add rattler_auth to authenticate requests

[wolfv]

No description provided.

[wolfv]

@baszalmstra unfortunately I had to make two functions, one for reqwest::blocking::Client and one for reqwest::Client. Maybe you have an idea on how to improve this?

Apart from that it works like a charm :)

[baszalmstra]

Nice work!

Some comments:

• authentication is currently a singleton and it cant be turned on or off. I dont like how intransparent, uncontrollable and potentially thread unsafe it is. It would be nice if you pass in an object for authentication. There you could also specify the key for the keychain for instance. Authentication::from_keychain would be nice to have!

• Please dont use unwrap in library code unless you are sure the code cannot fail. And even then, please add a comment and/or use expect.

[baszalmstra]

This looks pretty close to done to me! A note:

• Since you can only really use an AuthenticatedClient and there is no UnauthenticatedClient maybe we can just call it Client?
• I think by Default the "client" should be unauthenticated unless you initialize it with credentials. See my other comment.
• It would be very nice if there is also a From<reqwest::Client> implementation. That way the library remains super simple to use with just reqwest.
• Random thought: If there is direct conversion from reqwest::Client to rattler_networking::Client we can use impl Into<rattler_networking::Client> as an argument where authentication is required. That way people can keep using the reqwest::Client too.

[wolfv]

The idea of having a default key is that multiple tools could share the same namespace for credentials (eg rattler-build and px are both logged in to the same sites).

[baszalmstra]

I think thats dangerous behavior because if you set certain (invalid) credentials it affects all programs that use the default behavior. Its worst kind of a global variable you can have..

To me its also not logical that if you would do ‘px login’ it also works with ‘rattler-build publish’ (or whatever). Id much rather have a seperate ‘rattler-build login’.

Ever more so as this is a library, I think we should allow users to opt-in by specifying the same key. It should not be the default behavior.

[wolfv]

Hmm but for each channel you want to use with rattler build (not for publishing, just for pulling packages from) you'd need to re-login. A lot of programs use global configurations for credentials (eg netrc files) or global proxy configurations (HTTP_PROXY environment variable etc).

One can also easily opt out of the global sharing by using a different key.

I think it would be pretty nice if px and rattler build share the credentials (which we can achieve either way).

[wolfv]

just for the record, I am working on a keyring-rs compatible fallback storage that saves the authentication to a file in the ~/.rattler_auth.json location (trying to make that configurable as well).

It's a bit challenging because of multi-threading and file locking but hopefully can get it done soon.