Add context configuration and token-based authentication (client-side)#66
Merged
Conversation
Extend the context configuration schema to support authentication: - Add AuthConfig struct with type, token, and token-ref fields - Support inline tokens and keyring references (keyring://construct/<name>) - Add validation for auth configuration in EndpointContext.Validate() - Add helper methods IsConfigured() and KeyringKey() for token resolution Co-authored-by: construct-agent <noreply@construct.sh>
Introduce shared/keyring package for cross-platform secure credential storage: - KeyringProvider wraps zalando/go-keyring for macOS Keychain, Linux Secret Service, and Windows Credential Manager support - Custom error types ErrSecretNotFound and ErrSecretTooLarge for typed handling - Provider interface for dependency injection and testing - Configurable service name with default construct This enables CLI to store authentication tokens securely in the system keyring. Co-authored-by: construct-agent <noreply@construct.sh>
Update ContextManager to support authentication configuration: - Add keyringProvider field for secure token storage operations - Add NewContextManagerWithKeyring constructor for dependency injection - Extend UpsertContext with optional auth parameter - Add GetContext and ListContexts helper methods - Add DeleteContext that cleans up keyring tokens automatically - Add StoreToken, RetrieveToken, DeleteToken wrapper methods Update existing callers to pass nil for auth parameter (local contexts). Co-authored-by: construct-agent <noreply@construct.sh>
Implement WithAuthToken ClientOption that adds a Connect interceptor to inject Authorization: Bearer headers on all requests: - authInterceptor implements connect.Interceptor interface - WrapUnary adds auth header to unary RPC requests - WrapStreamingClient adds auth header to streaming client requests - WrapStreamingHandler passes through (client-side only) Co-authored-by: construct-agent <noreply@construct.sh>
Integrate authentication token resolution into API client creation: - Add --context global flag to override current context for single invocation - Support CONSTRUCT_CONTEXT environment variable with resolution order: flag > env > config - Add resolveContextName helper for context selection logic - Add buildClientOptions to configure auth when context has token configured - Add resolveToken to retrieve tokens from inline config or keyring - Skip context requirement for context.* commands (upcoming) - Update error messages to reference new context commands Co-authored-by: construct-agent <noreply@construct.sh>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add client-side context configuration and token-based authentication support, enabling users to connect to remote Construct daemons with secure token storage.
Context
This implements Phase 1 (Context Configuration System) and Phase 2 (Client Token Resolution) from the multi-environment context and authentication plan. Users need the ability to:
Related: plan.md outlines the full implementation including server-side token management (future phases).
Changes
API Client ()
Shared Package ()
CLI ()
Testing
Integration testing requires the context CLI commands (Phase 3) which will be implemented next.
Notes