credential: add a field called "ephemeral"

Now that we have support for a wide variety of types of authentication,
it's important to indicate to other credential helpers whether they
should store credentials, since not every credential helper may
intuitively understand all possible values of the authtype field.  Do so
with a boolean field called "ephemeral", to indicate whether the
credential is expected to be temporary.

For example, in HTTP Digest authentication, the Authorization header
value is based off a nonce.  It isn't useful to store this value
for later use because reusing the credential long term will not result
in successful authentication due to the nonce necessarily differing.

An additional case is potentially short-lived credentials, which may
last only a few hours.  It similarly wouldn't be helper for other
credential helpers to attempt to provide these much later.

We do still pass the value to "git credential store" or "git credential
erase", since it may be helpful to the original helper to know whether
the operation was successful.

Signed-off-by: brian m. carlson <sandals@crustytoothpaste.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/credential.c b/credential.c
index f5396629df6affb1f639b3dec1e8ce99201511b2..3531d7434641ae7f83f90bee6047d2a74638f385 100644 (file)
--- a/credential.c
+++ b/credential.c
@@ -289,6 +289,8 @@ int credential_read(struct credential *c, FILE *fp,
                } else if (!strcmp(key, "path")) {
                        free(c->path);
                        c->path = xstrdup(value);
+               } else if (!strcmp(key, "ephemeral")) {
+                       c->ephemeral = !!git_config_bool("ephemeral", value);
                } else if (!strcmp(key, "wwwauth[]")) {
                        strvec_push(&c->wwwauth_headers, value);
                } else if (!strcmp(key, "capability[]") && !strcmp(value, "authtype")) {
@@ -339,6 +341,8 @@ void credential_write(const struct credential *c, FILE *fp,
                credential_write_item(fp, "capability[]", "authtype", 0);
                credential_write_item(fp, "authtype", c->authtype, 0);
                credential_write_item(fp, "credential", c->credential, 0);
+               if (c->ephemeral)
+                       credential_write_item(fp, "ephemeral", "1", 0);
        }
        credential_write_item(fp, "protocol", c->protocol, 1);
        credential_write_item(fp, "host", c->host, 1);

diff --git a/credential.h b/credential.h
index b524fdba598f0b3412f324a93860fcfac7c72d0c..da2a4802b740b1f3040427d60e888e4776fe8dd8 100644 (file)
--- a/credential.h
+++ b/credential.h
@@ -152,6 +152,7 @@ struct credential {
        unsigned header_is_last_match:1;
 
        unsigned approved:1,
+                ephemeral:1,
                 configured:1,
                 quit:1,
                 use_http_path:1,

diff --git a/t/t0300-credentials.sh b/t/t0300-credentials.sh
index daf330ddd817db2dc2bdcf03a35b9a02f2a8bd2a..eceb6bbfbec80f44ee703062f5d5390c7af83862 100755 (executable)
--- a/t/t0300-credentials.sh
+++ b/t/t0300-credentials.sh
@@ -51,6 +51,17 @@ test_expect_success 'setup helper scripts' '
        test -z "$credential" || echo credential=$credential
        EOF
 
+       write_script git-credential-verbatim-ephemeral <<-\EOF &&
+       authtype=$1; shift
+       credential=$1; shift
+       . ./dump
+       echo capability[]=authtype
+       test -z "${capability##*authtype*}" || exit 0
+       test -z "$authtype" || echo authtype=$authtype
+       test -z "$credential" || echo credential=$credential
+       echo "ephemeral=1"
+       EOF
+
        write_script git-credential-verbatim-with-expiry <<-\EOF &&
        user=$1; shift
        pass=$1; shift
@@ -99,6 +110,25 @@ test_expect_success 'credential_fill invokes helper with credential' '
        EOF
 '
 
+test_expect_success 'credential_fill invokes helper with ephemeral credential' '
+       check fill "verbatim-ephemeral Bearer token" <<-\EOF
+       capability[]=authtype
+       protocol=http
+       host=example.com
+       --
+       capability[]=authtype
+       authtype=Bearer
+       credential=token
+       ephemeral=1
+       protocol=http
+       host=example.com
+       --
+       verbatim-ephemeral: get
+       verbatim-ephemeral: capability[]=authtype
+       verbatim-ephemeral: protocol=http
+       verbatim-ephemeral: host=example.com
+       EOF
+'
 
 test_expect_success 'credential_fill invokes multiple helpers' '
        check fill useless "verbatim foo bar" <<-\EOF