Sign in once per hub: oxy auth login, status and logout (closes #47) ff1f62fee654

//! Per-user credentials for hubs: one sign-in serves every repository on a

//! hub, and nothing secret is written into a checkout.

//!

//! The store is `credentials.toml` in the user's oxy directory (see

//! [`crate::repo::default_home`]), one section per hub:

//!

//! ```text

//! [https://oxygenhub.io]

//! account = "andymccall"

//! token = "oxyhub_…"

//! ```

//!

//! A hub is a scheme, host and port: a token is only ever sent to the hub

//! it was stored for. The file is written readable by its owner only, and

//! is ignored with a warning when anyone else can read it. With

//! `auth.helper` set in the user's `config.toml`, tokens go to that helper

//! instead (Git's credential-helper protocol, so `libsecret`,

//! `osxkeychain` and `manager` keep them in the system keyring) and the

//! file keeps only what is not secret.

//!

//! A token is sent over `https`, or over plain `http` to this machine only

//! ([`token_allowed`]); hub transports drop it on any redirect.

use crate::protocol::RemoteOptions;

use std::collections::{BTreeMap, HashMap};

use std::io::Write;

use std::path::{Path, PathBuf};

use std::process::{Command, Stdio};

use std::sync::{Mutex, OnceLock};

/// The user name oxy's tokens are stored under in a credential helper, so

/// they stay apart from Git credentials for the same host.

const HELPER_USER: &str = "oxy-token";

/// The hub of a URL: `scheme://host[:port]`, lower case, for `http` and

/// `https` URLs only.

pub fn hub_of(url: &str) -> Option<String> {

    let (scheme, rest) = url.split_once("://")?;

    let scheme = scheme.to_ascii_lowercase();

    if scheme != "http" && scheme != "https" {

        return None;

    }

    let host = rest.split(['/', '?', '#']).next()?;

    // Never key a hub on credentials embedded in the URL.

    let host = host.rsplit('@').next()?;

    if host.is_empty() {

        return None;

    }

    Some(format!("{scheme}://{}", host.to_ascii_lowercase()))

}

/// Whether a token may be sent to `url`: always over `https`, and over

/// plain `http` only to this machine (a hub under test, or a runner's own).

pub fn token_allowed(url: &str) -> bool {

    let Some(hub) = hub_of(url) else {

        return true;

    };

    match hub.split_once("://") {

        Some(("https", _)) => true,

        Some((_, host)) => {

            let name = match host.strip_prefix('[') {

                Some(v6) => v6.split(']').next().unwrap_or(""),

                None => host.rsplit_once(':').map_or(host, |(h, _)| h),

            };

            name == "localhost"

                || name == "::1"

                || name

                    .parse::<std::net::Ipv4Addr>()

                    .is_ok_and(|a| a.is_loopback())

        }

        None => false,

    }

}

/// What the store holds for one hub.

#[derive(Clone, Debug, Default, PartialEq, Eq)]

pub struct HubEntry {

    /// `scheme://host[:port]`.

    pub hub: String,

    /// The account the token signs in as, recorded at sign-in.

    pub account: Option<String>,

    /// The token, when it is in the file (not with a helper).

    pub token: Option<String>,

    /// Extra roots to trust for this hub (a self-signed hub).

    pub ca: Option<PathBuf>,

}

/// Where a saved token went.

#[derive(Clone, Debug, PartialEq, Eq)]

pub enum Stored {

    /// The credentials file, owner-only.

    File(PathBuf),

    /// A credential helper, by its `auth.helper` value.

    Helper(String),

}

/// The credential store of one oxy home directory.

#[derive(Clone, Debug)]

pub struct Credentials {

    home: PathBuf,

}

impl Credentials {

    /// The store in `home` (an oxy home directory).

    pub fn at(home: impl Into<PathBuf>) -> Credentials {

        Credentials { home: home.into() }

    }

    /// The store in the user's oxy home directory.

    pub fn user() -> Credentials {

        Credentials::at(crate::repo::default_home())

    }

    /// `credentials.toml` in the home directory.

    pub fn path(&self) -> PathBuf {

        self.home.join("credentials.toml")

    }

    /// The configured credential helper (`auth.helper` in the user file).

    pub fn helper(&self) -> Option<String> {

        crate::repo::read_config_file(&self.home.join("config.toml"))

            .ok()?

