Deploy token support

Author: RazerM

README.md

@@ -54,10 +54,24 @@
       <dd><code>C:\ProgramData\gitlab-pypi\gitlab-pypi.toml</code></dd>
     </dl>
 
-3.  Create a personal access token with `read_api` scope and add it to the config file:
+3.  Configure a token
+
+    ### Personal Access Token
+
+    Create with the `read_api` scope and add it to the config file:
+
+    ```toml
+    ["gitlab.com"]
+    token = "<token>"
+    ```
+
+    ### Deploy Token
+
+    Create with the `read_package_registry` scope and add it to the config file:
 
     ```toml
-    ["https://gitlab.com"]
+    ["gitlab.com"]
+    username = "<username>"
     token = "<token>"
     ```
 
@@ -96,7 +110,7 @@
 
     You need `authenticate = "always"` for uv to invoke [keyring] when no username is specified. This option is a good idea anyway!
 
-    Alternatively, add the username `__token__` to the URL, but this is not recommended for `pyproject.toml` as you likely want to use a different username in CI, for example.
+    Alternatively, add the username (which is `__token__` for personal access tokens) to the URL, but this is not recommended for `pyproject.toml` as you likely want to use a different username in CI, for example.
 
 6.  Done! `keyring-gitlab-pypi` will return your token for URLs that look like package installs.
 

src/keyrings/gitlab_pypi/__init__.py

@@ -73,7 +73,7 @@ def iter_config_paths() -> Iterator[Path]:
     yield user_config_path()
 
 
-def _load_access_token(service: str) -> str | None:
+def _load_access_credential(service: str) -> tuple[str, str] | None:
     url = _gitlab_url_from_service(service)
 
     if url is None:
@@ -82,13 +82,15 @@ def _load_access_token(service: str) -> str | None:
     # Since we don't need to merge config files, we can start with the
     # highest-precedence file and return the first token we find.
     for path in reversed(list(iter_config_paths())):
-        if token := _load_access_token_from_config_path(path, url):
-            return token
+        if credential := _load_access_credential_from_config_path(path, url):
+            return credential
 
     return None
 
 
-def _load_access_token_from_config_path(path: Path, url: URL) -> str | None:
+def _load_access_credential_from_config_path(
+    path: Path, url: URL
+) -> tuple[str, str] | None:
     try:
         with open(path / CONFIG_FILENAME, "rb") as f:
             config = tomllib.load(f)
@@ -134,8 +136,14 @@ def _load_access_token_from_config_path(path: Path, url: URL) -> str | None:
         if not token:
             continue
 
-        if isinstance(token, str):
-            return token
+        if not isinstance(token, str):
+            continue
+
+        username = host_config.get("username", "__token__")
+        if not isinstance(username, str):
+            continue
+
+        return username, token
 
     return None
 
@@ -177,11 +185,17 @@ class GitlabPypi(KeyringBackend):
         def __init__(self) -> None: ...
 
     def get_password(self, service: str, username: str) -> str | None:
-        if username == "__token__":
-            return _load_access_token(service)
-        elif username == "gitlab-ci-token":
+        if username == "gitlab-ci-token":
             return _load_ci_job_token(service)
 
+        credential = _load_access_credential(service)
+        if credential is None:
+            return None
+
+        config_username, token = credential
+        if config_username == username:
+            return token
+
         return None
 
     def set_password(self, service: str, username: str, password: str) -> None:
@@ -195,8 +209,8 @@ def get_credential(
         service: str,
         username: str | None,
     ) -> SimpleCredential | None:
-        if token := _load_access_token(service):
-            return SimpleCredential("__token__", token)
+        if credential := _load_access_credential(service):
+            return SimpleCredential(*credential)
         elif token := _load_ci_job_token(service):
             return SimpleCredential("gitlab-ci-token", token)
 

tests/conftest.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import os
+import random
 import re
 import secrets
 import string
@@ -139,6 +140,11 @@ def token() -> str:
     return "".join(secrets.choice(alphabet) for _ in range(20))
 
 
+@pytest.fixture
+def deploy_token_username() -> str:
+    return f"gitlab+deploy-token-{random.randint(0, 999):03d}"
+
+
 @pytest.fixture(
     # s: explicit scheme even if https
     # p: explicit port even if default
@@ -163,13 +169,17 @@ def section(request: FixtureRequest, gitlab_base_url: URL) -> str:
     return "".join(parts)
 
 
-@pytest.fixture
-def config_file(
+@pytest.fixture(
+    params=[None, "__token__"],
+    ids=["implicit-username", "explicit-username"],
+)
+def config_file_access_token(
     config_dir_env: ConfigDirEnv,
     monkeypatch: MonkeyPatch,
     fs: FakeFilesystem,
     token: str,
     section: str,
+    request: FixtureRequest,
 ) -> Path:
     config_dir_env.path.mkdir(parents=True)
     for key, value in config_dir_env.env.items():
@@ -186,7 +196,45 @@ def config_file(
             tomli_w.dump(doc, f)
 
