nullkey
41a98b5743
New v0.3 P0 entry 3-4: kubectl-style context-management subtree using gh's `<noun> <verb>` surface convention consistent with the rest of this CLI. - context list: tabwriter rendering + --json envelope; reads config.yaml only. - context add <name> --host <url> [--user]: validates http(s) URL, first context auto-becomes current, rejects duplicates with did-you-mean. - context remove <name>: best-effort keyring cleanup like `auth logout`. Removing the current context triggers exit-10 confirmation (lark-cli skill protocol) — subsequent commands would lose their default --context. (`context use` predates v0.3; the subtree was previously use-only.) Bugs caught and fixed inline by the post-commit reviewer round: - auth login was accepting `http://` (empty host portion) because the old validateHost only checked the scheme. New cmdutil.NormalizeHost (shared by both login and context add) requires u.Host != "". - context add's validateName claimed `..` was rejected but only denied / \\ space. Switched to positive allowlist [A-Za-z0-9._-] plus explicit ./../path-separator rejection. Helper consolidation: - cli/internal/cmdutil/host.go: NormalizeHost (trim, scheme, host non-empty) — both auth login and context add share it. - cli/internal/format/dash.go: DashIfEmpty — promoted from copies in cmd/auth/list.go and cmd/context/list.go. - recordingStore test stub dropped in favor of secrets.NewMemStore; contextKeyList test helper replaced by the existing contextKeys. 14 unit tests; 13 e2e branches verified. Roadmap: 3-4.
98 lines
2.7 KiB
Go
98 lines
2.7 KiB
Go
package auth
|
|
|
|
import (
|
|
"fmt"
|
|
"sort"
|
|
"text/tabwriter"
|
|
|
|
"github.com/spf13/cobra"
|
|
|
|
"github.com/Tencent/WeKnora/cli/internal/cmdutil"
|
|
"github.com/Tencent/WeKnora/cli/internal/format"
|
|
"github.com/Tencent/WeKnora/cli/internal/iostreams"
|
|
)
|
|
|
|
// ListOptions captures `weknora auth list` flag state.
|
|
type ListOptions struct {
|
|
JSONOut bool
|
|
}
|
|
|
|
// listEntry is one row in the rendered list / one element of envelope.data.
|
|
type listEntry struct {
|
|
Name string `json:"name"`
|
|
Host string `json:"host"`
|
|
User string `json:"user,omitempty"`
|
|
Mode string `json:"mode"` // "api-key" / "password" / "unknown"
|
|
Current bool `json:"current"`
|
|
}
|
|
|
|
// NewCmdList builds `weknora auth list`. Mirrors gh's per-host enumeration
|
|
// and lark `auth list`: render one row per registered context, marking the
|
|
// active one. Reads only ~/.config/weknora/config.yaml — no network, no
|
|
// keyring touch.
|
|
func NewCmdList(f *cmdutil.Factory) *cobra.Command {
|
|
opts := &ListOptions{}
|
|
cmd := &cobra.Command{
|
|
Use: "list",
|
|
Short: "List configured authentication contexts",
|
|
Args: cobra.NoArgs,
|
|
RunE: func(c *cobra.Command, _ []string) error {
|
|
return runList(opts, f)
|
|
},
|
|
}
|
|
cmd.Flags().BoolVar(&opts.JSONOut, "json", false, "Output JSON envelope")
|
|
return cmd
|
|
}
|
|
|
|
func runList(opts *ListOptions, f *cmdutil.Factory) error {
|
|
cfg, err := f.Config()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
entries := make([]listEntry, 0, len(cfg.Contexts))
|
|
for name, c := range cfg.Contexts {
|
|
entries = append(entries, listEntry{
|
|
Name: name,
|
|
Host: c.Host,
|
|
User: c.User,
|
|
Mode: inferMode(c.APIKeyRef, c.TokenRef),
|
|
Current: name == cfg.CurrentContext,
|
|
})
|
|
}
|
|
sort.Slice(entries, func(i, j int) bool { return entries[i].Name < entries[j].Name })
|
|
|
|
if opts.JSONOut {
|
|
return cmdutil.NewJSONExporter().Write(iostreams.IO.Out,
|
|
format.Success(entries, &format.Meta{Context: cfg.CurrentContext}))
|
|
}
|
|
if len(entries) == 0 {
|
|
fmt.Fprintln(iostreams.IO.Out, "No contexts configured. Run `weknora auth login` to create one.")
|
|
return nil
|
|
}
|
|
tw := tabwriter.NewWriter(iostreams.IO.Out, 0, 0, 2, ' ', 0)
|
|
fmt.Fprintln(tw, " NAME\tHOST\tUSER\tMODE")
|
|
for _, e := range entries {
|
|
marker := " "
|
|
if e.Current {
|
|
marker = "* "
|
|
}
|
|
fmt.Fprintf(tw, "%s%s\t%s\t%s\t%s\n", marker, e.Name, e.Host, format.DashIfEmpty(e.User), e.Mode)
|
|
}
|
|
return tw.Flush()
|
|
}
|
|
|
|
// inferMode reports which credential shape the context was logged in with.
|
|
// A context with both refs set (which shouldn't happen with the current
|
|
// login flow but might appear in hand-edited configs) is treated as
|
|
// password — JWT wins because it's the more capable mode.
|
|
func inferMode(apiKeyRef, tokenRef string) string {
|
|
switch {
|
|
case tokenRef != "":
|
|
return "password"
|
|
case apiKeyRef != "":
|
|
return "api-key"
|
|
default:
|
|
return "unknown"
|
|
}
|
|
}
|