            .remove("auth.helper")

            .filter(|h| !h.trim().is_empty())

    }

    /// Every hub in the file, tokens as stored there (none with a helper).

    pub fn entries(&self) -> Result<Vec<HubEntry>, String> {

        Ok(self.read()?.into_values().collect())

    }

    /// Whether the file can be read by anyone but its owner, in which case

    /// lookups ignore it.

    pub fn too_open(&self) -> bool {

        #[cfg(unix)]

        {

            use std::os::unix::fs::PermissionsExt;

            if let Ok(m) = std::fs::metadata(self.path()) {

                return m.permissions().mode() & 0o077 != 0;

            }

        }

        false

    }

    /// The entry for `hub`, its token fetched from the helper if one is set.

    pub fn get(&self, hub: &str) -> Result<Option<HubEntry>, String> {

        let entry = self.read()?.remove(hub);

        let helper = self.helper();

        let mut entry = match (entry, &helper) {

            (Some(e), _) => e,

            // A helper may hold a token stored before the file was cleared.

            (None, Some(_)) => HubEntry {

                hub: hub.to_string(),

                ..HubEntry::default()

            },

            (None, None) => return Ok(None),

        };

        if entry.token.is_none() {

            if let Some(h) = &helper {

                entry.token = run_helper(h, "get", hub, None)?;

            }

        }

        if entry.token.is_none() && entry.account.is_none() && entry.ca.is_none() {

            return Ok(None);

        }

        Ok(Some(entry))

    }

    /// Save a token (and what is known about it) for `hub`.

    pub fn save(

        &self,

        hub: &str,

        token: &str,

        account: Option<&str>,

        ca: Option<&Path>,

    ) -> Result<Stored, String> {

        let mut all = self.read()?;

        let helper = self.helper();

        let entry = all.entry(hub.to_string()).or_insert_with(|| HubEntry {

            hub: hub.to_string(),

            ..HubEntry::default()

        });

        entry.account = account.map(String::from).or(entry.account.take());

        if let Some(ca) = ca {

            entry.ca = Some(ca.to_path_buf());

        }

        let stored = match &helper {

            Some(h) => {

                run_helper(h, "store", hub, Some(token))?;

                entry.token = None;

                Stored::Helper(h.clone())

            }

            None => {

                entry.token = Some(token.to_string());

                Stored::File(self.path())

            }

        };

        self.write(&all)?;

        forget_cached();

        Ok(stored)

    }

    /// Remove `hub` from the file and the helper; returns what it held,

    /// with the token, so the caller can revoke it.

    pub fn remove(&self, hub: &str) -> Result<Option<HubEntry>, String> {

        let found = self.get(hub)?;

        let mut all = self.read()?;

        if all.remove(hub).is_some() {

            self.write(&all)?;

        }

        if let Some(h) = self.helper() {

            run_helper(&h, "erase", hub, None)?;

        }

        forget_cached();

        Ok(found)

    }

    fn read(&self) -> Result<BTreeMap<String, HubEntry>, String> {

        let path = self.path();

        let text = match std::fs::read_to_string(&path) {

            Ok(t) => t,

            Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(BTreeMap::new()),

            Err(e) => return Err(format!("reading {}: {e}", path.display())),

        };

        let mut out = BTreeMap::new();

        let mut current: Option<HubEntry> = None;

        for (n, line) in text.lines().enumerate() {

            let line = line.trim();

            if line.is_empty() || line.starts_with('#') {

                continue;

            }

            if let Some(hub) = line.strip_prefix('[').and_then(|l| l.strip_suffix(']')) {

                if let Some(e) = current.take() {

                    out.insert(e.hub.clone(), e);

                }

                current = Some(HubEntry {

                    hub: hub.trim().to_string(),

                    ..HubEntry::default()

                });

                continue;

            }

            let bad = || {

                format!(

                    "{} line {}: expected key = \"value\"",

                    path.display(),

                    n + 1

                )

            };

            let (k, v) = line.split_once('=').ok_or_else(bad)?;

            let v = unquote(v.trim()).ok_or_else(bad)?;

            let Some(e) = current.as_mut() else {

                return Err(format!(

                    "{} line {}: a key before any [hub] section",

                    path.display(),

                    n + 1

                ));

            };

            match k.trim() {

                "account" => e.account = Some(v),

                "token" => e.token = Some(v),

                "ca" => e.ca = Some(PathBuf::from(v)),

                // Unknown keys are kept out of lookups, not fatal.

                _ => {}

            }

        }

        if let Some(e) = current {

            out.insert(e.hub.clone(), e);

        }

        Ok(out)

    }

    fn write(&self, all: &BTreeMap<String, HubEntry>) -> Result<(), String> {

        let mut text =

            String::from("# oxy credentials: a token for each hub. Keep this file private.\n");

        for e in all.values() {

            text.push_str(&format!("\n[{}]\n", e.hub));

            if let Some(a) = &e.account {

                text.push_str(&format!("account = {}\n", quote(a)));

            }

            if let Some(t) = &e.token {

                text.push_str(&format!("token = {}\n", quote(t)));

            }

            if let Some(c) = &e.ca {

                text.push_str(&format!("ca = {}\n", quote(&c.to_string_lossy())));

            }

        }

        let path = self.path();

        std::fs::create_dir_all(&self.home)

