feat(auth): guide login, readable status and switch without --host

tea auth login without a method flag asks on a terminal for the instance
(prefilled from the repository, default_host or the only instance), how
to log in (token, browser, SSH key), the pasted token without echo with
a link to the applications page, where to keep it and whether git
should use tea for the instance. Bare hosts are accepted. Logging in to
an account tea already has replaces its credential after a
confirmation, or with --yes; a named account is confirmed before the
token is asked for. Every login ends with "Logged in to HOST as USER
(token, keyring)". OAuth requests write scopes for everything but
administration by default, and --scopes chooses others; --web is an
alias of --oauth.

auth status prints a block per instance with the active account, how
each account authenticates, its expiry, verification and token scopes,
whether git uses tea, and the GITEA_TOKEN of the environment. Piped it
prints tab-separated fields. It fails with exit code 4 when no account
or no usable credential exists instead of printing nothing.

auth switch takes the instance of the repository, --host, default_host
or the sole instance instead of requiring --host, toggles between two
accounts, asks on a terminal with more, and accepts --user. auth logout
takes the account as an argument, names it in its errors, and asks git's
other credential helpers to forget what they stored for the account.
auth refresh points token accounts to tea auth login --with-token, and
the new auth token prints the token of an account for scripts.

Every auth command reports what it did on a terminal and has a long
help text and examples.

Signed-off-by: bircni <bircni@icloud.com>

internal/git/credentials.go

@@ -6,6 +6,9 @@ package git
 import (
 	"context"
 	"errors"
+	"fmt"
+	"net/url"
+	"os"
 	"path/filepath"
 	"slices"
 	"strings"
@@ -118,3 +121,57 @@ func SetupCredentials(ctx context.Context, runner Runner, options CredentialSetu
 	_, err = runner.Output(ctx, cwd, false, "config", scope, "--add", prefix+"helper", helper)
 	return err
 }
+
+// HelperScope returns where Git is configured to ask tea for credentials of instance: "local" for
+// the repository in dir, "global", or "" when it is not.
+func HelperScope(ctx context.Context, runner Runner, dir, instance string) string {
+	normalized, err := settings.NormalizeHost(instance)
+	if err != nil {
+		return ""
+	}
+	for _, scope := range []string{"local", "global"} {
+		helpers, err := runner.Output(ctx, dir, false, "config", "--"+scope, "--get-all", "credential."+normalized+".helper")
+		if err == nil && strings.Contains(helpers, " auth git-credential ") {
+			return scope
+		}
+	}
+	return ""
+}
+
+// InputRunner runs Git with text on its standard input.
+type InputRunner interface {
+	Input(ctx context.Context, dir, input string, args ...string) (string, error)
+}
+
+// Input runs Git like Output with input on its standard input, without terminal prompts.
+func (s System) Input(ctx context.Context, dir, input string, args ...string) (string, error) {
+	env := s.Env
+	if env == nil {
+		env = os.Environ()
+	}
+	s.Env, s.In = setEnv(env, "GIT_TERMINAL_PROMPT", "0"), strings.NewReader(input)
+	return s.Output(ctx, dir, true, args...)
+}
+
+// RejectCredentials asks Git's credential helpers to erase the credentials they stored for user on
+// instance, such as a copy of tea's token that another helper kept after a push. Runners that cannot
+// send input reject nothing.
+func RejectCredentials(ctx context.Context, runner Runner, dir, instance, user string) error {
+	input, ok := runner.(InputRunner)
+	if !ok {
+		return nil
+	}
+	u, err := url.Parse(instance)
+	if err != nil || u.Host == "" {
+		return fmt.Errorf("invalid instance URL %q", instance)
+	}
+	if strings.ContainsAny(user, "\x00\r\n") {
+		return errors.New("invalid account name")
+	}
+	request := "protocol=" + u.Scheme + "\nhost=" + u.Host + "\n"
+	if user != "" {
+		request += "username=" + user + "\n"
+	}
+	_, err = input.Input(ctx, dir, request+"\n", "credential", "reject")
+	return err
+}

internal/git/credentials_test.go

@@ -90,6 +90,30 @@ func TestSetupGitCredentialsWorksWithoutAnExistingGlobalFile(t *testing.T) {
 	require.Contains(t, string(data), "auth git-credential")
 }
 
+func TestRejectCredentialsAsksHelpersToEraseTheAccount(t *testing.T) {
+	if _, err := exec.LookPath("git"); err != nil {
+		t.Skip("Git is not installed")
+	}
+	t.Setenv("GIT_CONFIG_NOSYSTEM", "1")
+	home := t.TempDir()
+	log := filepath.Join(home, "helper.log")
+	t.Setenv("GIT_CONFIG_GLOBAL", filepath.Join(home, "gitconfig"))
+	ctx := context.Background()
+	runner := System{}
+	_, err := runner.Output(ctx, home, false, "config", "--global", "credential.helper", "!f() { echo \"op=$1\" >> '"+log+"'; cat >> '"+log+"'; }; f")
+	require.NoError(t, err)
+	require.Empty(t, HelperScope(ctx, runner, home, "http://localhost:3001"))
+	require.NoError(t, RejectCredentials(ctx, runner, home, "http://localhost:3001/gitea", "alice"))
+	data, err := os.ReadFile(log)
+	require.NoError(t, err)
+	require.Equal(t, "op=erase\nprotocol=http\nhost=localhost:3001\nusername=alice\n", string(data))
+	executable, err := os.Executable()
+	require.NoError(t, err)
+	require.NoError(t, SetupCredentials(ctx, runner, CredentialSetup{Directory: home, Instance: "http://localhost:3001", Executable: executable}))
+	require.Equal(t, "global", HelperScope(ctx, runner, home, "http://localhost:3001"))
+	require.Empty(t, HelperScope(ctx, runner, home, "http://localhost:3002"))
+}
+
 func TestGitMissingConfigValueCarriesExitCode(t *testing.T) {
 	if _, err := exec.LookPath("git"); err != nil {
 		t.Skip("Git is not installed")