mosaicstack/stack
1
0
Fork 1
Code Issues 206 Pull Requests 14 Actions Packages Projects Releases 15 Wiki Activity

fix(mosaic): derive credential resolution traces

Browse Source
This commit is contained in:
be-coder-06
2026-08-05 18:01:41 -05:00
parent e46e114d3b
commit 46e65d9ad4
2 changed files with 22 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/mosaic/framework/tools/git/detect-platform.sh
+14 -9
View File
@@ -501,15 +501,15 @@ get_gitea_url_for_host() {
# Priority: Mosaic credential loader → GITEA_TOKEN env → ~/.git-credentials
_trace_credential_resolution() {
[[ "${MOSAIC_CREDENTIAL_TRACE:-}" == 1 ]] || return 0
local resolution_path="$1" reason="$2" identity="$3" host="$4" source="$5"
local reason="$1" identity="$2" host="$3" source="$4"
local shared_path_entered=false
[[ "$resolution_path" == shared ]] && shared_path_entered=true
[[ "$_resolution_path" == shared ]] && shared_path_entered=true
printf 'MOSAIC_CREDENTIAL_RESOLUTION outcome=ok reason=%s identity=%s host=%s resolution_path=%s shared_path_entered=%s source=%s\n' \
"$reason" "$identity" "$host" "$resolution_path" "$shared_path_entered" "$source" >&2
"$reason" "$identity" "$host" "$_resolution_path" "$shared_path_entered" "$source" >&2
}
get_gitea_token() {
local host="$1"
local host="$1" _resolution_path=unresolved
local script_dir
script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
local cred_loader="$script_dir/../_lib/credentials.sh"
@@ -543,12 +543,14 @@ get_gitea_token() {
local _resolved_token
_resolved_token=$(python3 "$script_dir/resolve-credential-envelope.py" \
"$_idcred" "$_ident" "${MOSAIC_CREDENTIAL_ESTATE:-}" "$host") || return 1
_trace_credential_resolution identity credential-resolved "$_ident" "$host" "$_ident_src"
_resolution_path=identity
_trace_credential_resolution credential-resolved "$_ident" "$host" "$_ident_src"
printf '%s\n' "$_resolved_token"
return 0
fi
if [[ -r "$_idtok" ]]; then
_trace_credential_resolution identity credential-resolved "$_ident" "$host" "$_ident_src"
_resolution_path=identity
_trace_credential_resolution credential-resolved "$_ident" "$host" "$_ident_src"
cat "$_idtok"
return 0
fi
@@ -604,7 +606,8 @@ get_gitea_token() {
echo "${GITEA_TOKEN:-}"
)
if [[ -n "$token" ]]; then
_trace_credential_resolution shared shared-credential-resolved '<interactive-shared>' "$host" credentials-loader
_resolution_path=shared
_trace_credential_resolution shared-credential-resolved '<interactive-shared>' "$host" credentials-loader
echo "$token"
return 0
fi
@@ -613,7 +616,8 @@ get_gitea_token() {
# 2. GITEA_TOKEN env var (only when GITEA_URL, if present, matches the remote host)
if [[ -n "${GITEA_TOKEN:-}" ]]; then
if [[ -z "${GITEA_URL:-}" ]] || gitea_url_matches_host "$GITEA_URL" "$host"; then
_trace_credential_resolution shared shared-credential-resolved '<interactive-shared>' "$host" environment
_resolution_path=shared
_trace_credential_resolution shared-credential-resolved '<interactive-shared>' "$host" environment
echo "$GITEA_TOKEN"
return 0
fi
@@ -625,7 +629,8 @@ get_gitea_token() {
local token
token=$(grep -F "$host" "$creds" 2>/dev/null | sed -n 's#https\?://[^@]*:\([^@/]*\)@.*#\1#p' | head -n 1)
if [[ -n "$token" ]]; then
_trace_credential_resolution shared shared-credential-resolved '<interactive-shared>' "$host" git-credentials
_resolution_path=shared
_trace_credential_resolution shared-credential-resolved '<interactive-shared>' "$host" git-credentials
echo "$token"
return 0
fi