Kyle Isom
edef642025
Replace per-call SSH signing with a two-layer auth system: Server: AuthInterceptor verifies JWT tokens (HMAC-SHA256 signed with repo-local jwt.key). Authenticate RPC accepts SSH-signed challenges and issues 30-day JWTs. Expired-but-valid tokens return a ReauthChallenge in error details (server-provided nonce for fast re-auth). Authenticate RPC is exempt from token requirement. Client: TokenCredentials replaces SSHCredentials as the primary PerRPCCredentials. NewWithAuth creates clients with auto-renewal — EnsureAuth obtains initial token, retryOnAuth catches Unauthenticated errors and re-authenticates transparently. Token cached at $XDG_STATE_HOME/sgard/token (0600). CLI: dialRemote() helper handles token loading, connection setup, and initial auth. Push/pull/prune commands simplified to use it. Proto: Added Authenticate RPC, AuthenticateRequest/Response, ReauthChallenge messages. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
20 lines
674 B
Modula-2
20 lines
674 B
Modula-2
module github.com/kisom/sgard
|
|
|
|
go 1.25.7
|
|
|
|
require (
|
|
github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/jonboulle/clockwork v0.5.0 // indirect
|
|
github.com/spf13/cobra v1.10.2 // indirect
|
|
github.com/spf13/pflag v1.0.9 // indirect
|
|
golang.org/x/crypto v0.49.0 // indirect
|
|
golang.org/x/net v0.51.0 // indirect
|
|
golang.org/x/sys v0.42.0 // indirect
|
|
golang.org/x/text v0.35.0 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
|
|
google.golang.org/grpc v1.79.3 // indirect
|
|
google.golang.org/protobuf v1.36.11 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|