50 lines
2.4 KiB
Markdown
50 lines
2.4 KiB
Markdown
---
|
|
name: gitea-token-from-http-credential-store
|
|
description: Extract the Dankclaw Gitea token from ~/.config/secrets/gitea (a URL-line credential store using http:// and %3a-encoded port) without the empty-token 401; covers the https-only extraction trap and the $$..$$ shell-expansion trap.
|
|
---
|
|
|
|
# Gitea token out of the HTTP credential store
|
|
|
|
`~/.config/secrets/gitea` is a git **credential-store file**, not a bare token file. On the Dank
|
|
boxes it reads:
|
|
|
|
```
|
|
http://dank:b7caa2f689cdc00841854b85cd0173386f707d86@192.168.0.143%3a3000
|
|
```
|
|
|
|
Three traps, all of which produce a silent **401 Unauthorized** rather than a parse error:
|
|
|
|
1. **Scheme is `http://`, not `https://`.** An extraction pattern written `s#^https://…#` matches
|
|
nothing and yields an empty token. GNU BRE has no `?` quantifier — use the
|
|
`http[s]*://` form or Python `https?://`:
|
|
|
|
```bash
|
|
TOK=$(sed -n 's#^http[s]*://[^:]*:\([^@]*\)@.*#\1#p' ~/.config/secrets/gitea)
|
|
test -n "$TOK" || echo "extraction failed" # never ship an unasserted capture
|
|
```
|
|
|
|
```py
|
|
tok = re.search(r"https?://[^:]*:([^@]+)@", pathlib.Path.home().joinpath(".config/secrets/gitea").read_text()).group(1)
|
|
```
|
|
|
|
Always assert non-empty (`test -n`) or print `${#TOK}` once: a correct token here is 40 chars,
|
|
and the length check catches a wrong pattern without echoing the secret.
|
|
|
|
2. **The token body contains `$$…$$`.** An omp output token inside a *file* is inert, but pasted
|
|
literally into a shell script line it expands (`$$` = shell PID). Keep it in a variable or read
|
|
it from the file — never inline it in command text.
|
|
|
|
3. **Port is percent-encoded (`%3a3000`).** Don't rebuild the API URL from that line; the working
|
|
endpoints are `http://192.168.0.143:3000/api/v1/...` and `https://gitea.franksdank.cloud/api/v1/...`
|
|
— both serve the same API, so a host/port mismatch looks like an auth failure.
|
|
|
|
Auth header for every call: `Authorization: token $TOK` (the `token` keyword is required; a bare
|
|
value 401s too).
|
|
|
|
**Never print the token.** Extract into a variable, then use `$TOK`; read the file with `read
|
|
path=...:raw` only when you must inspect the format.
|
|
|
|
Related: `gitea-pr-api-cycle` (POST/PATCH body shapes), `gitea-merge-form-encoded` (merge needs
|
|
`do=merge&merge_style=no-ff`, answers 200 with an empty body — verify by fetching the PR, not by
|
|
reading the response), `gitea-credential-store-url-format`.
|