mosaicstack/stack
1
0
Fork 1
Code Issues 207 Pull Requests 16 Actions Packages Projects Releases 15 Wiki Activity

fix(mosaic): close credential evidence gaps

Browse Source
This commit is contained in:
be-coder-06
2026-08-05 18:01:41 -05:00
parent d18e49e8f4
commit 26203bd92c
16 changed files with 373 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/mosaic/framework/tools/git/detect-platform.sh
+16 -16
View File
@@ -499,6 +499,15 @@ get_gitea_url_for_host() {
# Resolve a Gitea API token for the given host.
# Priority: Mosaic credential loader → GITEA_TOKEN env → ~/.git-credentials
_trace_credential_resolution() {
[[ "${MOSAIC_CREDENTIAL_TRACE:-}" == 1 ]] || return 0
local resolution_path="$1" reason="$2" identity="$3" host="$4" source="$5"
local shared_path_entered=false
[[ "$resolution_path" == shared ]] && shared_path_entered=true
printf 'MOSAIC_CREDENTIAL_RESOLUTION outcome=ok reason=%s identity=%s host=%s resolution_path=%s shared_path_entered=%s source=%s\n' \
"$reason" "$identity" "$host" "$resolution_path" "$shared_path_entered" "$source" >&2
}
get_gitea_token() {
local host="$1"
local script_dir
@@ -532,26 +541,14 @@ get_gitea_token() {
local _idcred="$HOME/.config/mosaic/secrets/gitea-tokens/${_idpfx}-${_ident}.credential.json"
if [[ -r "$_idcred" ]]; then
local _resolved_token
_resolved_token=$(python3 - "$_idcred" <<'PY'
import json, sys
value = json.load(open(sys.argv[1], encoding="utf-8")).get("token")
if not isinstance(value, str) or not value or any(ch.isspace() for ch in value):
raise SystemExit(1)
print(value)
PY
) || return 1
if [[ "${MOSAIC_CREDENTIAL_TRACE:-}" == 1 ]]; then
printf 'MOSAIC_CREDENTIAL_RESOLUTION outcome=ok reason=credential-resolved identity=%s host=%s shared_path_entered=false source=%s\n' \
"$_ident" "$host" "$_ident_src" >&2
fi
_resolved_token=$(python3 "$script_dir/resolve-credential-envelope.py" \
"$_idcred" "$_ident" "${MOSAIC_CREDENTIAL_ESTATE:-}" "$host") || return 1
_trace_credential_resolution identity credential-resolved "$_ident" "$host" "$_ident_src"
printf '%s\n' "$_resolved_token"
return 0
fi
if [[ -r "$_idtok" ]]; then
if [[ "${MOSAIC_CREDENTIAL_TRACE:-}" == 1 ]]; then
printf 'MOSAIC_CREDENTIAL_RESOLUTION outcome=ok reason=credential-resolved identity=%s host=%s shared_path_entered=false source=%s\n' \
"$_ident" "$host" "$_ident_src" >&2
fi
_trace_credential_resolution identity credential-resolved "$_ident" "$host" "$_ident_src"
cat "$_idtok"
return 0
fi
@@ -607,6 +604,7 @@ PY
echo "${GITEA_TOKEN:-}"
)
if [[ -n "$token" ]]; then
_trace_credential_resolution shared shared-credential-resolved '<interactive-shared>' "$host" credentials-loader
echo "$token"
return 0
fi
@@ -615,6 +613,7 @@ PY
# 2. GITEA_TOKEN env var (only when GITEA_URL, if present, matches the remote host)
if [[ -n "${GITEA_TOKEN:-}" ]]; then
if [[ -z "${GITEA_URL:-}" ]] || gitea_url_matches_host "$GITEA_URL" "$host"; then
_trace_credential_resolution shared shared-credential-resolved '<interactive-shared>' "$host" environment
echo "$GITEA_TOKEN"
return 0
fi
@@ -626,6 +625,7 @@ PY
local token
token=$(grep -F "$host" "$creds" 2>/dev/null | sed -n 's#https\?://[^@]*:\([^@/]*\)@.*#\1#p' | head -n 1)
if [[ -n "$token" ]]; then
_trace_credential_resolution shared shared-credential-resolved '<interactive-shared>' "$host" git-credentials
echo "$token"
return 0
fi