ask-auth 0.2.0 → 0.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 899769786d686dad5733fb428f4947d077af5e4913573558890ac309dc246d7e
-  data.tar.gz: 8dad782619a917d310858ec90136b86638fdffe64e71060c72ba8af42f91a41f
+  metadata.gz: d25e993c78fcede6b8d50972bfc8b99b5a30a03d85cf9c725eb5d5f3ae728725
+  data.tar.gz: d9792c086a2d3f84ecdbd5760bfd5ec02bb0074d3cb57670d8df5c7b3280015d
 SHA512:
-  metadata.gz: 69064653971ef660f7c2aa2f297f5a1119888a18b5521ebee9c4bbf1058f474ffb70275d9cf60dec044ee94565520d9e0fc9defc782ee4b74505e17b01d4a6c4
-  data.tar.gz: e819dd4a9a9bac4a5d9cca0064d750610b16c8d1baf3de33cd4bb792ec3292279091a271e0c34ccfa85738ff228cd798384e503ef4cd909aae96b4e66b118fca
+  metadata.gz: 29a7da04a8d494a59ace1c34840d7b57dead0277f19f02b6e824e30eb9511df5cd6453cfad4ce829a95666f4b9cd5d9f5ae3e43d6b67d549dcbb345c77f51c92
+  data.tar.gz: 94757f55995fac37460342c50ccbcac891096dc9f5a4b6c429d5f431d181a13556364301c065f3c2c15208a20209de48d33149ba6987bfdd11b8476f4c2cc819

data/lib/ask/auth/providers/file.rb

@@ -24,6 +24,7 @@ module Ask
           data = load_file
           return nil unless data
 
+          return nil unless name.respond_to?(:to_s)
           value = data[name.to_s] || data[name.to_sym]
           value
         end

data/lib/ask/auth/providers/rails_credentials.rb

@@ -5,28 +5,17 @@ module Ask
     module Providers
       # Resolves credentials from Rails encrypted credentials.
       #
-      # Tries multiple strategies in order, from least to most nested:
+      # Supports two lookup modes determined by the +name+ argument type:
       #
-      #   1. Full name as a single top-level key (flat layout)
-      #      +resolve(:openai_api_key)+ → +Rails.application.credentials.openai_api_key+
+      #   Symbol/String  → flat key, looked up literally
+      #     resolve(:opencode_api_key)      → credentials.opencode_api_key
+      #     resolve("opencode_api_key")     → credentials.opencode_api_key
       #
-      #   2. Progressively split into prefix + joined suffix
-      #      +resolve(:opencode_api_key)+ → tries:
-      #        a. +Rails.application.credentials.opencode.api_key+       ← most common
-      #        b. +Rails.application.credentials.opencode.api.key+        ← fully split
+      #   Array          → path segments, navigated in order
+      #     resolve([:opencode, :api_key])  → credentials.opencode.api_key
+      #     resolve([:opencode, :go, :api_key]) → credentials.opencode.go.api_key
       #
-      #   3. For compound provider slugs, +resolve(:opencode_go_api_key)+ tries:
-      #      a. +Rails.application.credentials.opencode.go_api_key+      ← slug as single key
-      #      b. +Rails.application.credentials.opencode.go.api_key+     ← slug + api_key
-      #      c. +Rails.application.credentials.opencode.go.api.key+     ← fully split
-      #
-      #   4. For deeply nested, +resolve(:nvidia_nim_api_key)+ tries:
-      #      a. +Rails.application.credentials.nvidia.nim_api_key+      ← nvidia + nim_api_key
-      #      b. +Rails.application.credentials.nvidia.nim.api_key+      ← nvidia.nim + api_key
-      #      c. +Rails.application.credentials.nvidia.nim.api.key+     ← fully split
-      #
-      # Strategy 2b/3b/4b keep +api_key+ intact as a single credential key
-      # instead of breaking it into +api+ and +key+.
+      # No splitting, no guessing. The caller determines the lookup path.
       #
       # Safely returns nil when Rails is not loaded.
       class RailsCredentials
@@ -34,41 +23,23 @@ module Ask
           return nil unless defined?(::Rails) && ::Rails.application.respond_to?(:credentials)
 