            .map_err(|e| format!("creating {}: {e}", self.home.display()))?;

        crate::durable::write_atomic_private(&path, text.as_bytes())

            .map_err(|e| format!("writing {}: {e}", path.display()))

    }

    /// The stored token and CA for `url`'s hub, if any: memoized, so a

    /// helper runs once per hub in a process. A file anyone else can read

    /// is ignored, with a warning.

    pub fn lookup(&self, url: &str) -> (Option<String>, Option<PathBuf>) {

        let Some(hub) = hub_of(url) else {

            return (None, None);

        };

        let key = (self.home.clone(), hub.clone());

        if let Some(hit) = cache().lock().unwrap().get(&key) {

            return hit.clone();

        }

        let found = if self.too_open() {

            warn_once(&format!(

                "warning: {} can be read by other users, so oxy ignores it; run chmod 600 on it",

                self.path().display()

            ));

            (None, None)

        } else {

            match self.get(&hub) {

                Ok(Some(e)) => (e.token, e.ca),

                Ok(None) => (None, None),

                Err(e) => {

                    warn_once(&format!("warning: credentials for {hub}: {e}"));

                    (None, None)

                }

            }

        };

        cache().lock().unwrap().insert(key, found.clone());

        found

    }

    /// Options for reaching `url` without a configured remote: `$OXY_TOKEN`

    /// and `$OXY_CA`, else what this store holds for its hub.

    pub fn options_for(&self, url: &str) -> RemoteOptions {

        let env_token = std::env::var("OXY_TOKEN").ok().filter(|t| !t.is_empty());

        let env_ca = std::env::var("OXY_CA").ok().map(PathBuf::from);

        let (token, ca) = match (&env_token, &env_ca) {

            (Some(_), Some(_)) => (None, None),

            _ => self.lookup(url),

        };

        RemoteOptions {

            token: env_token.or(token),

            ca: env_ca.or(ca),

            repo_id: None,

        }

    }

}

type Cache = Mutex<HashMap<(PathBuf, String), (Option<String>, Option<PathBuf>)>>;

fn cache() -> &'static Cache {

    static CACHE: OnceLock<Cache> = OnceLock::new();

    CACHE.get_or_init(Default::default)

}

fn forget_cached() {

    cache().lock().unwrap().clear();

}

fn warn_once(message: &str) {

    static SEEN: OnceLock<Mutex<std::collections::HashSet<String>>> = OnceLock::new();

    if SEEN

        .get_or_init(Default::default)

        .lock()

        .unwrap()

        .insert(message.to_string())

    {

        eprintln!("{message}");

    }

}

fn quote(v: &str) -> String {

    let mut out = String::from('"');

    for c in v.chars() {

        match c {

            '"' => out.push_str("\\\""),

            '\\' => out.push_str("\\\\"),

            '\n' => out.push_str("\\n"),

            c => out.push(c),

        }

    }

    out.push('"');

    out

}

fn unquote(v: &str) -> Option<String> {

    let inner = v.strip_prefix('"')?.strip_suffix('"')?;

    let mut out = String::new();

    let mut chars = inner.chars();

    while let Some(c) = chars.next() {

        if c == '\\' {

            match chars.next()? {

                'n' => out.push('\n'),

                c => out.push(c),

            }

        } else {

            out.push(c);

        }

    }

    Some(out)

}

/// Run a credential helper (Git's protocol): `get`, `store` or `erase` for

/// `hub`. `get` returns the password the helper answered with.

///

/// `auth.helper` is a helper name (run as `git credential-NAME`), an

/// absolute path, or a shell command after `!`, as in Git.

fn run_helper(

    helper: &str,

    action: &str,

    hub: &str,

    token: Option<&str>,

) -> Result<Option<String>, String> {

    let (protocol, host) = hub

        .split_once("://")

        .ok_or_else(|| format!("{hub} is not a hub URL"))?;

    let mut cmd = if let Some(shell) = helper.strip_prefix('!') {

        let mut c = Command::new("sh");

        c.arg("-c").arg(format!("{shell} {action}"));

        c

    } else if Path::new(helper).is_absolute() {

        let mut c = Command::new(helper);

        c.arg(action);

        c

    } else {

        let mut c = Command::new("git");

        c.arg(format!("credential-{helper}")).arg(action);

        c

    };

    let mut input = format!("protocol={protocol}\nhost={host}\nusername={HELPER_USER}\n");

    if let Some(t) = token {

        input.push_str(&format!("password={t}\n"));

    }

    input.push('\n');

    let mut child = cmd

        .stdin(Stdio::piped())

        .stdout(Stdio::piped())

        .stderr(Stdio::inherit())

        .spawn()

        .map_err(|e| format!("running credential helper {helper:?}: {e}"))?;

    child

        .stdin

        .take()

