nullkey
ca90ce422f
gh / lark / gcloud / stripe all ship a logout command and a way to
enumerate stored credentials on day one. WeKnora's `auth` subtree had
only login + status, leaving no documented purge path for keyring
secrets — a real concern for `--with-token` (sk-…) and JWT flows that
write credentials to OS keychains.
auth logout [--name <ctx>] [--all] [--json]
Clears keyring + file-fallback secrets (access / refresh / api_key
slots) for the named context (default: current) or every context
with --all. Removes the context entry from ~/.config/weknora/config.yaml
and clears current_context if the removed entry was active.
Mirrors `gh auth logout` and `lark auth logout`. As gh documents,
this does NOT revoke server-side — for API keys users must rotate in
the server UI, JWTs continue to be accepted until expiry.
auth list [--json]
Renders a compact table (NAME / HOST / USER / MODE) with the active
context marked `*`. Reads only config.yaml — no network, no keyring
touch. Mode is inferred from which credential ref is set (api_key
→ "api-key", token → "password"; both → "password" wins).
Mirrors gh's per-host enumeration (gh auth status iterates accounts)
and lark `auth list`. For weknora the contexts file already had this
data — the command is a thin renderer to match user muscle memory.
Deferred to a follow-up release:
- auth refresh + transparent 401 retry in the SDK (we already persist
refresh_token at login but never spend it; explicit gap)
- login --web browser OAuth flow (requires a server-side endpoint)
- auth token printer (cheap; defer with the rest)
Tests: 24 cli packages green. New: cmd/auth/logout_test.go (current
context, named, --all, no-contexts, unknown-name, no-current-no-flag,
mutex flags) + cmd/auth/list_test.go (human render, empty, JSON
envelope, inferMode edge cases). AGENTS.md command-surface note adds
the four-command auth subtree; screenshot section 4 adds `auth list`
alongside `auth status`.
105 lines
2.8 KiB
Go
105 lines
2.8 KiB
Go
package auth
|
|
|
|
import (
|
|
"fmt"
|
|
"sort"
|
|
"text/tabwriter"
|
|
|
|
"github.com/spf13/cobra"
|
|
|
|
"github.com/Tencent/WeKnora/cli/internal/cmdutil"
|
|
"github.com/Tencent/WeKnora/cli/internal/format"
|
|
"github.com/Tencent/WeKnora/cli/internal/iostreams"
|
|
)
|
|
|
|
// ListOptions captures `weknora auth list` flag state.
|
|
type ListOptions struct {
|
|
JSONOut bool
|
|
}
|
|
|
|
// listEntry is one row in the rendered list / one element of envelope.data.
|
|
type listEntry struct {
|
|
Name string `json:"name"`
|
|
Host string `json:"host"`
|
|
User string `json:"user,omitempty"`
|
|
Mode string `json:"mode"` // "api-key" / "password" / "unknown"
|
|
Current bool `json:"current"`
|
|
}
|
|
|
|
// NewCmdList builds `weknora auth list`. Mirrors gh's per-host enumeration
|
|
// and lark `auth list`: render one row per registered context, marking the
|
|
// active one. Reads only ~/.config/weknora/config.yaml — no network, no
|
|
// keyring touch.
|
|
func NewCmdList(f *cmdutil.Factory) *cobra.Command {
|
|
opts := &ListOptions{}
|
|
cmd := &cobra.Command{
|
|
Use: "list",
|
|
Short: "List configured authentication contexts",
|
|
Args: cobra.NoArgs,
|
|
RunE: func(c *cobra.Command, _ []string) error {
|
|
return runList(opts, f)
|
|
},
|
|
}
|
|
cmd.Flags().BoolVar(&opts.JSONOut, "json", false, "Output JSON envelope")
|
|
return cmd
|
|
}
|
|
|
|
func runList(opts *ListOptions, f *cmdutil.Factory) error {
|
|
cfg, err := f.Config()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
entries := make([]listEntry, 0, len(cfg.Contexts))
|
|
for name, c := range cfg.Contexts {
|
|
entries = append(entries, listEntry{
|
|
Name: name,
|
|
Host: c.Host,
|
|
User: c.User,
|
|
Mode: inferMode(c.APIKeyRef, c.TokenRef),
|
|
Current: name == cfg.CurrentContext,
|
|
})
|
|
}
|
|
sort.Slice(entries, func(i, j int) bool { return entries[i].Name < entries[j].Name })
|
|
|
|
if opts.JSONOut {
|
|
return cmdutil.NewJSONExporter().Write(iostreams.IO.Out,
|
|
format.Success(entries, &format.Meta{Context: cfg.CurrentContext}))
|
|
}
|
|
if len(entries) == 0 {
|
|
fmt.Fprintln(iostreams.IO.Out, "No contexts configured. Run `weknora auth login` to create one.")
|
|
return nil
|
|
}
|
|
tw := tabwriter.NewWriter(iostreams.IO.Out, 0, 0, 2, ' ', 0)
|
|
fmt.Fprintln(tw, " NAME\tHOST\tUSER\tMODE")
|
|
for _, e := range entries {
|
|
marker := " "
|
|
if e.Current {
|
|
marker = "* "
|
|
}
|
|
fmt.Fprintf(tw, "%s%s\t%s\t%s\t%s\n", marker, e.Name, e.Host, dashIfEmpty(e.User), e.Mode)
|
|
}
|
|
return tw.Flush()
|
|
}
|
|
|
|
// inferMode reports which credential shape the context was logged in with.
|
|
// A context with both refs set (which shouldn't happen with the current
|
|
// login flow but might appear in hand-edited configs) is treated as
|
|
// password — JWT wins because it's the more capable mode.
|
|
func inferMode(apiKeyRef, tokenRef string) string {
|
|
switch {
|
|
case tokenRef != "":
|
|
return "password"
|
|
case apiKeyRef != "":
|
|
return "api-key"
|
|
default:
|
|
return "unknown"
|
|
}
|
|
}
|
|
|
|
func dashIfEmpty(s string) string {
|
|
if s == "" {
|
|
return "-"
|
|
}
|
|
return s
|
|
}
|