CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

credential broker: Play tokens from POST /api/google/token (cached, single flight, local key fallback), grants and APIs per package in validate, Play write preflight, apps check and the desktop Accounts view; Google 403 names the API or grant, no retry

Browse source
This commit is contained in:
CRTkafa 2026-10-25 22:50:52 +07:00
parent 304407e523
commit 2c5e30090f
27 changed files with 1145 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

17
skills/store-pitfalls/SKILL.md
View file

@ -1498,3 +1498,20 @@ that fails without the fix (see CONTRIBUTING.md).
`cli/apple/signing.ts`, `tests/signing-targets.test.ts` (fixture pbxproj with an app, a share extension and app group
entitlements, a decoded profile plist, a fake App Store Connect), `cli/lib/console-apple-group-plan.ts` (the plan),
`verifyAppGroupsApi` in `cli/lib/console-verify.ts`, `appGroupVerdicts` in `cli/lib/targets.ts` (gap / unproven / ok).
## 122. Google keys moved to a credential broker: tokens, fallback and missing grants
- **Symptom:** after the Google service-account keys moved to the owner's credential broker, Play commands either
still wanted `PLAY_SERVICE_ACCOUNT`, or an upload ran its edit, uploaded and only then died on a bare 403 for a
permission the broker could have named; an error dump could carry the bearer token.
- **Do:** configure `~/.storebound/broker.json` (`url`, `apiKeyFile`, key file mode 600) and, when the account is not
the local key's, `PLAY_SERVICE_ACCOUNT_EMAIL` in the profile. `storebound doctor` says which source Play uses.
Before Play writes, the preflight reads `GET /api/google/play/<package>/storebound` and stops on a missing
permission or API with the exact name and link; grant it on the broker (`google_play_grant`) or enable the API
(`google_api_enable`), never by retrying. A 404 there means "register the package on the broker", not "no access".
A broker that refuses the API key (401 / 403) needs `google:read google:token` on the key; storebound neither retries
nor falls back then. The broker has no scope for the Reporting API or Play Games writes: those keep the local key.
- **Never:** write an access token to disk or into a log, put the broker key into a config or docs, or loop on a 403.
- **Guard:** `cli/lib/broker.ts` (config, key file mode, token cache and single flight, grants, preflight, redaction),
`cli/lib/google-auth.ts` `playToken` (broker first, local key fallback), `cli/lib/google-access.ts` (403 ->
GoogleAccessError, no retry), `tests/credential-broker.test.ts` (a local fake broker).