        .expect("piped")

        .write_all(input.as_bytes())

        .map_err(|e| format!("credential helper {helper:?}: {e}"))?;

    let out = child

        .wait_with_output()

        .map_err(|e| format!("credential helper {helper:?}: {e}"))?;

    if !out.status.success() {

        return Err(format!("credential helper {helper:?} {action} failed"));

    }

    if action != "get" {

        return Ok(None);

    }

    Ok(String::from_utf8_lossy(&out.stdout)

        .lines()

        .find_map(|l| l.strip_prefix("password="))

        .map(String::from)

        .filter(|p| !p.is_empty()))

}

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn hubs_are_scheme_host_and_port() {

        assert_eq!(

            hub_of("https://OxygenHub.io/doomsdayone/metalgear").as_deref(),

            Some("https://oxygenhub.io")

        );

        assert_eq!(

            hub_of("http://127.0.0.1:7300/a/b").as_deref(),

            Some("http://127.0.0.1:7300")

        );

        assert_eq!(

            hub_of("https://user:[email protected]/x").as_deref(),

            Some("https://hub.example")

        );

        assert_eq!(hub_of("/srv/repo"), None);

        assert_eq!(hub_of("file:///srv/repo"), None);

    }

    #[test]

    fn tokens_go_over_https_or_to_this_machine() {

        assert!(token_allowed("https://oxygenhub.io/a/b"));

        assert!(token_allowed("http://127.0.0.1:7300/a/b"));

        assert!(token_allowed("http://localhost/a"));

        assert!(token_allowed("http://[::1]:8080/a"));

        assert!(!token_allowed("http://oxygenhub.io/a/b"));

        assert!(!token_allowed("http://10.0.0.1/a"));

        assert!(!token_allowed("http://127.0.0.1.evil.example/a"));

    }

    #[test]

    fn save_get_and_remove_round_trip_privately() {

        let dir = tempfile::tempdir().unwrap();

        let store = Credentials::at(dir.path());

        assert_eq!(store.get("https://hub.example").unwrap(), None);

        let stored = store

            .save("https://hub.example", "tok\"en", Some("andy"), None)

            .unwrap();

        assert_eq!(stored, Stored::File(store.path()));

        store

            .save(

                "http://127.0.0.1:7300",

                "local",

                None,

                Some(Path::new("/ca.pem")),

            )

            .unwrap();

        let e = store.get("https://hub.example").unwrap().unwrap();

        assert_eq!(e.token.as_deref(), Some("tok\"en"));

        assert_eq!(e.account.as_deref(), Some("andy"));

        assert!(!store.too_open());

        assert_eq!(

            store.lookup("https://hub.example/o/r"),

            (Some("tok\"en".into()), None)

        );

        // Another host, scheme or port gets nothing.

        assert_eq!(store.lookup("https://other.example/o/r"), (None, None));

        assert_eq!(store.lookup("http://hub.example/o/r"), (None, None));

        assert_eq!(store.lookup("https://hub.example:8443/o/r"), (None, None));

        let gone = store.remove("https://hub.example").unwrap().unwrap();

        assert_eq!(gone.token.as_deref(), Some("tok\"en"));

        assert_eq!(store.lookup("https://hub.example/o/r"), (None, None));

        assert_eq!(store.entries().unwrap().len(), 1);

    }

    #[cfg(unix)]

    #[test]

    fn a_file_others_can_read_is_ignored() {

        use std::os::unix::fs::PermissionsExt;

        let dir = tempfile::tempdir().unwrap();

        let store = Credentials::at(dir.path());

        store.save("https://open.example", "t", None, None).unwrap();

        let mode = std::fs::metadata(store.path())

            .unwrap()

            .permissions()

            .mode();

        assert_eq!(mode & 0o777, 0o600);

        std::fs::set_permissions(store.path(), std::fs::Permissions::from_mode(0o644)).unwrap();

        assert!(store.too_open());

        assert_eq!(store.lookup("https://open.example/o/r"), (None, None));

    }

    #[cfg(unix)]

    #[test]

    fn a_helper_keeps_the_token_out_of_the_file() {

        let dir = tempfile::tempdir().unwrap();

        let vault = dir.path().join("vault");

        // A helper that keeps one password in a file, as a keyring would.

        let helper = format!(

            "!f() {{ case $1 in get) [ -f {v} ] && echo password=$(cat {v});; store) sed -n 's/^password=//p' > {v};; erase) rm -f {v};; esac; }}; f",

            v = vault.display()

        );

        std::fs::write(

            dir.path().join("config.toml"),

            format!("auth.helper = \"{helper}\"\n"),

        )

        .unwrap();

        let store = Credentials::at(dir.path());

        assert!(store.helper().is_some());

        let stored = store

            .save("https://hub.example", "secret", Some("andy"), None)

