feat(git): remember HTTPS credentials in the app secret store (#321)

Git no longer asks for the HTTPS user name and password on every fetch, pull and push. The password prompt offers "Remember for this host"; the credential is saved in the app's secret store (next to the saved SSH passwords, never in git's global configuration) only after the git command that used it succeeds, and a stored credential the server rejects is forgotten so the next command asks again. Settings › Version Control › Git lists saved credentials and forgets them.

Each git child gets its own id, passed to the askpass helper, so concurrent commands never save or forget each other's credentials. ide-vcs reports command completion through an observer installed at start-up instead of depending on ide-ssh. Credentials are keyed by scheme, host and port, and only git's authentication errors (Authentication failed, HTTP 401/403 responses, invalid username or password) forget a stored credential.

Fixes #272

Co-authored-by: a-rookie-of-C-language <[email protected]>

src/features/ssh/AskpassDialog.tsx

@@ -1,7 +1,7 @@
 /** The oldest pending askpass prompt as a modal: password / text field, or Yes / No for a host key. */
 import { useState } from "react";
 import { useTx } from "@/platform/i18n";
-import { Dialog, Input } from "@/ui";
+import { Checkbox, Dialog, Input } from "@/ui";
 import { answerAskpass, askpassAnswer, useAskpass, type AskpassPrompt } from "./askpass";
 import styles from "./Ssh.module.css";
 
@@ -13,7 +13,9 @@ export function AskpassHost() {
 function AskpassDialog({ prompt: p }: { prompt: AskpassPrompt }) {
   const tx = useTx();
   const [text, setText] = useState("");
-  const done = (choice: Parameters<typeof askpassAnswer>[1]) => answerAskpass(p.id, askpassAnswer(p.kind, choice));
+  const [remember, setRemember] = useState(true);
+  const done = (choice: Parameters<typeof askpassAnswer>[1]) =>
+    answerAskpass(p, askpassAnswer(p.kind, choice), remember);
   const cancel = () => done(null);
 
   if (p.kind === "confirm")
@@ -62,6 +64,7 @@ function AskpassDialog({ prompt: p }: { prompt: AskpassPrompt }) {
           value={text}
           onChange={(e) => setText(e.target.value)}
         />
+        {p.remember && <Checkbox checked={remember} onChange={setRemember} label={tx("Remember for this host")} />}
       </form>
     </Dialog>
   );

src/features/ssh/askpass.ts

@@ -9,6 +9,8 @@ export interface AskpassPrompt {
   id: number;
   prompt: string;
   kind: AskpassKind;
+  /** The dialog offers "Remember" (git HTTPS passwords). */
+  remember: boolean;
 }
 
 export const useAskpass = create<{ queue: AskpassPrompt[] }>(() => ({ queue: [] }));
@@ -32,7 +34,14 @@ export function askpassAnswer(
   return kind === "confirm" ? null : choice.text;
 }
 
-export function answerAskpass(id: number, answer: string | null, send = commands.sshAskpassAnswer) {
-  dropAskpass(id);
-  void send(id, answer).catch(() => {});
+export function answerAskpass(
+  p: AskpassPrompt,
+  answer: string | null,
+  remember: boolean,
+  send = commands.sshAskpassAnswer,
+) {
+  dropAskpass(p.id);
+  // The backend ties `remember` to this prompt; the git command saves it only
+  // on success and drops it again when authentication fails.
+  void send(p.id, answer, remember).catch(() => {});
 }

src/features/ssh/index.ts

@@ -13,7 +13,7 @@ import { chooseSshSession, SSH_SETTINGS_PAGE, startSshSession } from "./session"
 export function activate(): () => void {
   const disposers = [
     registerOverlay({ id: "ssh.askpass", component: AskpassHost }),
-    onIdeEvent("askpass", (e) => enqueueAskpass({ id: e.id, prompt: e.prompt, kind: e.kind })),
+    onIdeEvent("askpass", (e) => enqueueAskpass({ id: e.id, prompt: e.prompt, kind: e.kind, remember: e.remember })),
     onIdeEvent("askpassDone", (e) => dropAskpass(e.id)),
     registerActions([
       {

src/features/ssh/ssh.test.ts

@@ -7,26 +7,26 @@ describe("askpass queue", () => {
   beforeEach(() => useAskpass.setState({ queue: [] }));
 
   it("queues prompts in arrival order, once each", () => {
-    enqueueAskpass({ id: 1, prompt: "Password:", kind: "secret" });
-    enqueueAskpass({ id: 2, prompt: "Continue connecting (yes/no)?", kind: "confirm" });
-    enqueueAskpass({ id: 1, prompt: "Password:", kind: "secret" });
+    enqueueAskpass({ id: 1, prompt: "Password:", kind: "secret", remember: false });
+    enqueueAskpass({ id: 2, prompt: "Continue connecting (yes/no)?", kind: "confirm", remember: false });
+    enqueueAskpass({ id: 1, prompt: "Password:", kind: "secret", remember: false });
     expect(useAskpass.getState().queue.map((p) => p.id)).toEqual([1, 2]);
   });
 
   it("drops a prompt answered elsewhere", () => {
-    enqueueAskpass({ id: 1, prompt: "a", kind: "text" });
-    enqueueAskpass({ id: 2, prompt: "b", kind: "text" });
+    enqueueAskpass({ id: 1, prompt: "a", kind: "text", remember: false });
+    enqueueAskpass({ id: 2, prompt: "b", kind: "text", remember: false });
     dropAskpass(1);
     dropAskpass(9);
     expect(useAskpass.getState().queue.map((p) => p.id)).toEqual([2]);
   });
 
   it("answers the backend and shows the next prompt", () => {
-    const send = vi.fn((_id: number, _answer: string | null) => Promise.resolve());
-    enqueueAskpass({ id: 1, prompt: "a", kind: "secret" });
-    enqueueAskpass({ id: 2, prompt: "b", kind: "secret" });
-    answerAskpass(1, "hunter2", send);
-    expect(send).toHaveBeenCalledWith(1, "hunter2");
+    const send = vi.fn((_id: number, _answer: string | null, _remember: boolean) => Promise.resolve());
+    enqueueAskpass({ id: 1, prompt: "a", kind: "secret", remember: true });
+    enqueueAskpass({ id: 2, prompt: "b", kind: "secret", remember: false });
+    answerAskpass({ id: 1, prompt: "a", kind: "secret", remember: true }, "hunter2", true, send);
+    expect(send).toHaveBeenCalledWith(1, "hunter2", true);
     expect(useAskpass.getState().queue.map((p) => p.id)).toEqual([2]);
   });