@serve.zone/gitops 3.0.0 → 3.1.0

package/ts/classes/connectionmanager.ts

@@ -8,6 +8,8 @@ const LEGACY_CONNECTIONS_FILE = './.nogit/connections.json';
 const CONNECTIONS_PREFIX = '/connections/';
 const KEYCHAIN_PREFIX = 'keychain:';
 
+const getRegistryTokenSecretId = (connectionId: string): string => `${connectionId}:registry`;
+
 /**
  * Manages provider connections — persists each connection as an
  * individual JSON file via StorageManager. Tokens are stored in
@@ -98,6 +100,18 @@ export class ConnectionManager {
           // Plaintext token found — auto-migrate to keychain
           await this.migrateTokenToKeychain(conn);
         }
+        if (conn.registryToken?.startsWith(KEYCHAIN_PREFIX)) {
+          const registrySecretId = conn.registryToken.substring(KEYCHAIN_PREFIX.length);
+          const realRegistryToken = await this.smartSecret.getSecret(registrySecretId);
+          if (realRegistryToken) {
+            conn.registryToken = realRegistryToken;
+          } else {
+            logger.warn(`Could not retrieve registry token for connection ${conn.id} from keychain`);
+            conn.registryToken = undefined;
+          }
+        } else if (conn.registryToken && conn.registryToken !== '***') {
+          await this.migrateRegistryTokenToKeychain(conn);
+        }
         this.connections.push(conn);
       }
     }
@@ -125,21 +139,53 @@ export class ConnectionManager {
     }
   }
 
+  private async migrateRegistryTokenToKeychain(
+    conn: interfaces.data.IProviderConnection,
+  ): Promise<void> {
+    try {
+      const secretId = getRegistryTokenSecretId(conn.id);
+      await this.smartSecret.setSecret(secretId, conn.registryToken!);
+      const jsonConn = {
+        ...conn,
+        token: `${KEYCHAIN_PREFIX}${conn.id}`,
+        registryToken: `${KEYCHAIN_PREFIX}${secretId}`,
+      };
+      await this.storageManager.setJSON(`${CONNECTIONS_PREFIX}${conn.id}.json`, jsonConn);
+      logger.info(`Migrated registry token for connection "${conn.name}" to keychain`);
+    } catch (err) {
+      logger.warn(`Failed to migrate registry token for ${conn.id} to keychain: ${err}`);
+    }
+  }
+
   private async persistConnection(conn: interfaces.data.IProviderConnection): Promise<void> {
     // Store real token in keychain
     await this.smartSecret.setSecret(conn.id, conn.token);
+    if (conn.registryToken) {
+      await this.smartSecret.setSecret(getRegistryTokenSecretId(conn.id), conn.registryToken);
+    } else {
+      await this.smartSecret.deleteSecret(getRegistryTokenSecretId(conn.id));
+    }
     // Save JSON with sentinel value
-    const jsonConn = { ...conn, token: `${KEYCHAIN_PREFIX}${conn.id}` };
+    const jsonConn = {
+      ...conn,
+      token: `${KEYCHAIN_PREFIX}${conn.id}`,
+      registryToken: conn.registryToken ? `${KEYCHAIN_PREFIX}${getRegistryTokenSecretId(conn.id)}` : undefined,
+    };
     await this.storageManager.setJSON(`${CONNECTIONS_PREFIX}${conn.id}.json`, jsonConn);
   }
 
   private async removeConnection(id: string): Promise<void> {
     await this.smartSecret.deleteSecret(id);
+    await this.smartSecret.deleteSecret(getRegistryTokenSecretId(id));
     await this.storageManager.delete(`${CONNECTIONS_PREFIX}${id}.json`);
   }
 
   getConnections(): interfaces.data.IProviderConnection[] {
-    return this.connections.map((c) => ({ ...c, token: '***' }));
+    return this.connections.map((c) => ({
+      ...c,
+      token: '***',
+      registryToken: c.registryToken ? '***' : undefined,
+    }));
   }
 
   getConnection(id: string): interfaces.data.IProviderConnection | undefined {
@@ -152,6 +198,9 @@ export class ConnectionManager {
     baseUrl: string,
     token: string,
     groupFilter?: string,
+    registryUrl?: string,
+    registryUsername?: string,
+    registryToken?: string,
   ): Promise<interfaces.data.IProviderConnection> {
     const connection: interfaces.data.IProviderConnection = {
       id: crypto.randomUUID(),
@@ -162,16 +211,19 @@ export class ConnectionManager {
       createdAt: Date.now(),
       status: 'disconnected',
       groupFilter: groupFilter || undefined,
+      registryUrl: registryUrl || undefined,
+      registryUsername: registryUsername || undefined,
+      registryToken: registryToken || undefined,
     };
     this.connections.push(connection);
     await this.persistConnection(connection);
     logger.success(`Connection created: ${name} (${providerType})`);
-    return { ...connection, token: '***' };
+    return { ...connection, token: '***', registryToken: connection.registryToken ? '***' : undefined };
   }
 
   async updateConnection(
     id: string,
-    updates: { name?: string; baseUrl?: string; token?: string; groupFilter?: string },
+    updates: { name?: string; baseUrl?: string; token?: string; groupFilter?: string; registryUrl?: string; registryUsername?: string; registryToken?: string },
   ): Promise<interfaces.data.IProviderConnection> {
     const conn = this.connections.find((c) => c.id === id);
     if (!conn) throw new Error(`Connection not found: ${id}`);
@@ -182,8 +234,11 @@ export class ConnectionManager {
       conn.groupFilter = updates.groupFilter || undefined;
       conn.groupFilterId = undefined; // Will be re-resolved on next test
     }
+    if (updates.registryUrl !== undefined) conn.registryUrl = updates.registryUrl || undefined;
+    if (updates.registryUsername !== undefined) conn.registryUsername = updates.registryUsername || undefined;
+    if (updates.registryToken !== undefined) conn.registryToken = updates.registryToken || undefined;
     await this.persistConnection(conn);
-    return { ...conn, token: '***' };
+    return { ...conn, token: '***', registryToken: conn.registryToken ? '***' : undefined };
   }
 
   async deleteConnection(id: string): Promise<void> {
@@ -200,7 +255,7 @@ export class ConnectionManager {
     conn.status = paused ? 'paused' : 'disconnected';
     await this.persistConnection(conn);
     logger.info(`Connection ${paused ? 'paused' : 'resumed'}: ${conn.name}`);
-    return { ...conn, token: '***' };
+    return { ...conn, token: '***', registryToken: conn.registryToken ? '***' : undefined };
   }
 
   async testConnection(id: string): Promise<{ ok: boolean; error?: string }> {