            .unwrap();

        assert!(matches!(stored, Stored::Helper(_)));

        let text = std::fs::read_to_string(store.path()).unwrap();

        assert!(!text.contains("secret"), "{text}");

        assert_eq!(

            store

                .get("https://hub.example")

                .unwrap()

                .unwrap()

                .token

                .as_deref(),

            Some("secret")

        );

        store.remove("https://hub.example").unwrap();

        assert!(!vault.exists());

    }

}

//! `oxy auth`: sign in to a hub once, for every repository on it.

use super::ui;

use anyhow::{bail, Context, Result};

use oxy_core::credentials::{hub_of, token_allowed, Credentials, Stored};

use oxy_core::protocol::{http_json, RemoteOptions};

use oxy_core::repo::Repo;

use serde_json::Value;

use std::io::BufRead;

use std::path::{Path, PathBuf};

use std::time::{Duration, Instant};

/// The scopes oxy asks for: read and push repositories, and name the

/// account it signed in as.

const SCOPES: [&str; 3] = ["repo:read", "repo:write", "user:read"];

/// The hub named on the command line (a hub, a host, or any URL on it), else

/// that of this checkout's `origin` (or its only remote).

fn resolve_hub(arg: Option<&str>) -> Result<String> {

    if let Some(a) = arg {

        let url = if a.contains("://") {

            a.to_string()

        } else {

            format!("https://{a}")

        };

        return hub_of(&url).with_context(|| format!("{a} is not a hub URL"));

    }

    if let Ok(repo) = Repo::open(Path::new(".")) {

        let remotes = &repo.config.remotes;

        let url = remotes.get("origin").or_else(|| {

            (remotes.len() == 1)

                .then(|| remotes.values().next())

                .flatten()

        });

        if let Some(hub) = url.and_then(|u| hub_of(u)) {

            return Ok(hub);

        }

    }

    bail!("name the hub, as in: oxy auth login https://oxygenhub.io")

}

/// The account a token signs in as, from the hub's `/api/v1/user`.

fn whoami(hub: &str, options: &RemoteOptions) -> Result<std::result::Result<String, String>> {

    let (code, body) = http_json("GET", &format!("{hub}/api/v1/user"), None, options)

        .map_err(|e| anyhow::anyhow!("{e}"))?;

    if code != 200 {

        return Ok(Err(format!("HTTP {code}")));

    }

    let v: Value = serde_json::from_str(&body).context("the hub's answer about the account")?;

    Ok(v["username"]

        .as_str()

        .map(String::from)

        .ok_or_else(|| "no account in the answer".to_string()))

}

fn device_client() -> String {

    let host = std::fs::read_to_string("/etc/hostname")

        .ok()

        .or_else(|| std::env::var("COMPUTERNAME").ok())

        .map(|h| h.trim().to_string())

        .filter(|h| !h.is_empty());

    match host {

        Some(h) => format!("oxy on {h}"),

        None => "oxy".to_string(),

    }

}

/// The device sign-in (RFC 8628): show a code, wait for its approval on

/// the hub's web site, and return the token it grants.

fn device_sign_in(hub: &str, options: &RemoteOptions) -> Result<String> {

    let request = serde_json::json!({ "client": device_client(), "scopes": SCOPES }).to_string();

    let (code, body) = http_json(

        "POST",

        &format!("{hub}/api/v1/device/code"),

        Some(&request),

        options,

    )

    .map_err(|e| anyhow::anyhow!("{e}"))?;

    let v: Value = serde_json::from_str(&body)

        .with_context(|| format!("{hub} did not answer a sign-in request (HTTP {code})"))?;

    if code != 200 {

        bail!(

            "{hub} cannot sign in a device: {}",

            v["error_description"]

                .as_str()

                .or(v["detail"].as_str())

                .unwrap_or(&body)

        );

    }

    let device = v["device_code"]

        .as_str()

        .context("no device code")?

        .to_string();

    let user_code = v["user_code"].as_str().unwrap_or("?");

    let url = v["verification_uri_complete"]

        .as_str()

        .or(v["verification_uri"].as_str())

        .unwrap_or(hub);

    let mut interval = v["interval"].as_u64().unwrap_or(5).max(1);

    let deadline = Instant::now() + Duration::from_secs(v["expires_in"].as_u64().unwrap_or(900));

    eprintln!(

        "Open {} and approve the code {}",

        ui::path(url),

        ui::subject(user_code)

    );

    eprintln!(

        "  {} {}",

        ui::note(),

        ui::dim("approve only a code you started yourself, just now")

    );

    let sp = ui::spinner("Waiting for approval (Ctrl-C to give up)…");

    let poll = serde_json::json!({ "device_code": device }).to_string();

    loop {

        std::thread::sleep(Duration::from_secs(interval));

        if Instant::now() > deadline {

            sp.clear();

            bail!("the code expired before it was approved; run oxy auth login again");

