mosaicstack/stack
1
0
Fork 1
Code Issues 170 Pull Requests 9 Actions Packages Projects Releases 15 Wiki Activity

fix(mosaic): derive credential resolution traces

Browse Source
This commit is contained in:
be-coder-06
2026-08-05 13:21:03 -05:00
parent 0b1cb836f4
commit 6ca8758f8f
2 changed files with 22 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/mosaic/framework/tools/git/detect-platform.sh
+14 -9
View File
@@ -501,15 +501,15 @@ get_gitea_url_for_host() {
# Priority: Mosaic credential loader → GITEA_TOKEN env → ~/.git-credentials # Priority: Mosaic credential loader → GITEA_TOKEN env → ~/.git-credentials
_trace_credential_resolution() { _trace_credential_resolution() {
[[ "${MOSAIC_CREDENTIAL_TRACE:-}" == 1 ]] || return 0 [[ "${MOSAIC_CREDENTIAL_TRACE:-}" == 1 ]] || return 0
local resolution_path="$1" reason="$2" identity="$3" host="$4" source="$5" local reason="$1" identity="$2" host="$3" source="$4"
local shared_path_entered=false local shared_path_entered=false
[[ "$resolution_path" == shared ]] && shared_path_entered=true [[ "$_resolution_path" == shared ]] && shared_path_entered=true
printf 'MOSAIC_CREDENTIAL_RESOLUTION outcome=ok reason=%s identity=%s host=%s resolution_path=%s shared_path_entered=%s source=%s\n' \ printf 'MOSAIC_CREDENTIAL_RESOLUTION outcome=ok reason=%s identity=%s host=%s resolution_path=%s shared_path_entered=%s source=%s\n' \
"$reason" "$identity" "$host" "$resolution_path" "$shared_path_entered" "$source" >&2 "$reason" "$identity" "$host" "$_resolution_path" "$shared_path_entered" "$source" >&2
} }
get_gitea_token() { get_gitea_token() {
local host="$1" local host="$1" _resolution_path=unresolved
local script_dir local script_dir
script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
local cred_loader="$script_dir/../_lib/credentials.sh" local cred_loader="$script_dir/../_lib/credentials.sh"
@@ -543,12 +543,14 @@ get_gitea_token() {
local _resolved_token local _resolved_token
_resolved_token=$(python3 "$script_dir/resolve-credential-envelope.py" \ _resolved_token=$(python3 "$script_dir/resolve-credential-envelope.py" \
"$_idcred" "$_ident" "${MOSAIC_CREDENTIAL_ESTATE:-}" "$host") || return 1 "$_idcred" "$_ident" "${MOSAIC_CREDENTIAL_ESTATE:-}" "$host") || return 1
_trace_credential_resolution identity credential-resolved "$_ident" "$host" "$_ident_src" _resolution_path=identity
_trace_credential_resolution credential-resolved "$_ident" "$host" "$_ident_src"
printf '%s\n' "$_resolved_token" printf '%s\n' "$_resolved_token"
return 0 return 0
fi fi
if [[ -r "$_idtok" ]]; then if [[ -r "$_idtok" ]]; then
_trace_credential_resolution identity credential-resolved "$_ident" "$host" "$_ident_src" _resolution_path=identity
_trace_credential_resolution credential-resolved "$_ident" "$host" "$_ident_src"
cat "$_idtok" cat "$_idtok"
return 0 return 0
fi fi
@@ -604,7 +606,8 @@ get_gitea_token() {
echo "${GITEA_TOKEN:-}" echo "${GITEA_TOKEN:-}"
) )
if [[ -n "$token" ]]; then if [[ -n "$token" ]]; then
_trace_credential_resolution shared shared-credential-resolved '<interactive-shared>' "$host" credentials-loader _resolution_path=shared
_trace_credential_resolution shared-credential-resolved '<interactive-shared>' "$host" credentials-loader
echo "$token" echo "$token"
return 0 return 0
fi fi
@@ -613,7 +616,8 @@ get_gitea_token() {
# 2. GITEA_TOKEN env var (only when GITEA_URL, if present, matches the remote host) # 2. GITEA_TOKEN env var (only when GITEA_URL, if present, matches the remote host)
if [[ -n "${GITEA_TOKEN:-}" ]]; then if [[ -n "${GITEA_TOKEN:-}" ]]; then
if [[ -z "${GITEA_URL:-}" ]] || gitea_url_matches_host "$GITEA_URL" "$host"; then if [[ -z "${GITEA_URL:-}" ]] || gitea_url_matches_host "$GITEA_URL" "$host"; then
_trace_credential_resolution shared shared-credential-resolved '<interactive-shared>' "$host" environment _resolution_path=shared
_trace_credential_resolution shared-credential-resolved '<interactive-shared>' "$host" environment
echo "$GITEA_TOKEN" echo "$GITEA_TOKEN"
return 0 return 0
fi fi
@@ -625,7 +629,8 @@ get_gitea_token() {
local token local token
