git/list[1] front-page[2] threads[3] people[4] search[5] about
 

[PATCH 06/13] credential: apply helper config

From
Jeff King <peff@peff.net>
Date
Nov 24, 2011, 11:02 UTC
Message-ID
<20111124110223.GD8417@sigill.intra.peff.net>
In-Reply-To
<20111124105801.GA6168@sigill.intra.peff.net>

The functionality for credential storage helpers is already there; we just need to give the users a way to turn it on. This patch provides a "credential.helper" configuration variable which allows the user to provide one or more helper strings.

Rather than simply matching credential.helper, we will also compare URLs in subsection headings to the current context. This means you can apply configuration to a subset of credentials. For example:

  [credential "https://example.com"]
	helper = foo

would match a request for "https://example.com/foo.git", but not one for "https://kernel.org/foo.git".

This is overkill for the "helper" variable, since users are unlikely to want different helpers for different sites (and since helpers run arbitrary code, they could do the matching themselves anyway).

However, future patches will add new config variables where this extra feature will be more useful.

Signed-off-by: Jeff King <peff@peff.net>
---
 credential.c           |   61 ++++++++++++++++++++++++++++++++++++++++++++++++
 credential.h           |    5 +++-
 t/t0300-credentials.sh |   42 +++++++++++++++++++++++++++++++++
 t/t5550-http-fetch.sh  |   12 +++++++++
 4 files changed, 119 insertions(+), 1 deletions(-)
diff --git a/credential.c b/credential.c
index 5cc4319..120ea62 100644
--- a/credential.c
+++ b/credential.c
@@ -22,6 +22,61 @@ void credential_clear(struct credential *c)
 	credential_init(c);
 }
 
+int credential_match(const struct credential *want,
+		     const struct credential *have)
+{
+#define CHECK(x) (!want->x || (have->x && !strcmp(want->x, have->x)))
+	return CHECK(protocol) &&
+	       CHECK(host) &&
+	       CHECK(path) &&
+	       CHECK(username);
+#undef CHECK
+}
+
+static int credential_config_callback(const char *var, const char *value,
+				      void *data)
+{
+	struct credential *c = data;
+	const char *key, *dot;
+
+	key = skip_prefix(var, "credential.");
+	if (!key)
+		return 0;
+
+	if (!value)
+		return config_error_nonbool(var);
+
+	dot = strrchr(key, '.');
+	if (dot) {
+		struct credential want = CREDENTIAL_INIT;
+		char *url = xmemdupz(key, dot - key);
+		int matched;
+
+		credential_from_url(&want, url);
+		matched = credential_match(&want, c);
+
+		credential_clear(&want);
+		free(url);
+
+		if (!matched)
+			return 0;
+		key = dot + 1;
+	}
+
+	if (!strcmp(key, "helper"))
+		string_list_append(&c->helpers, value);
+
+	return 0;
+}
+
+static void credential_apply_config(struct credential *c)
+{
+	if (c->configured)
+		return;
+	git_config(credential_config_callback, c);
+	c->configured = 1;
+}
+
 static void credential_describe(struct credential *c, struct strbuf *out)
 {
 	if (!c->protocol)
@@ -203,6 +258,8 @@ void credential_fill(struct credential *c)
 	if (c->username && c->password)
 		return;
 
+	credential_apply_config(c);
+
 	for (i = 0; i < c->helpers.nr; i++) {
 		credential_do(c, c->helpers.items[i].string, "get");
 		if (c->username && c->password)
@@ -223,6 +280,8 @@ void credential_approve(struct credential *c)
 	if (!c->username || !c->password)
 		return;
 
+	credential_apply_config(c);
+
 	for (i = 0; i < c->helpers.nr; i++)
 		credential_do(c, c->helpers.items[i].string, "store");
 	c->approved = 1;
@@ -232,6 +291,8 @@ void credential_reject(struct credential *c)
 {
 	int i;
 
+	credential_apply_config(c);
+
 	for (i = 0; i < c->helpers.nr; i++)
 		credential_do(c, c->helpers.items[i].string, "erase");
 
diff --git a/credential.h b/credential.h
index 8a6d162..e504272 100644
--- a/credential.h
+++ b/credential.h
@@ -5,7 +5,8 @@
 
 struct credential {
 	struct string_list helpers;
-	unsigned approved:1;
+	unsigned approved:1,
+		 configured:1;
 
 	char *username;
 	char *password;
@@ -25,5 +26,7 @@ struct credential {
 
 int credential_read(struct credential *, FILE *);
 void credential_from_url(struct credential *, const char *url);
+int credential_match(const struct credential *have,
+		     const struct credential *want);
 
 #endif /* CREDENTIAL_H */
diff --git a/t/t0300-credentials.sh b/t/t0300-credentials.sh
index 81a455f..e3f61f4 100755
--- a/t/t0300-credentials.sh
+++ b/t/t0300-credentials.sh
@@ -192,4 +192,46 @@ test_expect_success 'internal getpass does not ask for known username' '
 	EOF
 '
 