        }

        let (code, body) = http_json(

            "POST",

            &format!("{hub}/api/v1/device/token"),

            Some(&poll),

            options,

        )

        .map_err(|e| anyhow::anyhow!("{e}"))?;

        let v: Value = serde_json::from_str(&body).unwrap_or_default();

        if code == 200 {

            sp.clear();

            return v["access_token"]

                .as_str()

                .map(String::from)

                .context("no token in the hub's answer");

        }

        match v["error"].as_str() {

            Some("authorization_pending") => {}

            Some("slow_down") => interval += 5,

            Some("access_denied") => {

                sp.clear();

                bail!("the sign-in was denied on the hub");

            }

            Some("expired_token") => {

                sp.clear();

                bail!("the code expired before it was approved; run oxy auth login again");

            }

            _ => {

                sp.clear();

                bail!("signing in: HTTP {code}: {}", body.trim());

            }

        }

    }

}

fn where_stored(stored: &Stored) -> String {

    match stored {

        Stored::File(p) => format!("{} (yours only)", p.display()),

        Stored::Helper(h) => format!("credential helper {h}"),

    }

}

pub fn login(hub: Option<&str>, with_token: bool, ca: Option<PathBuf>) -> Result<i32> {

    let hub = resolve_hub(hub)?;

    if !token_allowed(&hub) {

        bail!("{hub} is plain http: a token would cross the network unencrypted; sign in to its https address");

    }

    let store = Credentials::user();

    let ca = ca

        .map(|c| std::fs::canonicalize(&c).unwrap_or(c))

        .or_else(|| store.get(&hub).ok().flatten().and_then(|e| e.ca))

        .or_else(|| std::env::var("OXY_CA").ok().map(PathBuf::from));

    let anonymous = RemoteOptions {

        token: None,

        ca: ca.clone(),

        repo_id: None,

    };

    let token = if with_token {

        let mut line = String::new();

        std::io::stdin()

            .lock()

            .read_line(&mut line)

            .context("reading the token from standard input")?;

        let t = line.trim().to_string();

        if t.is_empty() {

            bail!("no token on standard input");

        }

        t

    } else {

        device_sign_in(&hub, &anonymous)?

    };

    let options = RemoteOptions {

        token: Some(token.clone()),

        ..anonymous

    };

    let account = match whoami(&hub, &options)? {

        Ok(a) => Some(a),

        Err(why) if with_token => bail!("{hub} did not accept the token ({why})"),

        // A token without user:read still serves repositories.

        Err(_) => None,

    };

    let stored = store

        .save(&hub, &token, account.as_deref(), ca.as_deref())

        .map_err(|e| anyhow::anyhow!("{e}"))?;

    let who = account

        .as_deref()

        .map(|a| format!(" as {}", ui::author(a)))

        .unwrap_or_default();

    println!("{} to {}{who}", ui::done("Signed in"), ui::path(&hub));

    println!(

        "  {} {}",

        ui::note(),

        ui::dim(format!("token in {}", where_stored(&stored)))

    );

    Ok(0)

}

/// The start of a token, enough to tell tokens apart and no more.

fn masked(token: &str) -> String {

    let shown: String = token.chars().take(10).collect();

    format!("{shown}…")

}

pub fn status() -> Result<i32> {

    let store = Credentials::user();

    let entries = store.entries().map_err(|e| anyhow::anyhow!("{e}"))?;

    if store.too_open() {

        println!(

            "{} {} {}",

            ui::caution(),

            ui::path(store.path().display()),

            ui::warn("can be read by other users, so oxy ignores it: run chmod 600 on it")

        );

    }

    if std::env::var("OXY_TOKEN").is_ok_and(|t| !t.is_empty()) {

        println!(

            "{} {}",

            ui::note(),

            ui::dim("OXY_TOKEN is set: it is used ahead of the tokens below, for every hub")

        );

    }

    if entries.is_empty() {

        println!(

            "{}",

            ui::dim("Not signed in to any hub: run oxy auth login HUB")

        );

        return Ok(0);

    }

    let helper = store.helper();

    let mut bad = false;

    for e in entries {

        let full = store.get(&e.hub).map_err(|e| anyhow::anyhow!("{e}"))?;

        let token = full.as_ref().and_then(|f| f.token.clone());

        println!("{}", ui::section(&e.hub));

        let Some(token) = token else {

            println!(

                "  {}",

                ui::warn("no token stored: run oxy auth login again")

            );

            bad = true;

            continue;

        };

        let options = RemoteOptions {

            token: Some(token.clone()),

            ca: e.ca.clone(),

            repo_id: None,

        };

        let check = match whoami(&e.hub, &options) {

            Ok(Ok(a)) => ui::ok(format!("valid, signed in as {a}")),

            Ok(Err(why)) if why == "HTTP 401" => {

                bad = true;

                ui::err("rejected by the hub: expired or revoked; run oxy auth login again")

