[GH-ISSUE #271] Auth: Show explicit storage location in auth status output #86

New issue

Closed

opened 2026-02-26 21:33:16 +03:00 by kerem · 1 comment

kerem commented

2026-02-26 21:33:16 +03:00

Owner

Originally created by @rudrankriyam on GitHub (Jan 28, 2026).
Original GitHub issue: https://github.com/rudrankriyam/App-Store-Connect-CLI/issues/271

Problem

When the system keychain is unavailable, the CLI silently falls back to storing credentials in the config file at ~/.asc/config.json. Users may believe their credentials are secured in the system keychain when they are actually stored in a plain JSON file. The auth status command does not clearly indicate which storage backend is being used.

This silent fallback behavior is defined in internal/auth/keychain.go:250-288:

credentials, err := listFromKeychain()
if err == nil {
    return credentials, nil
}
if !isKeyringUnavailable(err) {
    return nil, err
}
return listFromConfig()  // Silent fallback

Affected Code

internal/auth/keychain.go:250-288 - The ListCredentials function with silent fallback
cmd/auth.go:320-356 - The auth status command output formatting

Proposed Solution

Modify auth status to explicitly show the storage backend being used
Add a warning when falling back from keychain to config file
Show the storage location in both login confirmation and status output

Example improved auth status output:

Credential Storage: System Keychain (secure)
  Location: login keychain

Active Profile: default
  Key ID: ABC123DEF
  Issuer ID: 12345678-1234-1234-1234-123456789012
  Private Key: /path/to/key.p8

Or when using config file fallback:

Credential Storage: Config File (less secure)
  Location: /Users/username/.asc/config.json
  Warning: System keychain unavailable. Credentials stored in plain text.

Active Profile: default
  ...

During auth login, inform users where credentials will be stored before saving

Acceptance Criteria

auth status shows the storage backend type (keychain or config file)
auth status shows the storage location path
Warning is displayed when using config file fallback
auth login confirms storage location before saving
Add a --verbose flag to show additional storage details
Add tests for storage location output

Originally created by @rudrankriyam on GitHub (Jan 28, 2026). Original GitHub issue: https://github.com/rudrankriyam/App-Store-Connect-CLI/issues/271 ## Problem When the system keychain is unavailable, the CLI silently falls back to storing credentials in the config file at `~/.asc/config.json`. Users may believe their credentials are secured in the system keychain when they are actually stored in a plain JSON file. The `auth status` command does not clearly indicate which storage backend is being used. This silent fallback behavior is defined in `internal/auth/keychain.go:250-288`: ```go credentials, err := listFromKeychain() if err == nil { return credentials, nil } if !isKeyringUnavailable(err) { return nil, err } return listFromConfig() // Silent fallback ``` ## Affected Code - `internal/auth/keychain.go:250-288` - The `ListCredentials` function with silent fallback - `cmd/auth.go:320-356` - The `auth status` command output formatting ## Proposed Solution 1. Modify `auth status` to explicitly show the storage backend being used 2. Add a warning when falling back from keychain to config file 3. Show the storage location in both login confirmation and status output Example improved `auth status` output: ``` Credential Storage: System Keychain (secure) Location: login keychain Active Profile: default Key ID: ABC123DEF Issuer ID: 12345678-1234-1234-1234-123456789012 Private Key: /path/to/key.p8 ``` Or when using config file fallback: ``` Credential Storage: Config File (less secure) Location: /Users/username/.asc/config.json Warning: System keychain unavailable. Credentials stored in plain text. Active Profile: default ... ``` 4. During `auth login`, inform users where credentials will be stored before saving ## Acceptance Criteria - `auth status` shows the storage backend type (keychain or config file) - `auth status` shows the storage location path - Warning is displayed when using config file fallback - `auth login` confirms storage location before saving - Add a `--verbose` flag to show additional storage details - Add tests for storage location output