feat(auth): support required keyring credentials

Author: morluto

go.mod

@@ -6,18 +6,21 @@ require (
 	github.com/alecthomas/kong v1.16.0
 	github.com/google/go-cmp v0.7.0
 	github.com/google/go-github/v89 v89.0.0
+	github.com/google/uuid v1.6.0
 	github.com/modelcontextprotocol/go-sdk v1.6.1
 	github.com/pelletier/go-toml/v2 v2.4.3
 	github.com/pressly/goose/v3 v3.24.0
+	github.com/zalando/go-keyring v0.2.8
 	golang.org/x/time v0.15.0
 	modernc.org/sqlite v1.54.0
 )
 
 require (
+	github.com/danieljoos/wincred v1.2.3 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/godbus/dbus/v5 v5.2.2 // indirect
 	github.com/google/go-querystring v1.2.0 // indirect
 	github.com/google/jsonschema-go v0.4.3 // indirect
-	github.com/google/uuid v1.6.0 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mfridman/interpolate v0.0.2 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect

go.sum

@@ -4,10 +4,14 @@ github.com/alecthomas/kong v1.16.0 h1:g92/kUxBcdcTPOM79yE63viJgtcp5dNyrB3/O2cjYT
 github.com/alecthomas/kong v1.16.0/go.mod h1:wrlbXem1CWqUV5Vbmss5ISYhsVPkBb1Yo7YKJghju2I=
 github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
 github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
+github.com/danieljoos/wincred v1.2.3 h1:v7dZC2x32Ut3nEfRH+vhoZGvN72+dQ/snVXo/vMFLdQ=
+github.com/danieljoos/wincred v1.2.3/go.mod h1:6qqX0WNrS4RzPZ1tnroDzq9kY3fu1KwE7MRLQK4X0bs=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
+github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
 github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
 github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
@@ -49,10 +53,14 @@ github.com/segmentio/encoding v0.5.4 h1:OW1VRern8Nw6ITAtwSZ7Idrl3MXCFwXHPgqESYfv
 github.com/segmentio/encoding v0.5.4/go.mod h1:HS1ZKa3kSN32ZHVZ7ZLPLXWvOVIiZtyJnO1gPH1sKt0=
 github.com/sethvargo/go-retry v0.3.0 h1:EEt31A35QhrcRZtrYFDTBg91cqZVnFL2navjDrah2SE=
 github.com/sethvargo/go-retry v0.3.0/go.mod h1:mNX17F0C/HguQMyMyJxcnU471gOZGxCLyYaFyAZraas=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=
 github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4=
+github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPccHs=
+github.com/zalando/go-keyring v0.2.8/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=

internal/app/app.go

@@ -87,6 +87,9 @@ func (s *Service) loadConfig(save bool) (*config.Config, error) {
 	if err := config.ApplyEnv(cfg, os.Getenv); err != nil {
 		return nil, err
 	}
+	if err := config.Validate(cfg); err != nil {
+		return nil, fmt.Errorf("validate config: %w", err)
+	}
 	if save && !exists {
 		dir := filepath.Dir(cfgFile)
 		if err := os.MkdirAll(dir, 0755); err != nil {
@@ -157,9 +160,6 @@ func (s *Service) newGitHubReader() (github.Reader, error) {
 	if cfg == nil {
 		return nil, errors.New("configuration is not loaded")
 	}
-	if strings.EqualFold(cfg.TokenSource.Method, "keyring") {
-		return nil, errors.New("keyring token source is not supported")
-	}
 	tokenSrc := tokenSource(cfg)
 	client, err := github.NewClient(github.Config{TokenSource: tokenSrc})
 	if err != nil {
@@ -176,9 +176,11 @@ func tokenSource(cfg *config.Config) github.TokenSource {
 		if name == "" {
 			name = github.DefaultEnvToken
 		}
-		return github.EnvTokenSource(name)
+		return github.RequireToken(github.EnvTokenSource(name))
 	case "gh-cli":
-		return github.GhCLITokenSource(nil)
+		return github.RequireToken(github.GhCLITokenSource(nil))
+	case "keyring":
+		return github.RequireToken(github.KeyringTokenSource(cfg.TokenSource.Key))
 	}
 	return github.StaticTokenSource("")
 }

