90baa0528f## Summary Fixes #663 - **Security fix**: `mcp-publisher login` no longer writes `.mcpregistry_github_token` and `.mcpregistry_registry_token` to the current working directory. GitHub tokens are kept in memory during the login→exchange flow and cleared immediately after. - **Token location**: Unified token moved from `~/.mcp_publisher_token` to `~/.config/mcp-publisher/token.json` (dir 0700, file 0600), following the convention used by `gh`, `docker`, and `kubectl`. - **Dead code removed**: `NeedsLogin()` was on the `Provider` interface but never called — removed from interface and all 4 implementations. `forceLogin` field also removed. - **Auth tests added**: 11 new tests for `GitHubATProvider` (package previously had 0 tests). - **Test isolation**: `SetupTestToken` now uses `t.TempDir()` + `t.Setenv("HOME", ...)` instead of writing to real `$HOME`. ### Breaking change Users must re-login after upgrading (`mcp-publisher login <method>`). Existing tokens at `~/.mcp_publisher_token` are not auto-migrated. `logout` cleans up both old and new locations. ## Test plan - [x] `make check` passes (lint, unit tests, integration tests) - [x] `mcp-publisher login none` stores token at `~/.config/mcp-publisher/token.json` - [x] No `.mcpregistry_*` files created in cwd after login (with `--token`, `MCP_GITHUB_TOKEN`, or device flow) - [x] `mcp-publisher publish` reads token from new location - [x] `mcp-publisher validate` reads registry URL from new location - [x] `mcp-publisher logout` cleans up new location, legacy `~/.mcp_publisher_token`, and cwd `.mcpregistry_*` files - [x] `mcp-publisher logout` when not logged in shows "Not logged in" - [x] File permissions: dir 0700, file 0600 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
72 lines
1.5 KiB
Go
72 lines
1.5 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"strings"
|
|
)
|
|
|
|
type NoneProvider struct {
|
|
registryURL string
|
|
token string
|
|
}
|
|
|
|
type TokenResponse struct {
|
|
RegistryToken string `json:"registry_token"`
|
|
ExpiresAt int64 `json:"expires_at"`
|
|
}
|
|
|
|
func NewNoneProvider(registryURL string) Provider {
|
|
return &NoneProvider{
|
|
registryURL: registryURL,
|
|
}
|
|
}
|
|
|
|
func (p *NoneProvider) GetToken(ctx context.Context) (string, error) {
|
|
if p.token != "" {
|
|
return p.token, nil
|
|
}
|
|
|
|
// Get anonymous token from registry
|
|
if !strings.HasSuffix(p.registryURL, "/") {
|
|
p.registryURL += "/"
|
|
}
|
|
tokenURL := p.registryURL + "v0/auth/none"
|
|
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodPost, tokenURL, nil)
|
|
if err != nil {
|
|
return "", fmt.Errorf("error creating request: %w", err)
|
|
}
|
|
|
|
client := &http.Client{}
|
|
resp, err := client.Do(req)
|
|
if err != nil {
|
|
return "", fmt.Errorf("error getting anonymous token: %w", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
if resp.StatusCode != http.StatusOK {
|
|
body, _ := io.ReadAll(resp.Body)
|
|
return "", fmt.Errorf("failed to get anonymous token (status %d): %s", resp.StatusCode, body)
|
|
}
|
|
|
|
var tokenResp TokenResponse
|
|
if err := json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil {
|
|
return "", fmt.Errorf("error decoding token response: %w", err)
|
|
}
|
|
|
|
p.token = tokenResp.RegistryToken
|
|
return p.token, nil
|
|
}
|
|
|
|
func (p *NoneProvider) Login(_ context.Context) error {
|
|
// No login needed for anonymous auth
|
|
return nil
|
|
}
|
|
|
|
func (p *NoneProvider) Name() string {
|
|
return "none"
|
|
}
|