feat: add TokenProvider seam for per-request GitHub tokens#1
Merged
Conversation
Replace construction-time github.WithAuthToken(cfg.Token) with a
per-request token resolution so callers can inject rotating credentials
(e.g. short-lived GitHub App installation tokens minted on demand by the
sneat-go backend) without rebuilding the adapter.
- Add TokenProvider interface { Token(ctx) (string, error) },
TokenProviderFunc adapter and StaticTokenProvider(token).
- Add Config.TokenProvider field; an explicit provider wins over
Config.Token, and a bare non-empty Config.Token is auto-wrapped in
StaticTokenProvider, so existing callers keep working unchanged.
- Inject the token via a tokenProviderTransport RoundTripper that asks
the provider on every request; provider errors abort the request and
surface as regular operation errors. Caller-supplied http.Clients are
copied, never mutated.
- Deduplicate the identical go-github client construction in
NewGitHubFileReader and NewTreeWriter into newGitHubAPIClient.
- go.sum: add missing entries for dalgo v0.62.2 and golang.org/x/sys.
Design: sneat-co/backstage docs/roadmaps/ovdb-access-tokens-grants.md
(Decision 3.4, sequencing item 3).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FV3pbooAc9UPpNdiaJuKve
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces the construction-time
github.WithAuthToken(cfg.Token)binding with a per-request token seam, so callers can inject rotating credentials — e.g. short-lived (1h) GitHub App installation tokens minted on demand by the sneat-go backend — without rebuilding the adapter.Implements sequencing item 3 of the OVDB access-tokens-and-grants design (sneat-co/backstage
docs/roadmaps/ovdb-access-tokens-grants.md, Decision 3.4).Public API
type TokenProvider interface { Token(ctx context.Context) (string, error) }type TokenProviderFunc func(ctx context.Context) (string, error)— func adapterfunc StaticTokenProvider(token string) TokenProviderConfig.TokenProvider TokenProvider— takes precedence overConfig.TokenBackward compatibility
Config.Tokenwith no provider is auto-wrapped inStaticTokenProvider— existing callers keep working unchanged (entire pre-existing test suite passes untouched).Config.Tokentoday).Implementation notes
tokenProviderTransporthttp.RoundTripperconsulted on every request; provider errors abort the request before it fires and surface as regular operation errors.http.Clients are shallow-copied, never mutated.NewGitHubFileReader/NewTreeWriteris consolidated intonewGitHubAPIClient.go.sum: adds missing entries fordalgo v0.62.2andgolang.org/x/sys(localgo buildfailed on main without them).Tests
New coverage for: static-provider wrap, provider-wins-over-token precedence, provider called per operation with rotating tokens, error propagation through reader and writer, empty-token-unauthenticated, and no-mutation of caller HTTP clients.
go build && go vet && go testgreen; package coverage 99.8%.🤖 Generated with Claude Code
https://claude.ai/code/session_01FV3pbooAc9UPpNdiaJuKve