           creds = ::Rails.application.credentials
-          s = name.to_s
-          parts = s.split("_")
-          return nil if parts.empty?
-
-          # 1. Full name as a single top-level key
-          #    Must check the value, not just respond_to?, because
-          #    ActiveSupport::OrderedOptions#respond_to? returns true
-          #    for any method name, even when the key doesn't exist.
-          val = creds.public_send(s) rescue nil
-          return val if val
-
-          # 2. Try progressively longer prefixes, keeping the remainder
-          #    joined as a single key name at each level.
-          #    split_at=1: parts[0] as prefix, parts[1..] joined as key
-          #    split_at=2: parts[0..1] as prefix, parts[2..] joined as key
-          #    etc.
-          (1...parts.length).each do |split_at|
-            prefix_parts = parts.take(split_at)
-            key = parts.drop(split_at).join("_")
-
-            obj = prefix_parts.reduce(creds) do |o, p|
-              break nil unless o.respond_to?(p)
-              o.public_send(p)
-            end
-            next unless obj
+          parts = Array(name).map { |p| p.to_s.strip }
+          return nil if parts.empty? || parts.any?(&:empty?)
 
+          # Navigate the path segments. Must check the VALUE, not just
+          # respond_to?, because ActiveSupport::OrderedOptions#respond_to?
+          # returns true for any method name, even when the key doesn't exist.
+          value = parts.reduce(creds) do |obj, part|
             begin
-              val = obj.public_send(key)
-              return val if val
+              val = obj.public_send(part)
+              break nil if val.nil?
+              val
             rescue NoMethodError
-              # respond_to? can lie for some credential objects
+              break nil
             end
           end
 
-          nil
+          value
         end
       end
     end

data/lib/ask/auth/version.rb

@@ -2,6 +2,6 @@
 
 module Ask
   module Auth
-    VERSION = "0.2.0"
+    VERSION = "0.2.2"
   end
 end

data/lib/ask/auth.rb

@@ -51,20 +51,29 @@ module Ask
       end
 
       # Walk providers in order and return the first non-nil credential.
-      # Accepts one or more credential names — tries each in order,
-      # returning the first match across all providers.
+      # Tries each name in order and returns the first match.
       #
-      #   Ask::Auth.resolve(:openai_api_key)
-      #   Ask::Auth.resolve(:opencode_go_api_key, :opencode_api_key, user: current_user)
+      # Each +name+ can be:
+      #   Symbol/String  → flat key, tried literally by all providers
+      #   Array          → path segments, used for nested lookups (e.g., Rails credentials)
       #
-      # +names+:: One or more Symbols or Strings identifying the credential
+      #   Ask::Auth.resolve(:openai_api_key)                    # flat key
+      #   Ask::Auth.resolve(:opencode_api_key, :opencode_go_api_key)  # fallbacks
+      #   Ask::Auth.resolve([:opencode, :api_key])              # nested path: credentials.opencode.api_key
+      #   Ask::Auth.resolve(:opencode_go_api_key, [:opencode, :api_key], user: current_user)
+      #
+      # +names+:: One or more Symbols, Strings, or Arrays identifying the credential
       # +user+:: Optional user record for per-user providers (Database, OAuth)
       def resolve(*names, user: nil)
-        names = names.flatten.map { |n| n.to_s.strip }.reject(&:empty?)
         return nil if names.empty?
 
         names.each do |name|
+          # Validate the name
+          parts = Array(name).map { |p| p.to_s.strip }
+          next if parts.empty? || parts.any?(&:empty?)
+
           configuration.providers.each do |provider|
+            # Pass the original form (Symbol/Array) so providers can interpret it
             value = provider.call(name, user: user)
             next if value.nil?
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ask-auth
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.2
 platform: ruby
 authors:
 - Kaka Ruto