[GH-ISSUE #270] Auth: Validate credentials at login time #87

New issue

Closed

opened 2026-02-26 21:33:16 +03:00 by kerem · 1 comment

kerem commented

2026-02-26 21:33:16 +03:00

Owner

Originally created by @rudrankriyam on GitHub (Jan 28, 2026).
Original GitHub issue: https://github.com/rudrankriyam/App-Store-Connect-CLI/issues/270

Problem

The auth login command currently validates only the PEM format and file permissions of the private key. It does not verify that the credentials actually work with the App Store Connect API. Users only discover invalid credentials when they attempt their first API call, which leads to a poor developer experience.

Common failure modes that go undetected at login:

Mismatched Key ID and private key file
Expired or revoked API keys
Wrong Issuer ID for the key
Malformed private key content that passes basic PEM parsing but fails JWT signing

Affected Code

cmd/auth.go - The login command and credential storage logic
internal/auth/keychain.go:98-108 - Private key loading and validation
internal/asc/client_http.go:44-63 - JWT generation (this logic should be testable standalone)

Proposed Solution

After storing credentials, attempt to generate a JWT token to verify the private key can be used for signing
Optionally, make a lightweight API call (such as listing apps with a limit of 1) to verify the credentials work end-to-end
Provide clear error messages if validation fails, explaining which part failed (key loading, JWT signing, or API authentication)

Implementation approach:

func validateCredentials(keyID, issuerID, keyPath string) error {
    // Step 1: Load the private key
    privateKey, err := auth.LoadPrivateKey(keyPath)
    if err != nil {
        return fmt.Errorf("failed to load private key: %w", err)
    }

    // Step 2: Attempt JWT generation
    token, err := generateTestJWT(keyID, issuerID, privateKey)
    if err != nil {
        return fmt.Errorf("failed to generate JWT: %w", err)
    }

    // Step 3 (optional): Make a test API call
    // This confirms the key is registered with Apple
    return nil
}

Add a --skip-validation flag for users who want to store credentials without network access

Acceptance Criteria

auth login validates that JWT generation succeeds before storing credentials
Clear error messages indicate whether the issue is with the key file, key format, or credential mismatch
Add --skip-validation flag to bypass validation when needed
Add tests for the validation logic

Originally created by @rudrankriyam on GitHub (Jan 28, 2026). Original GitHub issue: https://github.com/rudrankriyam/App-Store-Connect-CLI/issues/270 ## Problem The `auth login` command currently validates only the PEM format and file permissions of the private key. It does not verify that the credentials actually work with the App Store Connect API. Users only discover invalid credentials when they attempt their first API call, which leads to a poor developer experience. Common failure modes that go undetected at login: 1. Mismatched Key ID and private key file 2. Expired or revoked API keys 3. Wrong Issuer ID for the key 4. Malformed private key content that passes basic PEM parsing but fails JWT signing ## Affected Code - `cmd/auth.go` - The login command and credential storage logic - `internal/auth/keychain.go:98-108` - Private key loading and validation - `internal/asc/client_http.go:44-63` - JWT generation (this logic should be testable standalone) ## Proposed Solution 1. After storing credentials, attempt to generate a JWT token to verify the private key can be used for signing 2. Optionally, make a lightweight API call (such as listing apps with a limit of 1) to verify the credentials work end-to-end 3. Provide clear error messages if validation fails, explaining which part failed (key loading, JWT signing, or API authentication) Implementation approach: ```go func validateCredentials(keyID, issuerID, keyPath string) error { // Step 1: Load the private key privateKey, err := auth.LoadPrivateKey(keyPath) if err != nil { return fmt.Errorf("failed to load private key: %w", err) } // Step 2: Attempt JWT generation token, err := generateTestJWT(keyID, issuerID, privateKey) if err != nil { return fmt.Errorf("failed to generate JWT: %w", err) } // Step 3 (optional): Make a test API call // This confirms the key is registered with Apple return nil } ``` 4. Add a `--skip-validation` flag for users who want to store credentials without network access ## Acceptance Criteria - `auth login` validates that JWT generation succeeds before storing credentials - Clear error messages indicate whether the issue is with the key file, key format, or credential mismatch - Add `--skip-validation` flag to bypass validation when needed - Add tests for the validation logic