jason.woltje
975084abe2
Owner direction: the stack must never impact default harness usage. Correction to M19 as shipped (nothing had been created in ~/.pi — the move breaks nothing). - Mosaic-managed accounts: <dataRoot>/auth/<account>.json, perms 0600 enforced (loose perms flagged in listings, refused by --auth — mirrors gitea-api.sh credential hygiene). - ~/.pi is read-only to the stack, permanently; the only interaction remains the existing read-only container mount of the default credential. Recorded as a ROADMAP standing decision. - auth.sh is now config-driven (data root from config.json, fail closed, consistent with every other tool); status reports both sources labeled. - agent.sh --auth resolution moved after load_config (needs the data root); missing/symlinked/non-0600 accounts refuse. - test-auth.sh: 15 no-Docker cases (accounts-create-nothing, loose-perms refusal, invalid-config refusal added). Test-authoring correction recorded in BUILD-LOG (fixture-state mismatch caught before running). Suites 24/15/90/14/17 + verify green.
119 lines
4.5 KiB
Bash
Executable File
119 lines
4.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# auth.sh — pi credential checkpoint (M19, corrected per owner in #48):
|
|
# per-provider auth report and mosaic-managed account listing. Never prints
|
|
# credential material: provider names, credential types, permission bits,
|
|
# and env var NAMES only.
|
|
#
|
|
# Ownership rule (#48): ~/.pi is READ-ONLY to the stack — the only
|
|
# interaction is the existing read-only container mount of the default
|
|
# credential. Mosaic-managed accounts live under the data root:
|
|
# <dataRoot>/auth/<account>.json
|
|
#
|
|
# Usage:
|
|
# scripts/auth.sh status report default harness credential + accounts
|
|
# scripts/auth.sh accounts list mosaic-managed accounts (data root)
|
|
#
|
|
# Exit codes: 0 report produced · 2 credential file unparseable ·
|
|
# 3 default credential file missing for a read · 4 file/environment problem.
|
|
set -uo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
# shellcheck source=common.sh
|
|
source scripts/common.sh
|
|
load_config # fail closed: data root comes from the system config
|
|
|
|
HARNESS_FILE="${PI_AUTH_FILE:-$HOME/.pi/agent/auth.json}"
|
|
ACCOUNTS_DIR="$MOSAIC_DEV_DIR/auth"
|
|
OP="${1:-}"
|
|
|
|
# report_file FILE — providers + types for a pi auth.json; never values.
|
|
report_file() {
|
|
local file="$1"
|
|
if [ ! -e "$file" ]; then
|
|
echo " (not present)"
|
|
return 3
|
|
fi
|
|
if [ ! -f "$file" ] || [ -L "$file" ]; then
|
|
echo "auth: credential file must be a regular, non-symbolic-link file: $file" >&2
|
|
return 4
|
|
fi
|
|
if ! node -e '
|
|
const fs = require("fs");
|
|
const file = process.argv[1];
|
|
let doc;
|
|
try { doc = JSON.parse(fs.readFileSync(file, "utf8")); }
|
|
catch (e) { console.error("auth: credential file is not valid JSON: " + e.message); process.exit(2); }
|
|
if (typeof doc !== "object" || doc === null || Array.isArray(doc)) {
|
|
console.error("auth: credential file must be a JSON object keyed by provider"); process.exit(2);
|
|
}
|
|
const st = fs.statSync(file);
|
|
console.log(" perms " + String(st.mode & 0o777).toString(8).padStart(3, "0"));
|
|
const keys = Object.keys(doc).sort();
|
|
if (keys.length === 0) console.log(" providers: (none in file)");
|
|
for (const k of keys) {
|
|
const e = doc[k];
|
|
let type = "unknown";
|
|
if (typeof e === "object" && e !== null && typeof e.type === "string" && /^[a-z0-9_-]+$/i.test(e.type)) type = e.type;
|
|
console.log(" " + k + " type=" + type + " source=auth.json");
|
|
}
|
|
' "$file"; then
|
|
return 2
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
case "$OP" in
|
|
status)
|
|
echo "default harness credential (read-only to the stack; never written): $HARNESS_FILE"
|
|
RC=0
|
|
report_file "$HARNESS_FILE" || RC=$?
|
|
echo "resolution: auth.json entries take priority over environment (pi order: --api-key > auth.json > env > models.json)"
|
|
ENV_NAMES="$(env | grep -oE '^[A-Z0-9_]+_API_KEY' | sort -u | paste -sd, -)"
|
|
if [ -n "$ENV_NAMES" ]; then
|
|
echo "env-side credential-like names set (informational; file entries take priority): $ENV_NAMES"
|
|
else
|
|
echo "env-side credential-like names set: (none)"
|
|
fi
|
|
echo "mosaic-managed accounts ($ACCOUNTS_DIR):"
|
|
shopt -s nullglob
|
|
FILES=("$ACCOUNTS_DIR"/*.json)
|
|
shopt -u nullglob
|
|
if [ "${#FILES[@]}" -eq 0 ]; then
|
|
echo " (none)"
|
|
else
|
|
for f in "${FILES[@]}"; do
|
|
name="$(basename "$f" .json)"
|
|
perms="$(stat -c %a "$f" 2>/dev/null || echo '?')"
|
|
marker=""
|
|
[ "$f" = "$HARNESS_FILE" ] && marker=" <- active (PI_AUTH_FILE)"
|
|
warn=""
|
|
[ "$perms" != "600" ] && warn=" [not 0600 — agent --auth will refuse]"
|
|
echo " $name (perms $perms)$marker$warn"
|
|
done
|
|
fi
|
|
exit "$RC"
|
|
;;
|
|
accounts)
|
|
shopt -s nullglob
|
|
FILES=("$ACCOUNTS_DIR"/*.json)
|
|
shopt -u nullglob
|
|
if [ "${#FILES[@]}" -eq 0 ]; then
|
|
echo "accounts: (none) — mosaic-managed accounts are $ACCOUNTS_DIR/<account>.json (perms 0600)"
|
|
exit 0
|
|
fi
|
|
echo "mosaic-managed accounts in $ACCOUNTS_DIR:"
|
|
for f in "${FILES[@]}"; do
|
|
name="$(basename "$f" .json)"
|
|
perms="$(stat -c %a "$f" 2>/dev/null || echo '?')"
|
|
marker=""
|
|
[ "$f" = "$HARNESS_FILE" ] && marker=" <- active (PI_AUTH_FILE)"
|
|
warn=""
|
|
[ "$perms" != "600" ] && warn=" [not 0600 — agent --auth will refuse]"
|
|
echo " $name (perms $perms)$marker$warn"
|
|
done
|
|
;;
|
|
*)
|
|
echo "usage: scripts/auth.sh status | accounts" >&2
|
|
exit 4
|
|
;;
|
|
esac
|