CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

credential broker: Play tokens from POST /api/google/token (cached, single flight, local key fallback), grants and APIs per package in validate, Play write preflight, apps check and the desktop Accounts view; Google 403 names the API or grant, no retry

Browse source
This commit is contained in:
CRTkafa 2026-10-25 22:50:52 +07:00
parent 304407e523
commit 2c5e30090f
27 changed files with 1145 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

13
cli/index.ts
View file

@ -105,6 +105,7 @@ async function main(): Promise<void> {
const loaded = await loadConfig(args.get('config'));
const { acquireLock, lockKeys } = await import('./lib/lock');
for (const k of lockKeys(key, args, loaded.config)) acquireLock(loaded.root, k, argv.filter(x => x !== '--force-unlock').join(' '), { force: args.has('force-unlock') });
await playPreflight(key, loaded, args);
await (await COMMANDS[key]![0]()).run({ loaded, args });
};
await (args.has('json') ? withJsonOutput(go) : go());
@ -119,8 +120,20 @@ async function main(): Promise<void> {
// one writer per app and store (cli/lib/lock.ts): dry runs and reads take no lock
const { acquireLock, lockKeys } = await import('./lib/lock');
for (const k of lockKeys(key, args, loaded.config)) acquireLock(loaded.root, k, argv.filter(x => x !== '--force-unlock').join(' '), { force: args.has('force-unlock') });
await playPreflight(key, loaded, args);
await (await COMMANDS[key]![0]()).run({ loaded, args });
});
}
/** Play commands with a credential broker: the package's grants and APIs are read first, and a missing permission or a
* disabled API stops the command before any Play call (a dry run or a read only warns). cli/lib/broker.ts. */
async function playPreflight(key: string, loaded: { root: string; config: { play?: { packageName: string } } }, args: ReturnType<typeof parseArgs>): Promise<void> {
if (!key.startsWith('play ')) return;
const b = await import('./lib/broker');
if (!b.COMMAND_NEEDS[key]) return;
const { warn } = await import('./lib/log');
const read = args.has('dry') || ['status', 'pull'].includes(String(args._[0] ?? ''));
await b.playPreflight(key, loaded.root, loaded.config.play?.packageName, { dry: read, warn: m => warn('preflight', m) });
}
main().catch(e => { console.error(`\nerror: ${(e as Error).message}`); process.exit(1); });