-
Notifications
You must be signed in to change notification settings - Fork 48
SUP-5203: use keychain for api token #562
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
mcncl
wants to merge
3
commits into
main
Choose a base branch
from
bm/apitoken_keychain
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,141 @@ | ||
| package config | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "os" | ||
|
|
||
| "github.com/zalando/go-keyring" | ||
| ) | ||
|
|
||
| const ( | ||
| // KeychainServiceName is the service name used when storing tokens in the system keychain | ||
| KeychainServiceName = "com.buildkite.cli" | ||
|
|
||
| // EnvVarTokenStorage allows users to override token storage mechanism | ||
| // Valid values: "keychain" (default), "file" | ||
| EnvVarTokenStorage = "BUILDKITE_TOKEN_STORAGE" | ||
| ) | ||
|
|
||
| // TokenStorage defines the interface for storing and retrieving API tokens | ||
| type TokenStorage interface { | ||
| Get(org string) (string, error) | ||
| Set(org, token string) error | ||
| Delete(org string) error | ||
| List() ([]string, error) | ||
| } | ||
|
|
||
| // KeychainTokenStorage stores tokens in the system keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service) | ||
| type KeychainTokenStorage struct { | ||
| serviceName string | ||
| } | ||
|
|
||
| // NewKeychainTokenStorage creates a new keychain-based token storage | ||
| func NewKeychainTokenStorage() *KeychainTokenStorage { | ||
| return &KeychainTokenStorage{ | ||
| serviceName: KeychainServiceName, | ||
| } | ||
| } | ||
|
|
||
| // Get retrieves a token for the given organization from the keychain | ||
| func (k *KeychainTokenStorage) Get(org string) (string, error) { | ||
| token, err := keyring.Get(k.serviceName, org) | ||
| if err == keyring.ErrNotFound { | ||
| return "", fmt.Errorf("no token found for organization %q", org) | ||
| } | ||
| if err != nil { | ||
| return "", fmt.Errorf("failed to get token from keychain: %w", err) | ||
| } | ||
| return token, nil | ||
| } | ||
|
|
||
| // Set stores a token for the given organization in the keychain | ||
| func (k *KeychainTokenStorage) Set(org, token string) error { | ||
| if err := keyring.Set(k.serviceName, org, token); err != nil { | ||
| return fmt.Errorf("failed to set token in keychain: %w", err) | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| // Delete removes a token for the given organization from the keychain | ||
| func (k *KeychainTokenStorage) Delete(org string) error { | ||
| if err := keyring.Delete(k.serviceName, org); err != nil { | ||
| return fmt.Errorf("failed to delete token from keychain: %w", err) | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| // List returns all organizations that have tokens stored in the keychain | ||
| // Note: This is not directly supported by the keychain API, so we'll return an empty list | ||
| // and rely on the file-based config for listing organizations | ||
| func (k *KeychainTokenStorage) List() ([]string, error) { | ||
| return []string{}, nil | ||
| } | ||
|
|
||
| // FileTokenStorage stores tokens in the configuration file (legacy/fallback mode) | ||
| type FileTokenStorage struct { | ||
| conf *Config | ||
| } | ||
|
|
||
| // NewFileTokenStorage creates a new file-based token storage | ||
| func NewFileTokenStorage(conf *Config) *FileTokenStorage { | ||
| return &FileTokenStorage{ | ||
| conf: conf, | ||
| } | ||
| } | ||
|
|
||
| // Get retrieves a token for the given organization from the config file | ||
| func (f *FileTokenStorage) Get(org string) (string, error) { | ||
| key := fmt.Sprintf("organizations.%s.api_token", org) | ||
| token := f.conf.userConfig.GetString(key) | ||
| if token == "" { | ||
| return "", fmt.Errorf("no token found for organization %q", org) | ||
| } | ||
| return token, nil | ||
| } | ||
|
|
||
| // Set stores a token for the given organization in the config file | ||
| func (f *FileTokenStorage) Set(org, token string) error { | ||
| key := fmt.Sprintf("organizations.%s.api_token", org) | ||
| f.conf.userConfig.Set(key, token) | ||
| return f.conf.userConfig.WriteConfig() | ||
| } | ||
|
|
||
| // Delete removes a token for the given organization from the config file | ||
| func (f *FileTokenStorage) Delete(org string) error { | ||
| key := fmt.Sprintf("organizations.%s.api_token", org) | ||
| f.conf.userConfig.Set(key, nil) | ||
| return f.conf.userConfig.WriteConfig() | ||
| } | ||
|
|
||
| // List returns all organizations that have tokens stored in the config file | ||
| func (f *FileTokenStorage) List() ([]string, error) { | ||
| orgsMap := f.conf.userConfig.GetStringMap("organizations") | ||
| orgs := make([]string, 0, len(orgsMap)) | ||
| for org := range orgsMap { | ||
| // Check if this org actually has a token | ||
| key := fmt.Sprintf("organizations.%s.api_token", org) | ||
| if f.conf.userConfig.GetString(key) != "" { | ||
| orgs = append(orgs, org) | ||
| } | ||
| } | ||
| return orgs, nil | ||
| } | ||
|
|
||
| // getTokenStorageBackend determines which token storage backend to use based on environment variables | ||
| func getTokenStorageBackend() string { | ||
| backend := os.Getenv(EnvVarTokenStorage) | ||
| if backend == "" { | ||
| return "keychain" // Default to keychain | ||
| } | ||
| return backend | ||
| } | ||
|
|
||
| // ShouldUseKeychain returns true if keychain storage should be used | ||
| func ShouldUseKeychain() bool { | ||
| return getTokenStorageBackend() == "keychain" | ||
| } | ||
|
|
||
| // Deprecated: use ShouldUseKeychain instead | ||
| func shouldUseKeychain() bool { | ||
| return ShouldUseKeychain() | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@scadu this section should be what you're after
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@mcncl ah, thanks for pointing that! Nice!