            }

            Ok(Err(why)) => ui::warn(format!("not checked ({why})")),

            Err(e) => ui::warn(format!("not checked ({e})")),

        };

        println!(

            "{}",

            ui::kv("token", format!("{} {}", masked(&token), check))

        );

        if let Some(a) = &e.account {

            println!("{}", ui::kv("account", ui::author(a)));

        }

        let place = match &helper {

            Some(h) => format!("credential helper {h}"),

            None => store.path().display().to_string(),

        };

        println!("{}", ui::kv("stored", ui::dim(place)));

        if let Some(ca) = &e.ca {

            println!("{}", ui::kv("ca", ui::path(ca.display())));

        }

    }

    Ok(if bad { 1 } else { 0 })

}

pub fn logout(hub: Option<&str>) -> Result<i32> {

    let store = Credentials::user();

    let hub = match hub {

        Some(_) => resolve_hub(hub)?,

        None => {

            let entries = store.entries().map_err(|e| anyhow::anyhow!("{e}"))?;

            match (entries.len(), resolve_hub(None)) {

                (_, Ok(h)) => h,

                (1, Err(_)) => entries[0].hub.clone(),

                _ => bail!("name the hub to sign out of (oxy auth status lists them)"),

            }

        }

    };

    let Some(entry) = store.remove(&hub).map_err(|e| anyhow::anyhow!("{e}"))? else {

        println!("{}", ui::dim(format!("Not signed in to {hub}")));

        return Ok(0);

    };

    // Revoke the token on the hub too, so a copy left anywhere is useless.

    let revoked = match &entry.token {

        Some(t) => {

            let options = RemoteOptions {

                token: Some(t.clone()),

                ca: entry.ca.clone(),

                repo_id: None,

            };

            matches!(

                http_json(

                    "DELETE",

                    &format!("{hub}/api/v1/user/token"),

                    None,

                    &options

                ),

                Ok((200 | 204, _))

            )

        }

        None => false,

    };

    println!("{} of {}", ui::done("Signed out"), ui::path(&hub));

    if revoked {

        println!(

            "  {} {}",

            ui::note(),

            ui::dim("the token was revoked on the hub")

        );

    } else {

        println!(

            "  {} {}",

            ui::caution(),

            ui::warn("the hub did not revoke the token: revoke it under Settings → Tokens")

        );

    }

    Ok(0)

}

- **Sign in once per hub: `oxy auth login`, `status` and `logout` (#47).** `oxy auth login https://oxygenhub.io` signs in through the browser, and every repository on that hub then clones, fetches and pushes with the token, subrepos included. Nothing secret goes into a checkout any more.

  - The token is kept in `~/.config/oxy/credentials.toml`, readable by you only, or in the system keyring through a Git credential helper (`oxy config --user auth.helper libsecret`).

  - `--with-token` reads a token from standard input, for CI and scripts. `oxy auth logout` also revokes the token on the hub.

  - A token goes over `https` only (plain `http` only to this machine), never to another host after a redirect. A credentials file that others can read is ignored.

  - Lookup order: `remote.<name>.token`, `OXY_TOKEN`, the store, then an enclosing checkout's remote on the same hub. Clones no longer copy a token into a subrepo's configuration.

  - Identity secret keys are now created owner-only, rather than tightened just after being written.

Collaborating through a hub such as OxygenHub: sign in once, in the

browser, and every repository on that hub clones, fetches and pushes with it.

oxy auth login https://oxygenhub.io

oxy clone https://oxygenhub.io/owner/project

oxy push

oxy pull

```

Or with your own server:

```

echo SECRET | oxy auth login https://host:8890 --with-token

    write_atomic_mode(path, data, false)

}

/// [`write_atomic`] for a secret: on Unix the file is created readable by

/// its owner only, so the secret is never on disk with wider permissions.

pub fn write_atomic_private(path: &Path, data: &[u8]) -> io::Result<()> {

    write_atomic_mode(path, data, true)

}

fn write_atomic_mode(path: &Path, data: &[u8], private: bool) -> io::Result<()> {

        let mut open = fs::OpenOptions::new();

        open.write(true).create_new(true);

        #[cfg(unix)]

        if private {

            use std::os::unix::fs::OpenOptionsExt;

            open.mode(0o600);

        }

        #[cfg(not(unix))]

        let _ = private;

        let mut f = open.open(&tmp)?;

pub mod credentials;

        refuse_plain_token(base, options)?;

/// Refuse to send a token where anyone on the way could read it: plain

/// `http` to another machine (see [`crate::credentials::token_allowed`]).

