Module: StillActive::SourceCredentials

Extended by:
SourceCredentials
Included in:
SourceCredentials
Defined in:
lib/still_active/source_credentials.rb

Overview

Auth headers for a gem source, resolved the way Bundler itself does: from its per-host credential store (bundle config / the BUNDLE_<HOST> env var).

The store is HOST-KEYED (credentials_for is self[uri.to_s] || self[uri.host]), which is the whole security property when a source URI comes from a lockfile: a host the user never configured resolves to no credential, so a malicious lockfile naming attacker.example.com cannot make still_active send another host's credential there. There is deliberately NO ambient/global fallback here; the only ambient token still_active holds (--artifactory-token) is guarded by an explicit host allowlist inside ArtifactoryClient, which is the sole caller that adds it.

Instance Method Summary collapse

Instance Method Details

#auth_header(credentials) ⇒ Object

Turns a Bundler credential string into an Authorization header: user:pass becomes Basic (each half percent-decoded, since Bundler stores them encoded), a bare token becomes Bearer. Empty/nil yields no header.



28
29
30
31
32
33
34
35
36
37
 
# File 'lib/still_active/source_credentials.rb', line 28

def auth_header(credentials)
  return {} if credentials.nil? || credentials.empty?

  if credentials.include?(":")
    user, pass = credentials.split(":", 2).map { |part| CGI.unescape(part) }
    {"Authorization" => "Basic #{["#{user}:#{pass}"].pack("m0")}"}
  else
    {"Authorization" => "Bearer #{credentials}"}
  end
end

#headers_for(source_uri) ⇒ Object 



21
22
23
 
# File 'lib/still_active/source_credentials.rb', line 21

def headers_for(source_uri)
  auth_header(Bundler.settings.credentials_for(URI(source_uri)))
end