kcl-lang / kpm / 33355443416

47%

main: 47%

Build Type

Pull #768

github

Committed by Peefy

Commit Message

feat(auth): refresh provider-minted OCI credentials on pull

`kpm login --provider=gcp` (PR #766) writes a short-lived OAuth
token to the ORAS credential store. On subsequent pulls, ORAS sees
that cached token directly and has no idea it came from GCP — so it
fails silently after ~1h when the token expires.

This PR wires the OCI client through a dynamic
[remoteauth.CredentialFunc] that ORAS re-enters on every 401. A new
sidecar `providers.json` maps `host -> provider` so a follow-up
`kpm pull` knows to mint a fresh credential via the matching
`auth.Provider` instead of reading the stale ORAS-stored token.

Changes:
- pkg/auth/store.go — small JSON sidecar store with atomic writes,
  lazy load, and sync.RWMutex concurrency.
- pkg/auth/resolve.go — Resolver that consults ProviderStore first
  and falls back to the ORAS credentials.Store.
- pkg/oci/oci.go — new WithCredentialFunc option; WithCredential
  preserved for backwards compatibility (CredentialFunc wins if
  both are passed).
- pkg/downloader/credential.go — CredStore.Resolver() exposes the
  sidecar+fallback chain as an auth.CredentialFunc.
- pkg/downloader/downloader.go — both OCI client call sites now use
  credentialOptionFor(...) which returns the right option based on
  whether credsStore is set, and rejects empty hostName (matching
  the previous behaviour of CredStore.Credential).
- pkg/checker/checker.go — SumChecker.GetCredentialFunc() so the
  manifest fetch uses dynamic resolution.
- pkg/client/{client,push}.go — KpmClient.CredentialFunc() so push
  uses dynamic resolution too.
- pkg/cmd/cmd_login.go — after a non-basic login, record
  host -> providerName in the sidecar so subsequent pulls know
  which provider to invoke.
- pkg/cmd/cmd_logout.go — best-effort: also drop the host from the
  sidecar so post-logout pulls fall back to anonymous / static.

Why a sidecar instead of extending config.json: ORAS owns
config.json and would happily overwrite any extra fields it does
not under... (continued)

Pull Request Pull Request #768: feat(auth): refresh provider-minted OCI credentials on pull

Coverage Stats

131 of 222 new or added lines in 10 files covered. (59.01%)

16 existing lines in 4 files now uncovered.

5175 of 11059 relevant lines covered (46.79%)

0.53 hits per line