Allow gh auth git-credential get to get a token for non-active user

[emiksk]

Describe the feature or problem you’d like to solve

Currently gh auth git-credential get can get a token for only active account in specified host.

e.g.

$ gh auth status
github.com
  ✓ Logged in to github.com account emiksk (keyring)
  - Active account: true
  - Git operations protocol: https
  - Token: gho_************************************
  - Token scopes: 'gist', 'read:org', 'repo', 'workflow'

  ✓ Logged in to github.com account non-emiksk (keyring)
  - Active account: false
  - Git operations protocol: https
  - Token: gho_************************************
  - Token scopes: 'gist', 'read:org', 'repo', 'workflow'

$ gh auth git-credential get
protocol=https
host=github.com

protocol=https
host=github.com
username=emiksk
password=gho_************************************

$ gh auth git-credential get
protocol=https
host=github.com
username=non-emiksk


$

I think that gh auth git-credential get should be able to get a token regardless of whether user is active or not if the specific username is given.

Proposed solution

This enhancement will allow developers to control credentials by remote url (such as https://emiksk@github.com/org/repo and https://non-emiksk@github.com/org/repo) instead of using gh auth switch.

Additional context

This behavior is caused by using ActiveToken() method in helper.go even if a username is given.
It would be better to use the TokenForUser() method when username is given, as in token.go.

However, TokenForUser() method ignores environment variables such as GITHUB_TOKEN unlike ActiveToken() method.

cli/internal/config/config.go

Lines 448 to 458 in 140edf7

	func (c *AuthConfig) TokenForUser(hostname, user string) (string, string, error) {
	if token, err := keyring.Get(keyringServiceName(hostname), user); err == nil {
	return token, "keyring", nil
	}
	if token, err := c.cfg.Get([]string{hostsKey, hostname, usersKey, user, oauthTokenKey}); err == nil {
	return token, "oauth_token", nil
	}
	return "", "default", fmt.Errorf("no token found for '%s'", user)
	}

cli/internal/config/config.go

Line 203 in 140edf7

token, source := ghAuth.TokenFromEnvOrConfig(hostname)

Therefore, if the logic of token.go and helper.go are simply made common, a behavior is changed when an environment variable exists and username is explicitly given.
Since this behavior also exists in the test case, it needs to consider whether the behavior should be changed or whether different logic should be implemented instead of sharing the same logic.

[williammartin]

Ahhh yes thank you for this excellent write up and investigation! This is something that we discussed and decided to leave out of the original multi-account MVP to keep the scope small. I'm glad you opened this because a similar thing was mentioned over here: #8875 (comment)

Can you talk a little bit more about how you would like to use this with regards remote URLs? Do you clone and configure your repositories outside of gh using git directly? Would it be interesting if we found a way in gh to make this kind of thing configurable as well? For example, perhaps we could offer configuration of remotes with a username during repo clone, repo fork etc. I'm not sure exactly what this would look like, but I think it's worth thinking holistically about the issue.

[emiksk]

@williammartin
Thank you for your reply!

For example, perhaps we could offer configuration of remotes with a username during repo clone, repo fork etc.

It’s the interesting feature. I didn’t have thought of it, yet I might use it if it’s offered.

Imagining myself using remote URLs to switch credentials, I would probably use a combination of includeIf and insteadOf in gitconfig to automatically switch remote URLs according to working directories.

For example, adding the following includeIf to gitconfig:

[includeIf "/path/to/repositories_for_emiksk]
  path = /path/to/gitconfig_for_emiksk

Then, adding the following insteadOf to /path/to/gitconfig_for_emiksk, remote URLs will automatically be changed to https://emiksk@github.com from https://github.com when I work in the git directory.

[url "https://emiksk@github.com"]
  insteadOf = https://github.com

I believe this is a nice way to automatically switch credentials for accounts for each directory.
Of course, there may be times when I want to switch between multiple credentials in one git directory.

It's the poor English writing, but I hope you get the message.