+HELPER="f() {
+		cat >/dev/null
+		echo username=foo
+		echo password=bar
+	}; f"
+test_expect_success 'respect configured credentials' '
+	test_config credential.helper "$HELPER" &&
+	check fill <<-\EOF
+	--
+	username=foo
+	password=bar
+	--
+	EOF
+'
+
+test_expect_success 'match configured credential' '
+	test_config credential.https://example.com.helper "$HELPER" &&
+	check fill <<-\EOF
+	protocol=https
+	host=example.com
+	path=repo.git
+	--
+	username=foo
+	password=bar
+	--
+	EOF
+'
+
+test_expect_success 'do not match configured credential' '
+	test_config credential.https://foo.helper "$HELPER" &&
+	check fill <<-\EOF
+	protocol=https
+	host=bar
+	--
+	username=askpass-username
+	password=askpass-password
+	--
+	askpass: Username for '\''https://bar'\'':
+	askpass: Password for '\''https://askpass-username@bar'\'':
+	EOF
+'
+
 test_done
diff --git a/t/t5550-http-fetch.sh b/t/t5550-http-fetch.sh
index 398a2d2..21e2f5d 100755
--- a/t/t5550-http-fetch.sh
+++ b/t/t5550-http-fetch.sh
@@ -101,6 +101,18 @@ test_expect_success 'http auth can request both user and pass' '
 	expect_askpass both user@host
 '
 
+test_expect_success 'http auth respects credential helper config' '
+	test_config_global credential.helper "f() {
+		cat >/dev/null
+		echo username=user@host
+		echo password=user@host
+	}; f" &&
+	>askpass-query &&
+	echo wrong >askpass-response &&
+	git clone "$HTTPD_URL/auth/repo.git" clone-auth-helper &&
+	expect_askpass none
+'
+
 test_expect_success 'fetch changes via http' '
 	echo content >>file &&
 	git commit -a -m two &&

-- 
1.7.7.4.5.gb32a5
Previous: Jeff KingNext: Jeff King
Message 11 of 49 in “credential helpers, take two”
  1. 0/13 credential helpers, take twoJeff King, Nov 24, 2011
  2. 01/13 test-lib: add test_config_global variantJeff King, Nov 24, 2011
  3. 02/13 t5550: fix typoJeff King, Nov 24, 2011
  4. 03/13 introduce credentials APIJeff King, Nov 24, 2011
  5. Junio C HamanoNov 28, 2011
  6. Jeff KingNov 29, 2011
  7. Junio C HamanoNov 29, 2011
  8. Jeff KingNov 29, 2011
  9. 04/13 credential: add function for parsing url componentsJeff King, Nov 24, 2011
  10. 05/13 http: use credential API to get passwordsJeff King, Nov 24, 2011
  11. 06/13 credential: apply helper configJeff King, Nov 24, 2011
  12. 07/13 credential: add credential.*.usernameJeff King, Nov 24, 2011
  13. 08/13 credential: make relevance of http path configurableJeff King, Nov 24, 2011
  14. 09/13 docs: end-user documentation for the credential subsystemJeff King, Nov 24, 2011
  15. 10/13 credentials: add "cache" helperJeff King, Nov 24, 2011
  16. Eric SunshineNov 24, 2011
  17. Junio C HamanoNov 29, 2011
  18. Jeff KingNov 29, 2011
  19. 11/13 strbuf: add strbuf_add*_urlencodeJeff King, Nov 24, 2011
  20. Junio C HamanoNov 29, 2011
  21. Jeff KingNov 29, 2011
  22. René ScharfeNov 29, 2011
  23. Jeff KingNov 30, 2011
  24. Junio C HamanoNov 30, 2011
  25. René ScharfeNov 30, 2011
  26. 12/13 credentials: add "store" helperJeff King, Nov 24, 2011
  27. Eric SunshineNov 24, 2011
  28. Jeff KingNov 24, 2011
  29. Junio C HamanoNov 29, 2011
  30. Jeff KingNov 29, 2011
  31. 13/13 t: add test harness for external credential helpersJeff King, Nov 24, 2011
  32. Erik Faye-LundNov 24, 2011
  33. Jeff KingNov 24, 2011
  34. Erik Faye-LundNov 24, 2011
  35. 0/6 echo usernames as they are typedJeff King, Nov 27, 2011
  36. 1/6 move git_getpass to its own source fileJeff King, Nov 27, 2011
  37. 2/6 refactor git_getpass into generic prompt functionJeff King, Nov 27, 2011
  38. 3/6 stub out getpass_echo functionJeff King, Nov 27, 2011
  39. 4/6 prompt: add PROMPT_ECHO flagJeff King, Nov 27, 2011
  40. 5/6 credential: use git_prompt instead of git_getpassJeff King, Nov 27, 2011
  41. 6/6 compat/getpass: add a /dev/tty implementationJeff King, Nov 27, 2011
  42. Junio C HamanoNov 27, 2011
  43. Erik Faye-LundNov 27, 2011
  44. Jeff KingNov 28, 2011
  45. Erik Faye-LundNov 28, 2011
  46. Jeff KingNov 28, 2011
  47. Frans KlaverNov 28, 2011
  48. Erik Faye-LundNov 28, 2011
  49. Jeff KingNov 28, 2011

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.