ask-auth 0.1.4 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 52438e8c475956073bd3f61dcba1e5f6f6ff0619cf83532ba6429603786373e6
-  data.tar.gz: 199345260588e9813e0feddd9881fbcf7290e67dae2ed5fd259c380085927dad
+  metadata.gz: bb2c28ee519b76814303a1c502ad2cd707bda862ea84ba1d9172656a07fb9c92
+  data.tar.gz: a1eb477ff8f9fb5a7e4b6e35e268e372644e1e0c596d32f622392d003e36ff63
 SHA512:
-  metadata.gz: 39dd2a342b2b02afb910bc1132b8e90e211a2607d0413db69808646ac04fa91653c16d9014284f5e6a841370a497621d4eb6b83c83151c46a7d6a73739f9f815
-  data.tar.gz: 0dc793d15763b903da6b55b85e0791ef90c4c86f6d81059abab08211767d7d980b492c774d305dea683d884d68869dd98f9d4269abd72b43980909a3b4407c3a
+  metadata.gz: 523eb5835f6d43f808a0eed7c80ca1fb51c6e97c7f47ecfce9920b15edc5a9521edb6a42be99f17b9ebd5540bec4df0c6a562f9aabc3e45c378275dadf91ab68
+  data.tar.gz: 81e3eb0a8f88c908edf12942453a5156402f072b28a8de0cd776787ad7a94667dc9449411bfaa9a3c2622c56c7144dbcaf9a8b0c784c6142ff6f38b56703b639

data/lib/ask/auth/providers/rails_credentials.rb

@@ -5,28 +5,17 @@ module Ask
     module Providers
       # Resolves credentials from Rails encrypted credentials.
       #
-      # Tries multiple strategies in order, from least to most nested:
+      # Supports two lookup modes determined by the +name+ argument type:
       #
-      #   1. Full name as a single top-level key (flat layout)
-      #      +resolve(:openai_api_key)+ → +Rails.application.credentials.openai_api_key+
+      #   Symbol/String  → flat key, looked up literally
+      #     resolve(:opencode_api_key)      → credentials.opencode_api_key
+      #     resolve("opencode_api_key")     → credentials.opencode_api_key
       #
-      #   2. Progressively split into prefix + joined suffix
-      #      +resolve(:opencode_api_key)+ → tries:
-      #        a. +Rails.application.credentials.opencode.api_key+       ← most common
-      #        b. +Rails.application.credentials.opencode.api.key+        ← fully split
+      #   Array          → path segments, navigated in order
+      #     resolve([:opencode, :api_key])  → credentials.opencode.api_key
+      #     resolve([:opencode, :go, :api_key]) → credentials.opencode.go.api_key
       #
-      #   3. For compound provider slugs, +resolve(:opencode_go_api_key)+ tries:
-      #      a. +Rails.application.credentials.opencode.go_api_key+      ← slug as single key
-      #      b. +Rails.application.credentials.opencode.go.api_key+     ← slug + api_key
-      #      c. +Rails.application.credentials.opencode.go.api.key+     ← fully split
-      #
-      #   4. For deeply nested, +resolve(:nvidia_nim_api_key)+ tries:
-      #      a. +Rails.application.credentials.nvidia.nim_api_key+      ← nvidia + nim_api_key
-      #      b. +Rails.application.credentials.nvidia.nim.api_key+      ← nvidia.nim + api_key
-      #      c. +Rails.application.credentials.nvidia.nim.api.key+     ← fully split
-      #
-      # Strategy 2b/3b/4b keep +api_key+ intact as a single credential key
-      # instead of breaking it into +api+ and +key+.
+      # No splitting, no guessing. The caller determines the lookup path.
       #
       # Safely returns nil when Rails is not loaded.
       class RailsCredentials
@@ -34,41 +23,23 @@ module Ask
           return nil unless defined?(::Rails) && ::Rails.application.respond_to?(:credentials)
 
