auth

Documentation

Overview

Package auth models Bitbucket credentials, resolves them from configuration or secure storage, and applies them to outgoing HTTP requests.

Index

• Constants
• Variables
• func AccountKey(baseURL, scheme string) string
• func Forget(baseURL, scheme string, store *Store) error
• func Save(baseURL string, cred Credential, store *Store) (string, error)
• type Credential
  • func Resolve(cfg config.Config, secrets config.Secrets, store *Store) (Credential, error)
  • func (c Credential) Decorator() transport.Decorator
  • func (c Credential) Header() string
  • func (c Credential) Redacted() Credential
  • func (c Credential) Validate() error
• type Store
  • func NewStore(dir string) *Store
  • func (s *Store) Delete(account string) error
  • func (s *Store) Load(account string) (string, error)
  • func (s *Store) Save(account, secret string) (string, error)
• type StoreAccessError
  • func (e *StoreAccessError) Error() string
  • func (e *StoreAccessError) Unwrap() error

Constants

const (
	SchemePAT   = "pat"   // Bearer Personal Access Token (Data Center 7.9+)
	SchemeBasic = "basic" // HTTP Basic (DC: user+password; Cloud: email+API token)
)

Scheme identifies an authentication scheme.

const (
	BackendKeychain = "keychain"
	BackendFile     = "file"
)

Backend names reported by Save.

Variables

var ErrSecretNotFound = errors.New("secret not found")

ErrSecretNotFound is returned by a Store when no secret exists for an account.

Functions

func AccountKey

func AccountKey(baseURL, scheme string) string

AccountKey derives the keychain account identifier for a base URL and scheme. It is stable across runs so credentials can be located later.

func Forget

func Forget(baseURL, scheme string, store *Store) error

Forget removes any stored secret for the base URL and scheme.

func Save

func Save(baseURL string, cred Credential, store *Store) (string, error)

Save stores a credential's secret for later resolution and returns the backend ("keychain" or "file") that accepted it.

Types

type Credential

type Credential struct {
	Scheme   string
	Username string // basic only
	Secret   string // PAT token, or password / API token
}

Credential is a fully resolved credential ready to authenticate requests.

func Resolve

func Resolve(cfg config.Config, secrets config.Secrets, store *Store) (Credential, error)

Resolve produces a Credential from configuration. A secret supplied via flags/env/.env (carried in secrets) takes precedence; otherwise the secret is loaded from the Store. The returned credential is validated.

func (Credential) Decorator

func (c Credential) Decorator() transport.Decorator

Decorator returns a transport.Decorator that authenticates every request.

func (Credential) Header

func (c Credential) Header() string

Header returns the Authorization header value for the credential.

func (Credential) Redacted

func (c Credential) Redacted() Credential

Redacted returns a copy safe for logging: the secret is masked.

func (Credential) Validate

func (c Credential) Validate() error

Validate reports whether the credential is internally consistent.

type Store

type Store struct {
	// contains filtered or unexported fields
}

Store persists secrets. It prefers the OS keychain and transparently falls back to a protected file under the config directory when the keychain is unavailable. Windows encrypts the fallback with per-user DPAPI; other platforms retain the existing 0600 file behavior.

func NewStore

func NewStore(dir string) *Store

NewStore returns a Store whose file fallback lives in dir.

func (*Store) Delete

func (s *Store) Delete(account string) error

Delete removes the secret for account from both backends. Missing entries are not an error.

func (*Store) Load

func (s *Store) Load(account string) (string, error)

Load retrieves the secret for account, trying the keychain then the file. It returns ErrSecretNotFound when neither holds a value.

func (*Store) Save

func (s *Store) Save(account, secret string) (string, error)

Save stores secret for account and returns the backend that accepted it.

type StoreAccessError

type StoreAccessError struct {
	Backend string
	Err     error
}

StoreAccessError means the credential store could not be inspected. It is intentionally distinct from ErrSecretNotFound: a caller must not tell the user to reconfigure credentials when a sandbox merely hid the keychain.

func (*StoreAccessError) Error

func (e *StoreAccessError) Error() string

func (*StoreAccessError) Unwrap

func (e *StoreAccessError) Unwrap() error