Repository navigation
feat(context): retrieve tokens through interactive shell commands - #1531
Open
FelixJacobi wants to merge 2 commits into
Open
FelixJacobi wants to merge 2 commits into
FelixJacobi wants to merge 2 commits into
Conversation
Support read-only Git credential helpers per context so API tokens can remain in an external credential store. Resolve tokens lazily, preserve HCLOUD_TOKEN overrides, and keep retrieved secrets out of config output. Add a Passbolt adapter example, documentation, and regression coverage.
Author
|
After doing some research, I came to the conclusion, that the git credential helper protocol isn't the best choice since it only partly fits the requirements, I would consider something like Process credential provider - AWS SDKs and Tools. A problem is, that there is no proper standard for that. |
Replace the Git credential protocol with a per-context token_command. Capture and trim only stdout while inheriting stdin and stderr so secret managers can prompt for passphrases and PINs without an adapter. Keep resolution lazy and cached for the client lifecycle, retain HCLOUD_TOKEN overrides, and use the stored token when no command is set. Never persist the resolved token or include it in debug output. Add parsing, failure, interactive I/O, precedence, and secrecy tests, and document the new configuration and Passbolt raw-output example.
FelixJacobi
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Contexts currently persist API tokens in
cli.toml. This adds an optional per-contexttoken_commandso tokens can remain in an external secret store such as Passbolt.The Passbolt example assumes a version providing those raw-output flags. hcloud accepts any command that prints only its token to stdout, without a credential protocol or response schema.
hcloud context create --token-command '<command>' <name>creates and activates a context without executing the command or storing a token. On Unix the command runs through/bin/sh -c(on Windows,cmd.exe /D /C), inheriting stdin and stderr so interactive passphrase, PIN, and MFA prompts remain available. Only stdout is captured and surrounding whitespace is trimmed.Tokens are resolved lazily and cached for the client lifecycle. A nonempty
HCLOUD_TOKENtakes priority, followed by a nonblanktoken_command; when no command is configured, the existing stored token is used. Failed commands, empty output, and invalid header characters stop authentication without falling back to a stored token. Configuration inspection, help, and context management do not execute token commands, and resolved tokens never enter configuration output or debug traces.Includes configuration documentation and regenerated CLI reference documentation. The Git credential protocol, lookup URL, and Python adapter have been removed from this proposal.
Validation:
go test ./...go test -race ./internal/state/... ./internal/cmd/context/...Only the hcloud side is implemented here; this PR does not modify Passbolt. Live Passbolt integration was not tested.
Implementation and tests were developed with OpenAI Codex assistance.