NextIteration.SpectreConsole.Auth.Providers.SoftwareOne 2.4.0

NextIteration.SpectreConsole.Auth.Providers.SoftwareOne

SoftwareOne Marketplace credential provider for NextIteration.SpectreConsole.Auth.

Drops a ready-to-use SoftwareOneCredential, SoftwareOneToken, authentication service, Spectre.Console accounts add prompt collector, and accounts list display formatter into a CLI that already uses the core auth package.

Install

dotnet add package NextIteration.SpectreConsole.Auth.Providers.SoftwareOne

Requires the core package (NextIteration.SpectreConsole.Auth, major-capped range [2.3.0,3.0.0)) — NuGet pulls it in transitively. Core 1.x is not supported: core 2.0.0 added a CancellationToken to the interfaces these providers implement.

Quick start

using NextIteration.SpectreConsole.Auth;
using NextIteration.SpectreConsole.Auth.Providers.SoftwareOne;

services.AddCredentialStore(opts =>
{
    opts.CredentialsDirectory = Path.Combine(
        Environment.GetFolderPath(Environment.SpecialFolder.UserProfile),
        ".my-cli", "credentials");
});

services.AddHttpClient();           // IHttpClientFactory is required

services.AddSoftwareOneAuthProvider();

// ... then hook up the accounts branch in your Spectre.Console configurator
// (from the core package):
//
//   config.AddAccountsBranch();

From that point on:

my-cli accounts add        # prompts for SoftwareOne (and any other registered providers)
my-cli accounts list       # shows stored credentials with Actor, Base URL, masked token
my-cli accounts select <id>
my-cli accounts delete <id>

Resolving a token in consumer code:

public sealed class MarketplaceClient(SoftwareOneAuthenticationService auth, IHttpClientFactory http)
{
    public async Task<string> GetOrdersAsync()
    {
        var token = await auth.AuthenticateAsync();
        using var client = http.CreateClient();
        client.BaseAddress = token.BaseUrl;
        client.DefaultRequestHeaders.Authorization =
            new AuthenticationHeaderValue(SoftwareOneToken.TokenType, token.ApiToken);
        // ... token.Actor / token.Environment let you branch on which flow to use
        return await client.GetStringAsync($"/v1/{token.Actor.ToLowerInvariant()}/orders");
    }
}

What gets stored

Each accounts add run validates the supplied token against the Marketplace API and, on exactly one match, serialises a SoftwareOneCredential into the encrypted keystore:

The token never leaves the credential store unencrypted. accounts list renders the account as name (type), the masked token fingerprint (first four + last four characters) followed by its friendly token name, plus actor and base URL.

Authentication model

SoftwareOne tokens are long-lived and issued out-of-band via the Marketplace portal — there's no exchange or refresh flow. SoftwareOneAuthenticationService.AuthenticateAsync() is therefore a pass-through: it deserialises the selected credential and projects it into a SoftwareOneToken. IsExpired is hard-coded to false, but tokens can be revoked in the portal — a revoked token surfaces as a 401 on the first API call. Consumers should treat 401 as "prompt for a fresh credential" rather than relying on IsExpired.

Add-time validation

Before storing, the collector performs a live GET {BaseUrl}/v1/accounts/api-tokens?eq(token,'…')&limit=2 authenticated with the user-supplied token. Three outcomes:

• Exactly one match → the five Token* / Account* metadata fields are populated from the response and the credential is stored.
• Zero matches or multiple matches → the command fails; the credential is not stored.
• HTTP error (network, non-2xx) → the command fails; the credential is not stored.

This front-loads the "is this token real?" check — no half-valid credentials sitting in the keystore waiting to 401 later. The validation uses a named HttpClient (SoftwareOneCredentialCollector.HttpClientName) so consumers can pre-configure it:

services.AddHttpClient(SoftwareOneCredentialCollector.HttpClientName, c =>
{
    c.Timeout = TimeSpan.FromSeconds(10);
});

AddSoftwareOneAuthProvider() registers that named client itself, with IHttpClientFactory's default logging suppressed (RemoveAllLoggers()). That matters because the lookup passes the token in the query string, and Microsoft.Extensions.Http 8.x logs the full request URI at Information level — so without the suppression any consumer with an information-level logger would write the plaintext, long-lived token to its log on every accounts add. (10.x redacts the query, so this is reachable specifically for consumers on the net8.0 floor.) Pre-configuring the client as above adds to the same registration and keeps the suppression; it does not affect logging for any other HttpClient in your application.

Supported platforms

Whatever the core package supports (currently Windows, macOS, Linux on .NET 8 and .NET 10).

References

• SoftwareOne Marketplace REST API — https://docs.platform.softwareone.com/developer-resources/rest-api Endpoints, request/response shapes, authentication model, and how to generate API tokens from the Marketplace portal.

License

MIT © Stuart Meeks