nullkey
ca90ce422f
gh / lark / gcloud / stripe all ship a logout command and a way to
enumerate stored credentials on day one. WeKnora's `auth` subtree had
only login + status, leaving no documented purge path for keyring
secrets — a real concern for `--with-token` (sk-…) and JWT flows that
write credentials to OS keychains.
auth logout [--name <ctx>] [--all] [--json]
Clears keyring + file-fallback secrets (access / refresh / api_key
slots) for the named context (default: current) or every context
with --all. Removes the context entry from ~/.config/weknora/config.yaml
and clears current_context if the removed entry was active.
Mirrors `gh auth logout` and `lark auth logout`. As gh documents,
this does NOT revoke server-side — for API keys users must rotate in
the server UI, JWTs continue to be accepted until expiry.
auth list [--json]
Renders a compact table (NAME / HOST / USER / MODE) with the active
context marked `*`. Reads only config.yaml — no network, no keyring
touch. Mode is inferred from which credential ref is set (api_key
→ "api-key", token → "password"; both → "password" wins).
Mirrors gh's per-host enumeration (gh auth status iterates accounts)
and lark `auth list`. For weknora the contexts file already had this
data — the command is a thin renderer to match user muscle memory.
Deferred to a follow-up release:
- auth refresh + transparent 401 retry in the SDK (we already persist
refresh_token at login but never spend it; explicit gap)
- login --web browser OAuth flow (requires a server-side endpoint)
- auth token printer (cheap; defer with the rest)
Tests: 24 cli packages green. New: cmd/auth/logout_test.go (current
context, named, --all, no-contexts, unknown-name, no-current-no-flag,
mutex flags) + cmd/auth/list_test.go (human render, empty, JSON
envelope, inferMode edge cases). AGENTS.md command-surface note adds
the four-command auth subtree; screenshot section 4 adds `auth list`
alongside `auth status`.
32 lines
1.1 KiB
Go
32 lines
1.1 KiB
Go
// Package auth holds the cobra commands for authentication
|
|
// (login / logout / list / status). Token refresh is deferred to v0.3 once
|
|
// the SDK gains automatic 401 retry against the stored refresh_token.
|
|
package auth
|
|
|
|
import (
|
|
"github.com/spf13/cobra"
|
|
|
|
"github.com/Tencent/WeKnora/cli/internal/cmdutil"
|
|
)
|
|
|
|
// NewCmdAuth builds the `weknora auth` command tree and registers its
|
|
// subcommands. Called from cli/cmd/root.go.
|
|
func NewCmdAuth(f *cmdutil.Factory) *cobra.Command {
|
|
cmd := &cobra.Command{
|
|
Use: "auth",
|
|
Short: "Manage authentication credentials and contexts",
|
|
// NoArgs makes cobra emit its canonical `unknown command "X" for
|
|
// "weknora auth"` for any positional, which mapCobraError tags as
|
|
// FlagError → exit 2. Run (not RunE) is required: a parent with
|
|
// neither Run nor RunE short-circuits to help and skips Args
|
|
// validation entirely.
|
|
Args: cobra.NoArgs,
|
|
Run: func(c *cobra.Command, _ []string) { _ = c.Help() },
|
|
}
|
|
cmd.AddCommand(NewCmdLogin(f, nil))
|
|
cmd.AddCommand(NewCmdLogout(f))
|
|
cmd.AddCommand(NewCmdList(f))
|
|
cmd.AddCommand(NewCmdStatus(f))
|
|
return cmd
|
|
}
|