token=$(grep -F "$host" "$creds" 2>/dev/null | sed -n 's#https\?://[^@]*:\([^@/]*\)@.*#\1#p' | head -n 1) token=$(grep -F "$host" "$creds" 2>/dev/null | sed -n 's#https\?://[^@]*:\([^@/]*\)@.*#\1#p' | head -n 1)
if [[ -n "$token" ]]; then if [[ -n "$token" ]]; then
_trace_credential_resolution shared shared-credential-resolved '<interactive-shared>' "$host" git-credentials _resolution_path=shared
_trace_credential_resolution shared-credential-resolved '<interactive-shared>' "$host" git-credentials
echo "$token" echo "$token"
return 0 return 0
fi fi
packages/mosaic/framework/tools/git/git-credential-mosaic
+8 -4
View File
@@ -27,12 +27,13 @@ done
script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
trace_resolution() { trace_resolution() {
[ "${MOSAIC_CREDENTIAL_TRACE:-}" = 1 ] || return 0 [ "${MOSAIC_CREDENTIAL_TRACE:-}" = 1 ] || return 0
resolution_path="$1" reason="$2" trace_identity="$3" trace_host="$4" source="$5" reason="$1" trace_identity="$2" trace_host="$3" source="$4"
shared_path_entered=false shared_path_entered=false
[ "$resolution_path" = shared ] && shared_path_entered=true [ "$resolution_path" = shared ] && shared_path_entered=true
printf 'MOSAIC_CREDENTIAL_RESOLUTION outcome=ok reason=%s identity=%s host=%s resolution_path=%s shared_path_entered=%s source=%s\n' \ printf 'MOSAIC_CREDENTIAL_RESOLUTION outcome=ok reason=%s identity=%s host=%s resolution_path=%s shared_path_entered=%s source=%s\n' \
"$reason" "$trace_identity" "$trace_host" "$resolution_path" "$shared_path_entered" "$source" >&2 "$reason" "$trace_identity" "$trace_host" "$resolution_path" "$shared_path_entered" "$source" >&2
} }
resolution_path=unresolved
# Per-agent identity resolution (Gate-16 author≠reviewer separation). # Per-agent identity resolution (Gate-16 author≠reviewer separation).
# Priority: MOSAIC_GIT_IDENTITY env > git config mosaic.gitIdentity (per-worktree, # Priority: MOSAIC_GIT_IDENTITY env > git config mosaic.gitIdentity (per-worktree,
# survives across non-persistent shells) > git-supplied username (credential.username # survives across non-persistent shells) > git-supplied username (credential.username
@@ -59,13 +60,15 @@ if [ -n "$ident" ]; then
if [ -e "$idcred" ] || [ -L "$idcred" ]; then if [ -e "$idcred" ] || [ -L "$idcred" ]; then
token=$(python3 "$script_dir/resolve-credential-envelope.py" \ token=$(python3 "$script_dir/resolve-credential-envelope.py" \
"$idcred" "$ident" "${MOSAIC_CREDENTIAL_ESTATE:-}" "$host") || exit 1 "$idcred" "$ident" "${MOSAIC_CREDENTIAL_ESTATE:-}" "$host") || exit 1
trace_resolution identity credential-resolved "$ident" "$host" git-credential-mosaic resolution_path=identity
trace_resolution credential-resolved "$ident" "$host" git-credential-mosaic
echo "username=${ident}" echo "username=${ident}"
echo "password=${token}" echo "password=${token}"
exit 0 exit 0
fi fi
if [ -r "$idtok" ]; then if [ -r "$idtok" ]; then
trace_resolution identity credential-resolved "$ident" "$host" git-credential-mosaic resolution_path=identity
trace_resolution credential-resolved "$ident" "$host" git-credential-mosaic
echo "username=${ident}" echo "username=${ident}"
echo "password=$(cat "$idtok")" echo "password=$(cat "$idtok")"
exit 0 exit 0
@@ -98,7 +101,8 @@ esac
# shellcheck source=../_lib/credentials.sh # shellcheck source=../_lib/credentials.sh
source "$script_dir/../_lib/credentials.sh" source "$script_dir/../_lib/credentials.sh"
load_credentials "$svc" >/dev/null 2>&1 || exit 0 load_credentials "$svc" >/dev/null 2>&1 || exit 0
trace_resolution shared shared-credential-resolved '<interactive-shared>' "$host" credentials-loader resolution_path=shared
trace_resolution shared-credential-resolved '<interactive-shared>' "$host" credentials-loader
# GITEA_USER is not populated by load_credentials (it only exports # GITEA_USER is not populated by load_credentials (it only exports
# GITEA_URL/GITEA_TOKEN for gitea-*), so this fallback is normally taken. Gitea's # GITEA_URL/GITEA_TOKEN for gitea-*), so this fallback is normally taken. Gitea's
# git-over-HTTP auth authenticates from the token itself (the password field), # git-over-HTTP auth authenticates from the token itself (the password field),