fn refuse_plain_token(url: &str, options: &RemoteOptions) -> Result<()> {

    if options.token.is_some() && !crate::credentials::token_allowed(url) {

        return Err(RepoError::Msg(format!(

            "{url}: refusing to send a token over plain http; use https"

        )));

    }

    Ok(())

}

        "the hub needs you signed in, or did not accept the token: run `oxy auth login HUB` (pushing needs repo:write)"

        "nothing at this URL that you can see: check the owner and repository name; a private repository needs you signed in (`oxy auth login HUB`)"

    }

}

/// A JSON request to a hub API (`GET`, `POST` or `DELETE`), with the same

/// TLS trust and token rules as remotes. Returns the status and body, an

/// error status included; only transport failures are errors.

pub fn http_json(

    method: &str,

    url: &str,

    body: Option<&str>,

    options: &RemoteOptions,

) -> Result<(u16, String)> {

    refuse_plain_token(url, options)?;

    let agent = ureq::AgentBuilder::new()

        .tls_config(tls_client_config(options.ca.as_deref())?)

        .timeout(std::time::Duration::from_secs(60))

        .build();

    let mut req = agent.request(method, url).set("Accept", "application/json");

    if let Some(t) = &options.token {

        req = req.set("Authorization", &format!("Bearer {t}"));

    }

    let resp = match body {

        Some(b) => req.set("Content-Type", "application/json").send_string(b),

        None => req.call(),

    };

    match resp {

        Ok(r) => {

            let code = r.status();

            Ok((code, r.into_string().unwrap_or_default()))

        }

        Err(ureq::Error::Status(code, r)) => Ok((code, r.into_string().unwrap_or_default())),

        Err(e) => Err(RepoError::Msg(with_hint(e.to_string()))),

    refuse_plain_token(url, options)?;

            // Read by the credential store from the user file.

            "auth.helper" => {}

        crate::durable::write_atomic_private(&path, &sk.encode(&key))?;

    /// Credentials and trust for a remote: `remote.<name>.token` and

    /// `remote.<name>.ca`, else the defaults for its URL

    /// ([`Repo::fill_credentials`]).

        let url = self.config.remotes.get(name).cloned().unwrap_or_default();

        let mut options = RemoteOptions {

            token: self.config.remote_tokens.get(name).cloned(),

            ca: self.config.remote_cas.get(name).map(PathBuf::from),

        };

        self.fill_credentials(&url, &mut options);

        options

    }

    /// The user's credential store (`credentials.toml` beside the user

    /// configuration file).

    pub fn credentials(&self) -> crate::credentials::Credentials {

        crate::credentials::Credentials::at(

            self.user_config

                .parent()

                .map(Path::to_path_buf)

                .unwrap_or_else(default_home),

        )

    }

    /// Fill in what `options` lacks for `url`: `$OXY_TOKEN` and `$OXY_CA`,

    /// then the user's credential store for its hub, then a remote on the

    /// same hub in an enclosing checkout (a subrepo borrows its parent's).

    fn fill_credentials(&self, url: &str, options: &mut RemoteOptions) {

        if options.token.is_some() && options.ca.is_some() {

            return;

        }

        let stored = self.credentials().options_for(url);

        options.token = options.token.take().or(stored.token);

        options.ca = options.ca.take().or(stored.ca);

        if options.token.is_some() && options.ca.is_some() {

            return;

        let Some(hub) = crate::credentials::hub_of(url) else {

            return;

        };

        let mut at = self.root.parent();

        while let Some(dir) = at {

            let Ok(cfg) = read_config_file(&dir.join(OXY_DIR).join("config")) else {

                break;

            };

            for (key, remote_url) in &cfg {

                let Some(name) = key

                    .strip_prefix("remote.")

                    .and_then(|k| k.strip_suffix(".url"))

                else {

                    continue;

                };

                if crate::credentials::hub_of(remote_url).as_deref() != Some(hub.as_str()) {

                    continue;

                }

                if options.token.is_none() {

                    options.token = cfg.get(&format!("remote.{name}.token")).cloned();

                }

                if options.ca.is_none() {

                    options.ca = cfg.get(&format!("remote.{name}.ca")).map(PathBuf::from);

                }

            }

            if options.token.is_some() && options.ca.is_some() {

                return;

            }

            at = dir.parent();

        }

    /// credentials (see [`Repo::credentials_for`]).

            ..self.credentials_for(url)

                ..self.credentials_for(url)

        let options = crate::credentials::Credentials::user().options_for(url);

        Self::clone_using(url, dest, max_blob, sparse, depth, &options)

    /// Clone a subrepo with the credentials the parent would use for its

    /// hub (see [`Repo::credentials_for`]). Nothing is recorded in the

    /// subrepo: it finds the same ones again through its parent.

        Self::clone_using(url, dest, None, &[], None, &options)

    /// environment's (`OXY_TOKEN`, `OXY_CA`), the user's credential store