Log in once per hub: a per-user credential store and oxy auth issue #47 closed: completed andymccall opened this 1 month ago · 0 comments

Today oxy takes a token only from OXY_TOKEN or a remote's saved token in .oxy/config, and clone does not keep it, so a private repository needs the token on every clone, and submodules on the same hub cannot use it. oh keeps its own token separately.

• A per-user store keyed by hub (scheme, host and port): the system keyring where there is one, else ~/.config/oxy/credentials.toml, owner-only.
• oxy auth login [HUB] through the hub's device sign-in; oxy auth status and oxy auth logout.
• Lookup: remote.NAME.token, then OXY_TOKEN, then the store for the URL's hub. Clone, fetch, push and submodules all use it.
• Tokens are no longer written into checkouts.
• Never send a token over plain http, or to another host after a redirect.