Unattended refresh: exchange an API key without a browser and keep the token file fresh
Maintainers usually reply within 1 day
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 68/100
- Issue type
- Feature
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- rust
- Domain
- authentication, cli, security
Research direction
Start with expiry handling in src/main.rs and the STS request construction in src/sts.rs, especially append_pair("WebIdentityToken", …). Trace the existing credential exchange and the proxy's form-encoded /.sts path, including the dependency on source-cooperative/source.coop#548. Done means a daemon can refresh AWS_WEB_IDENTITY_TOKEN_FILE from an API key without a browser, and the token is absent from request URLs.
Written by the indexing model from the issue text.
Description
Phase 5 — API keys.
Today
The CLI caches credentials and checks their expiry — and when they have expired it stops: Cached credentials have expired. Run 'source-coop login' to refresh. (src/main.rs). That is interactive, so nothing keeps a token file fresh for a daemon.
The CLI also sends the token as a URL query parameter (src/sts.rs, append_pair("WebIdentityToken", …)), so bearer tokens land in access logs.
Do
- Add a mode that reads an API key, exchanges it at
/.stswithout a browser, and keepsAWS_WEB_IDENTITY_TOKEN_FILEfresh. - Send the token in the request body. The proxy already accepts form-encoded bodies, so this is CLI-only.
Done when
A daemon holding a key and no browser runs across a credential expiry, and the token never appears in a request URL.
Depends on source-cooperative/source.coop#548.
Part of source-cooperative/source.coop#491.
- Dominant language
- Rust
- Stars
- 1
- Forks
- 0
- Avg merge
- 18h 52m
- Merged PRs (30d)
- 19
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from source-cooperative/source-coop-cli
-
enhancement
Difficulty 4/5 3-5 days Newbie friendliness 28/100
source-cooperative/source-coop-cli#35 ·
Maintainers usually reply within 1 day
-
enhancement
Difficulty 3/5 3-5 days Newbie friendliness 22/100
source-cooperative/source-coop-cli#34 ·
Maintainers usually reply within 1 day
-
enhancement
Difficulty 4/5 3-5 days Newbie friendliness 28/100
source-cooperative/source-coop-cli#33 ·
Maintainers usually reply within 1 day
-
enhancement
Difficulty 4/5 3-5 days Newbie friendliness 35/100
source-cooperative/source-coop-cli#32 ·
Maintainers usually reply within 1 day
-
enhancement
Difficulty 3/5 1-2 days Newbie friendliness 28/100
source-cooperative/source-coop-cli#31 ·
Maintainers usually reply within 1 day
All issues in source-cooperative/source-coop-cli
Similar issues
-
agent duplicate providers tool triaged
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
founders_reward panics on a configured Testnet when the slow-start subsidy is not a multiple of 5Openexternal-contribution
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
ZcashFoundation/zebra#11792 ·
Maintainers usually reply within 1 day
-
content:edit documentation effort:high
Difficulty 1/5 1-3 hours Newbie friendliness 67/100
cloudflare/cloudflare-docs#34428 ·
Maintainers usually reply within 1 day
-
area/cli bug
Difficulty 2/5 1-3 hours Newbie friendliness 85/100