           creds = ::Rails.application.credentials
-          s = name.to_s
-          parts = s.split("_")
-          return nil if parts.empty?
-
-          # 1. Full name as a single top-level key
-          #    Must check the value, not just respond_to?, because
-          #    ActiveSupport::OrderedOptions#respond_to? returns true
-          #    for any method name, even when the key doesn't exist.
-          val = creds.public_send(s) rescue nil
-          return val if val
-
-          # 2. Try progressively longer prefixes, keeping the remainder
-          #    joined as a single key name at each level.
-          #    split_at=1: parts[0] as prefix, parts[1..] joined as key
-          #    split_at=2: parts[0..1] as prefix, parts[2..] joined as key
-          #    etc.
-          (1...parts.length).each do |split_at|
-            prefix_parts = parts.take(split_at)
-            key = parts.drop(split_at).join("_")
-
-            obj = prefix_parts.reduce(creds) do |o, p|
-              break nil unless o.respond_to?(p)
-              o.public_send(p)
-            end
-            next unless obj
+          parts = Array(name).map { |p| p.to_s.strip }
+          return nil if parts.empty? || parts.any?(&:empty?)
 
+          # Navigate the path segments. Must check the VALUE, not just
+          # respond_to?, because ActiveSupport::OrderedOptions#respond_to?
+          # returns true for any method name, even when the key doesn't exist.
+          value = parts.reduce(creds) do |obj, part|
             begin
-              val = obj.public_send(key)
-              return val if val
+              val = obj.public_send(part)
+              break nil if val.nil?
+              val
             rescue NoMethodError
-              # respond_to? can lie for some credential objects
+              break nil
             end
           end
 
-          nil
+          value
         end
       end
     end

data/lib/ask/auth/version.rb

@@ -2,6 +2,6 @@
 
 module Ask
   module Auth
-    VERSION = "0.1.4"
+    VERSION = "0.2.1"
   end
 end

data/lib/ask/auth.rb

@@ -18,10 +18,12 @@ module Ask
   #
   module Auth
     class MissingCredential < KeyError
-      def initialize(name)
-        super("No credential found for #{name.inspect}. " \
-              "Set #{name.to_s.upcase} in your environment, add it to ~/.ask/credentials.yml, " \
-              "or configure a provider.")
+      def initialize(names)
+        names = Array(names).flatten
+        inspected = names.map(&:inspect).join(", ")
+        super("No credential found for #{inspected}. " \
+              "Set one of #{names.map { |n| n.to_s.upcase }.uniq.join(", ")} in your environment, " \
+              "add it to ~/.ask/credentials.yml, or configure a provider.")
       end
     end
 
@@ -49,21 +51,38 @@ module Ask
       end
 
       # Walk providers in order and return the first non-nil credential.
-      # +name+:: Symbol or String identifying the credential (e.g. +:github_token+)
+      # Tries each name in order and returns the first match.
+      #
+      # Each +name+ can be:
+      #   Symbol/String  → flat key, tried literally by all providers
+      #   Array          → path segments, used for nested lookups (e.g., Rails credentials)
+      #
+      #   Ask::Auth.resolve(:openai_api_key)                    # flat key
+      #   Ask::Auth.resolve(:opencode_api_key, :opencode_go_api_key)  # fallbacks
+      #   Ask::Auth.resolve([:opencode, :api_key])              # nested path: credentials.opencode.api_key
+      #   Ask::Auth.resolve(:opencode_go_api_key, [:opencode, :api_key], user: current_user)
+      #
+      # +names+:: One or more Symbols, Strings, or Arrays identifying the credential
       # +user+:: Optional user record for per-user providers (Database, OAuth)
-      def resolve(name, user: nil)
-        name = name.to_s.strip
-        return nil if name.empty?
+      def resolve(*names, user: nil)
+        return nil if names.empty?
 
-        configuration.providers.each do |provider|
-          value = provider.call(name, user: user)
-          next if value.nil?
+        names.each do |name|
+          # Validate the name
+          parts = Array(name).map { |p| p.to_s.strip }
+          next if parts.empty? || parts.any?(&:empty?)
 
-          normalized = normalize(value)
-          return normalized unless normalized.nil?
+          configuration.providers.each do |provider|
+            # Pass the original form (Symbol/Array) so providers can interpret it
+            value = provider.call(name, user: user)
+            next if value.nil?
+
+            normalized = normalize(value)
+            return normalized unless normalized.nil?
+          end
         end
 
-        raise MissingCredential, name
+        raise MissingCredential, names
       end
 
       private

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ask-auth
 version: !ruby/object:Gem::Version
-  version: 0.1.4
+  version: 0.2.1
 platform: ruby
 authors:
 - Kaka Ruto