internal/app/app_test.go

@@ -359,7 +359,7 @@ func TestSearchReportsDefaultLimit(t *testing.T) {
 	}
 }
 
-func TestLocalInitializationDoesNotResolveUnsupportedAuth(t *testing.T) {
+func TestLocalInitializationDoesNotResolveKeyringAuth(t *testing.T) {
 	ctx := context.Background()
 	paths := config.NewPaths(&config.Env{Home: t.TempDir()})
 	configPath, err := paths.ConfigFile()
@@ -368,6 +368,7 @@ func TestLocalInitializationDoesNotResolveUnsupportedAuth(t *testing.T) {
 	}
 	cfg := config.Default()
 	cfg.TokenSource.Method = "keyring"
+	cfg.TokenSource.Key = "test-account"
 	if err := config.ApplyDefaults(cfg, paths); err != nil {
 		t.Fatal(err)
 	}
@@ -382,8 +383,40 @@ func TestLocalInitializationDoesNotResolveUnsupportedAuth(t *testing.T) {
 	if _, err := svc.Init(ctx); err != nil {
 		t.Fatalf("local init resolved GitHub auth: %v", err)
 	}
-	if _, err := svc.Sync(ctx, cli.RepoRef{Owner: "owner", Repo: "repo"}); err == nil || !strings.Contains(err.Error(), "keyring") {
-		t.Fatalf("network sync error = %v, want explicit unsupported auth", err)
+}
+
+func TestConfiguredAuthenticationIsRequired(t *testing.T) {
+	t.Setenv("GITCONTRIBUTE_TEST_MISSING_TOKEN", "")
+	cfg := config.Default()
+	cfg.TokenSource = config.TokenSource{
+		Method: "env",
+		Key:    "GITCONTRIBUTE_TEST_MISSING_TOKEN",
+	}
+
+	_, err := tokenSource(cfg).Token(context.Background())
+	if !errors.Is(err, github.ErrRequiredToken) {
+		t.Fatalf("configured auth error = %v, want ErrRequiredToken", err)
+	}
+}
+
+func TestNewRejectsInvalidConfiguredTokenSource(t *testing.T) {
+	paths := config.NewPaths(&config.Env{Home: t.TempDir()})
+	configPath, err := paths.ConfigFile()
+	if err != nil {
+		t.Fatal(err)
+	}
+	cfg := config.Default()
+	cfg.TokenSource.Method = "keyrign"
+	if err := config.ApplyDefaults(cfg, paths); err != nil {
+		t.Fatal(err)
+	}
+	if err := config.Save(configPath, cfg); err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = New(paths, "test")
+	if err == nil || !strings.Contains(err.Error(), "invalid token_source method") {
+		t.Fatalf("New error = %v, want invalid token source", err)
 	}
 }
 

internal/config/config.go

@@ -237,10 +237,10 @@ func Validate(cfg *Config) error {
 	}
 
 	switch cfg.TokenSource.Method {
-	case "none", "keyring", "gh-cli":
-	case "env":
-		if cfg.TokenSource.Key == "" {
-			return errors.New("token_source key is required when method is env")
+	case "none", "gh-cli":
+	case "env", "keyring":
+		if strings.TrimSpace(cfg.TokenSource.Key) == "" {
+			return fmt.Errorf("token_source key is required when method is %s", cfg.TokenSource.Method)
 		}
 	default:
 		return fmt.Errorf("invalid token_source method %q", cfg.TokenSource.Method)

internal/config/config_test.go

@@ -190,6 +190,16 @@ func TestConfigValidation(t *testing.T) {
 			cfg:     &Config{Database: "/tmp/db", TokenSource: TokenSource{Method: "env"}, Crawl: Crawl{Budget: 1, Concurrency: 1}, Output: Output{Format: "text"}},
 			wantErr: "token_source key is required when method is env",
 		},
+		{
+			name:    "token keyring missing account",
+			cfg:     &Config{Database: "/tmp/db", TokenSource: TokenSource{Method: "keyring"}, Crawl: Crawl{Budget: 1, Concurrency: 1}, Output: Output{Format: "text"}},
+			wantErr: "token_source key is required when method is keyring",
+		},
+		{
+			name:    "token keyring blank account",
+			cfg:     &Config{Database: "/tmp/db", TokenSource: TokenSource{Method: "keyring", Key: "  \t"}, Crawl: Crawl{Budget: 1, Concurrency: 1}, Output: Output{Format: "text"}},
+			wantErr: "token_source key is required when method is keyring",
+		},
 		{
 			name:    "invalid token method",
 			cfg:     &Config{Database: "/tmp/db", TokenSource: TokenSource{Method: "magic"}, Crawl: Crawl{Budget: 1, Concurrency: 1}, Output: Output{Format: "text"}},

internal/github/auth.go

@@ -3,9 +3,12 @@ package github
 import (
 	"context"
 	"errors"
+	"fmt"
 	"os"
 	"os/exec"
 	"strings"
+
+	"github.com/zalando/go-keyring"
 )
 
 // TokenSource resolves a GitHub authentication token.
@@ -16,6 +19,14 @@ type TokenSource interface {
 // ErrNoToken indicates that a token source could not provide a token.
 var ErrNoToken = errors.New("no GitHub token available")
 
+// ErrRequiredToken indicates that an explicitly configured authentication
+// source did not provide a token.
+var ErrRequiredToken = errors.New("configured GitHub token unavailable")
+
+// KeyringService is the service name used for credentials owned by
+// gitcontribute.
+const KeyringService = "gitcontribute"
+
 // CommandRunner abstracts process execution so that tests can inject behavior.
 type CommandRunner interface {
 	Run(ctx context.Context, name string, args ...string) (string, error)
@@ -65,6 +76,39 @@ func (s *envTokenSource) Token(ctx context.Context) (string, error) {
 	return v, nil
 }
 