     path = config_dir_env.path / "gitlab-pypi.toml"
-    doc = {section: {"token": token}}
+    host_config = {"token": token}
+    if request.param is not None:
+        host_config["username"] = request.param
+    doc = {section: host_config}
+    with open(path, "wb") as f:
+        tomli_w.dump(doc, f)
+    return path
+
+
+@pytest.fixture
+def config_file_deploy_token(
+    config_dir_env: ConfigDirEnv,
+    monkeypatch: MonkeyPatch,
+    fs: FakeFilesystem,
+    token: str,
+    section: str,
+    deploy_token_username: str,
+) -> Path:
+    config_dir_env.path.mkdir(parents=True)
+    for key, value in config_dir_env.env.items():
+        monkeypatch.setenv(key, value)
+
+    # Set bad tokens in lower precedence config files to verify that they are
+    # not used.
+    for lower_precedence_path in iter_config_paths():
+        if lower_precedence_path == config_dir_env.path:
+            break
+        lower_precedence_path.mkdir(parents=True, exist_ok=True)
+        doc = {
+            section: {
+                "username": deploy_token_username,
+                "token": f"token from {lower_precedence_path}",
+            }
+        }
+        with open(lower_precedence_path / "gitlab-pypi.toml", "wb") as f:
+            tomli_w.dump(doc, f)
+
+    path = config_dir_env.path / "gitlab-pypi.toml"
+    doc = {section: {"username": deploy_token_username, "token": token}}
     with open(path, "wb") as f:
         tomli_w.dump(doc, f)
     return path
@@ -197,6 +245,7 @@ class InvalidConfig(Enum):
     NO_TOKEN = auto()
     BLANK_TOKEN = auto()
     NON_STR_TOKEN = auto()
+    NON_STR_USERNAME = auto()
 
 
 @pytest.fixture(
@@ -205,6 +254,7 @@ class InvalidConfig(Enum):
         InvalidConfig.NO_TOKEN,
         InvalidConfig.BLANK_TOKEN,
         InvalidConfig.NON_STR_TOKEN,
+        InvalidConfig.NON_STR_USERNAME,
     ]
 )
 def invalid_config_file(
@@ -228,6 +278,8 @@ def invalid_config_file(
         doc = {section: {"token": ""}}
     elif request.param is InvalidConfig.NON_STR_TOKEN:
         doc = {section: {"token": 123}}
+    elif request.param is InvalidConfig.NON_STR_USERNAME:
+        doc = {section: {"username": 123, "token": token}}
     else:
         raise NotImplementedError(request.param)
 

tests/test_access_token.py

@@ -11,13 +11,13 @@
 
 
 def test_get_password(
-    backend: GitlabPypi, config_file: Path, service: str, token: str
+    backend: GitlabPypi, config_file_access_token: Path, service: str, token: str
 ) -> None:
     assert backend.get_password(service, "__token__") == token
 
 
 def test_get_password_wrong_username(
-    backend: GitlabPypi, config_file: Path, service: str, token: str
+    backend: GitlabPypi, config_file_access_token: Path, service: str, token: str
 ) -> None:
     assert backend.get_password(service, "__token__") == token
     assert backend.get_password(service, "alice") is None
@@ -26,7 +26,7 @@ def test_get_password_wrong_username(
 @pytest.mark.parametrize("username", [None, "", "username", "__token__"])
 def test_get_credential(
     backend: GitlabPypi,
-    config_file: Path,
+    config_file_access_token: Path,
     service: str,
     token: str,
     username: str | None,
@@ -38,7 +38,7 @@ def test_get_credential(
 
 
 def test_get_password_unknown_url(
-    backend: GitlabPypi, config_file: Path, badservice: str
+    backend: GitlabPypi, config_file_access_token: Path, badservice: str
 ) -> None:
     assert backend.get_password(badservice, "__token__") is None
 
@@ -50,7 +50,7 @@ def test_get_password_no_config(
 
 
 def test_get_password_wrong_url(
-    backend: GitlabPypi, config_file: Path, service: str
+    backend: GitlabPypi, config_file_access_token: Path, service: str
 ) -> None:
     service = service.replace("/pypi/", "/banana/")
     assert backend.get_password(service, "__token__") is None
@@ -74,7 +74,7 @@ def test_get_password_invalid_url_scheme(
 
 
 def test_get_credential_unknown_url(
-    backend: GitlabPypi, config_file: Path, badservice: str
+    backend: GitlabPypi, config_file_access_token: Path, badservice: str
 ) -> None:
     assert backend.get_credential(badservice, None) is None
 
@@ -86,7 +86,7 @@ def test_get_credential_no_config(
 
 
 def test_get_credential_wrong_url(
-    backend: GitlabPypi, config_file: Path, service: str
+    backend: GitlabPypi, config_file_access_token: Path, service: str
 ) -> None:
     service = service.replace("/pypi/", "/banana/")
     assert backend.get_credential(service, None) is None

tests/test_deploy_token.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+from keyring.credentials import SimpleCredential
+
+from keyrings.gitlab_pypi import GitlabPypi
+
+
+def test_get_password(
+    backend: GitlabPypi,
+    config_file_deploy_token: Path,
+    service: str,
+    token: str,
+    deploy_token_username: str,
+) -> None:
+    assert backend.get_password(service, "__token__") is None
+    assert backend.get_password(service, deploy_token_username) == token
+
+
+def test_get_credential(
+    backend: GitlabPypi,
+    config_file_deploy_token: Path,
+    service: str,
+    token: str,
+    deploy_token_username: str,
+) -> None:
+    credential = backend.get_credential(service, None)
+    assert isinstance(credential, SimpleCredential)
+    assert credential.username == deploy_token_username
+    assert credential.password == token