From 8e6d29f1806cc569b48d913564c7d80a1c2f2355 Mon Sep 17 00:00:00 2001 From: Christian Cleberg Date: Fri, 17 Jul 2026 17:04:15 -0500 Subject: Replace env-var PAT with GitHub device authorization flow + Keychain MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes #6, #7 (milestone 0.4.0). - GitHubDeviceAuthClient implements the OAuth 2.0 device authorization grant (device code request + poll for token) against GitHub's OAuth App endpoints. Verified against the real endpoints directly. - KeychainTokenStore stores the resulting token in the app's own Keychain item (not synced to iCloud Keychain), no shared entitlement needed since nothing else reads it. - AuthStore drives the sign-in state machine (signedOut / awaitingAuthorization / signedIn) and a new SignInView replaces the old "missing token" error state with an actual sign-in UI. - SecurityEventStore now reads the token from Keychain instead of the GITHUB_TOKEN environment variable, which is fully retired. - Scope requested is security_events, the narrowest available for classic OAuth Apps (no read-only variant exists at this level, unlike fine-grained PATs). Private-repo Dependabot alerts may need broader repo scope — to be confirmed with real-world testing. --- octosentry/SecurityEventStore.swift | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'octosentry/SecurityEventStore.swift') diff --git a/octosentry/SecurityEventStore.swift b/octosentry/SecurityEventStore.swift index 11f813c..65a7280 100644 --- a/octosentry/SecurityEventStore.swift +++ b/octosentry/SecurityEventStore.swift @@ -3,8 +3,8 @@ // octosentry // // Holds the fetched event stream for the popover. Watch list, seen-state, -// and last-fetch timestamps are persisted (see PersistedState); the PAT -// is still read from GITHUB_TOKEN as a dev-only shortcut (spec §13). +// and last-fetch timestamps are persisted (see PersistedState); the token +// comes from Keychain, put there by the device authorization flow (spec §6). // // Each alert source is fetched independently, per repo, so a problem // with one endpoint (or one repo) doesn't blank out the rest. A 403/404 @@ -42,8 +42,8 @@ final class SecurityEventStore { minimumSeverity = state.minimumSeverity watchedRepos = state.watchedRepos - guard let token = ProcessInfo.processInfo.environment["GITHUB_TOKEN"], !token.isEmpty else { - errorMessages = [GitHubAPIError.missingToken.errorDescription ?? "Missing GITHUB_TOKEN."] + guard let token = KeychainTokenStore.load() else { + errorMessages = [GitHubAPIError.missingToken.errorDescription ?? "Not signed in."] return } -- cgit v1.2.3