+// KeyringTokenSource resolves a token from the operating system credential
+// store. account identifies the credential within the gitcontribute service.
+func KeyringTokenSource(account string) TokenSource {
+	return &keyringTokenSource{account: account, get: keyring.Get}
+}
+
+type keyringTokenSource struct {
+	account string
+	get     func(service, user string) (string, error)
+}
+
+func (s *keyringTokenSource) Token(ctx context.Context) (string, error) {
+	if err := ctx.Err(); err != nil {
+		return "", err
+	}
+	if strings.TrimSpace(s.account) == "" {
+		return "", ErrNoToken
+	}
+
+	token, err := s.get(KeyringService, s.account)
+	if errors.Is(err, keyring.ErrNotFound) {
+		return "", ErrNoToken
+	}
+	if err != nil {
+		return "", fmt.Errorf("read GitHub token from keyring: %w", err)
+	}
+	token = strings.TrimSpace(token)
+	if token == "" {
+		return "", ErrNoToken
+	}
+	return token, nil
+}
+
 // GhCLITokenSource resolves a token by running `gh auth token`.
 // Optional args are passed through to `gh` (for example a `--hostname` flag).
 func GhCLITokenSource(runner CommandRunner, args ...string) TokenSource {
@@ -115,6 +159,27 @@ func (c chainTokenSource) Token(ctx context.Context) (string, error) {
 	return "", ErrNoToken
 }
 
+// RequireToken prevents an explicitly configured source from silently falling
+// back to anonymous GitHub access.
+func RequireToken(source TokenSource) TokenSource {
+	return requiredTokenSource{source: source}
+}
+
+type requiredTokenSource struct {
+	source TokenSource
+}
+
+func (s requiredTokenSource) Token(ctx context.Context) (string, error) {
+	if s.source == nil {
+		return "", ErrRequiredToken
+	}
+	token, err := s.source.Token(ctx)
+	if errors.Is(err, ErrNoToken) || (err == nil && token == "") {
+		return "", ErrRequiredToken
+	}
+	return token, err
+}
+
 // DefaultEnvToken is the conventional environment variable name for a
 // GitHub token.
 const DefaultEnvToken = "GITHUB_TOKEN"

internal/github/client_test.go

@@ -13,6 +13,7 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/zalando/go-keyring"
 )
 
 const testOwner = "octocat"
@@ -556,6 +557,80 @@ func TestTokenResolution(t *testing.T) {
 			t.Fatalf("got %q, %v", tok, err)
 		}
 	})
+
+	t.Run("required missing", func(t *testing.T) {
+		src := RequireToken(StaticTokenSource(""))
+		tok, err := src.Token(context.Background())
+		if !errors.Is(err, ErrRequiredToken) || errors.Is(err, ErrNoToken) || tok != "" {
+			t.Fatalf("got %q, %v", tok, err)
+		}
+	})
+
+	t.Run("required present", func(t *testing.T) {
+		src := RequireToken(StaticTokenSource("required-token"))
+		tok, err := src.Token(context.Background())
+		if err != nil || tok != "required-token" {
+			t.Fatalf("got %q, %v", tok, err)
+		}
+	})
+
+	t.Run("keyring", func(t *testing.T) {
+		var service, account string
+		src := &keyringTokenSource{
+			account: "github.com",
+			get: func(gotService, gotAccount string) (string, error) {
+				service, account = gotService, gotAccount
+				return " keyring-token\n", nil
+			},
+		}
+		tok, err := src.Token(context.Background())
+		if err != nil || tok != "keyring-token" {
+			t.Fatalf("got %q, %v", tok, err)
+		}
+		if service != KeyringService || account != "github.com" {
+			t.Fatalf("lookup = %q/%q, want %q/github.com", service, account, KeyringService)
+		}
+	})
+
+	t.Run("keyring missing", func(t *testing.T) {
+		src := &keyringTokenSource{
+			account: "missing",
+			get:     func(string, string) (string, error) { return "", keyring.ErrNotFound },
+		}
+		tok, err := src.Token(context.Background())
+		if !errors.Is(err, ErrNoToken) || tok != "" {
+			t.Fatalf("got %q, %v", tok, err)
+		}
+	})
+
+	t.Run("keyring backend failure", func(t *testing.T) {
+		backendErr := errors.New("backend unavailable")
+		src := &keyringTokenSource{
+			account: "github.com",
+			get:     func(string, string) (string, error) { return "", backendErr },
+		}
+		_, err := src.Token(context.Background())
+		if !errors.Is(err, backendErr) || !strings.Contains(err.Error(), "keyring") {
+			t.Fatalf("got %v, want wrapped keyring backend error", err)
+		}
+	})
+
+	t.Run("keyring canceled", func(t *testing.T) {
+		ctx, cancel := context.WithCancel(context.Background())
+		cancel()
+		called := false
+		src := &keyringTokenSource{
+			account: "github.com",
+			get: func(string, string) (string, error) {
+				called = true
+				return "token", nil
+			},
+		}
+		_, err := src.Token(ctx)
+		if !errors.Is(err, context.Canceled) || called {
+			t.Fatalf("got err=%v called=%t, want canceled without lookup", err, called)
+		}
+	})
 }
 
 type fakeRunner struct {