feat(cli): add `forge creds` — unified credential management #17

Merged

gmackie merged 1 commit from feat/cli-creds into main

2026-06-25 17:34:46 +00:00

gmackie commented

2026-06-25 17:18:08 +00:00

Owner

Adds a single forge creds umbrella over every credential plane ForgeGraph touches:

Plane	Provider	Backed by
integration	cloudflare, hetzner, forgejo	`/api/fg/integrations` (encrypted)
auth	forgegraph	`~/.forgegraph/credentials.json`
ssh	ssh	`/api/fg/ssh-keys`
postgres	postgres	per app/stage secret + node rotate

Subcommands

creds status — aggregate audit view across all planes (where stored, valid/active, last verified)
creds set <provider> — store/update a credential (integration token, CLI token, or SSH key)
creds rotate <provider> — rotate an integration token or a Postgres password
creds rm <provider> — remove/revoke a credential

Integration providers already had full server-side CRUD on /api/fg/integrations (GET / POST-upsert / DELETE) but no CLI write path — you had to use the web UI. This exposes set/rotate/rm and unifies it with the existing auth, ssh-key, and db rotate-password flows. Provider registry + parsing helpers are unit-tested (creds_test.go); full cmd/fg/commands suite passes.

Smoke-tested live: creds status correctly aggregates cloudflare+hetzner (active), forgejo (not set), 3 SSH keys, auth, and postgres.

🤖 Generated with Claude Code

Adds a single `forge creds` umbrella over every credential plane ForgeGraph touches: | Plane | Provider | Backed by | |---|---|---| | integration | cloudflare, hetzner, forgejo | `/api/fg/integrations` (encrypted) | | auth | forgegraph | `~/.forgegraph/credentials.json` | | ssh | ssh | `/api/fg/ssh-keys` | | postgres | postgres | per app/stage secret + node rotate | **Subcommands** - `creds status` — aggregate audit view across all planes (where stored, valid/active, last verified) - `creds set <provider>` — store/update a credential (integration token, CLI token, or SSH key) - `creds rotate <provider>` — rotate an integration token or a Postgres password - `creds rm <provider>` — remove/revoke a credential Integration providers already had full server-side CRUD on `/api/fg/integrations` (GET / POST-upsert / DELETE) but **no CLI write path** — you had to use the web UI. This exposes set/rotate/rm and unifies it with the existing `auth`, `ssh-key`, and `db rotate-password` flows. Provider registry + parsing helpers are unit-tested (`creds_test.go`); full `cmd/fg/commands` suite passes. Smoke-tested live: `creds status` correctly aggregates cloudflare+hetzner (active), forgejo (not set), 3 SSH keys, auth, and postgres. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

gmackie added 1 commit

2026-06-25 17:18:09 +00:00

feat(cli): add forge creds — unified credential management

AI Code Review / review (pull_request) Failing after 9s

Details

CI / ci (pull_request) Successful in 16m10s

Details

612b2aa1ad

A single umbrella over every credential plane ForgeGraph touches:
Cloudflare, Hetzner, and Forgejo (workspace integrations), the ForgeGraph
CLI auth token, SSH keys for node access, and Postgres passwords.

Subcommands:
  creds status   aggregate audit view across all planes (where stored, valid?)
  creds set      store/update a credential (integrations, CLI token, SSH key)
  creds rotate   rotate integration tokens or a Postgres password
  creds rm       remove/revoke a credential

Integration providers already had full server-side CRUD
(/api/fg/integrations); this exposes the missing set/rotate/rm write path
in the CLI and unifies it with the existing auth, ssh-key, and db flows.
Provider registry + helpers are unit-tested.

gmackie merged commit 59a6bcac31 into main

2026-06-25 17:34:46 +00:00

gmackie referenced this pull request from a commit

2026-06-25 17:34:46 +00:00

feat(cli): add `forge creds` — unified credential management (#17)

gmackie referenced this pull request from a commit

2026-07-06 21:10:19 +00:00

feat(oauth): trust NetControl as an OIDC client (#17)