feat: adds credential manager functionality to the CLI

.github/workflows/ci.yml

@@ -7,6 +7,7 @@ on:
     branches:
       - main
       - v11.0.0
+      - feat/credential-mgr-integration
       # Add any long-lived feature branches here
   pull_request:
   workflow_dispatch:

cspell-dictionary.txt

@@ -29,6 +29,7 @@ autoloaded
 autoscale
 autovacuum
 awscli
+badheaders
 barsize
 baseport
 bindkey

package.json

@@ -6,11 +6,11 @@
   "bin": "./bin/run.js",
   "bugs": "https://github.com/heroku/cli/issues",
   "dependencies": {
-    "@heroku-cli/command": "^12.3.3",
+    "@heroku-cli/command": "12.4.0",
     "@heroku-cli/notifications": "^1.2.6",
     "@heroku-cli/schema": "^1.0.25",
     "@heroku/buildpack-registry": "^1.0.1",
-    "@heroku/heroku-cli-util": "^10.8.0",
+    "@heroku/heroku-cli-util": "10.8.1",
     "@heroku/http-call": "^5.5.1",
     "@heroku/mcp-server": "^1.2.0",
     "@heroku/socksv5": "^0.0.9",

src/commands/accounts/add.ts

@@ -7,32 +7,29 @@ import AccountsModule from '../../lib/accounts/accounts.js'
 
 export default class Add extends Command {
   static args = {
-    name: Args.string({description: 'name of Heroku account to add', required: true}),
+    name: Args.string({description: 'alias for Heroku account to add', required: true}),
   }
-  static description = 'add a Heroku account to your cache'
+  static description = 'add the current Heroku account to your accounts cache'
   static example = `${color.command('heroku accounts:add my-account')}`
 
   async run() {
     const {args} = await this.parse(Add)
     const {name} = args
-    const logInMessage = 'You must be logged in to run this command.'
+    const accounts = await AccountsModule.list()
 
-    if (AccountsModule.list().some(a => a.name === name)) {
+    if (accounts.some(account => account.name === name)) {
       ux.error(`${name} already exists`)
     }
 
     const {body: account} = await this.heroku.get<Heroku.Account>('/account')
-    const email = account.email || ''
+    const email = account.email!
 
-    const token = this.heroku.auth || ''
-
-    if (token === '') {
-      ux.error(logInMessage)
+    const existingAlias = accounts.find(account => account.name && account.username === email)
+    if (existingAlias) {
+      ux.error(`Account ${email} already has an alias of ${existingAlias.name}.`)
     }
 
-    if (email === '') {
-      ux.error(logInMessage)
-    }
+    const token = this.heroku.auth!
 
     AccountsModule.add(name, email, token)
   }

src/commands/accounts/current.ts

@@ -11,11 +11,12 @@ export default class Current extends Command {
   static promptFlagActive = false
 
   async run() {
-    const accountName = await AccountsModule.current()
+    const accountName = await AccountsModule.current(this.heroku)
     if (accountName) {
       hux.styledHeader(`Current account is ${color.user(accountName)}`)
     } else {
-      ux.error(`You haven't set an account. Run ${color.code('heroku accounts:add <account-name>')} to add an account to your cache or ${color.code('heroku accounts:set <account-name>')} to set the current account.`)
+      ux.error(`You haven't set an account.\n
+      Run ${color.code('heroku accounts:add <account-name>')} to add an account to your cache or ${color.code('heroku accounts:set <account-name>')} to set the current account.`)
     }
   }
 }

src/commands/accounts/index.ts

@@ -11,16 +11,17 @@ export default class AccountsIndex extends Command {
   static promptFlagActive = false
 
   async run() {
-    const accounts = accountsModule.list()
+    const accounts = await accountsModule.list()
     if (accounts.length === 0) {
       ux.error('You don\'t have any accounts in your cache.')
     }
 
+    const current = await accountsModule.current(this.heroku)
     for (const account of accounts) {
-      if (account.name === await accountsModule.current()) {
-        ux.stdout(`* ${account.name}`)
+      if (account.name === current || account.username === current) {
+        ux.stdout(`* ${account.name ?? account.username}`)
       } else {
-        ux.stdout(`  ${account.name}`)
+        ux.stdout(`  ${account.name ?? account.username}`)
       }
     }
   }

src/commands/accounts/remove.ts

@@ -15,14 +15,19 @@ export default class Remove extends Command {
     const {args} = await this.parse(Remove)
     const {name} = args
 
-    if (!AccountsModule.list().some(a => a.name === name)) {
+    const accounts = await AccountsModule.list()
+    const account = accounts.find(a => a.name === name || a.username === name)
+
+    if (!account) {
       ux.error(`${name} doesn't exist in your accounts cache.`)
     }
 
-    if (await AccountsModule.current() === name) {
-      ux.error(`${name} is the current account.`)
+    const currentAccount = await AccountsModule.current(this.heroku)
+    // Check both alias (name) and email (username) against current account
+    if (currentAccount === name || currentAccount === account.username) {
+      ux.error(`${name} is the current account. To log out, run ${color.command('heroku logout')}.`)
     }
 
-    AccountsModule.remove(name)
+    await AccountsModule.remove(name)
   }
 }

src/commands/accounts/set.ts

@@ -6,19 +6,22 @@ import AccountsModule from '../../lib/accounts/accounts.js'
 
 export default class Set extends Command {
   static args = {
-    name: Args.string({description: 'name of account to set', required: true}),
+    name: Args.string({description: 'name or username of account to set', required: true}),
   }
-  static description = 'set the current Heroku account from your cache'
+  static description = 'set the current Heroku account from your accounts cache'
   static example = `${color.command('heroku accounts:set my-account')}`
 
   async run() {
     const {args} = await this.parse(Set)
     const {name} = args
 
-    if (!AccountsModule.list().some(a => a.name === name)) {
-      ux.error(`${name} does not exist in your accounts cache.`)
+    const accounts = await AccountsModule.list()
+    const account = accounts.find(account => account.name === name || account.username === name)
+
+    if (!account) {
+      ux.error(`${name} doesn't exist in your accounts cache.`)
     }
 
-    AccountsModule.set(name)
+    await AccountsModule.set(account, this.config.dataDir)
   }
 }

src/commands/apps/create.ts

@@ -90,6 +90,7 @@ async function configureGitRemote(context: Interfaces.ParserOutput, app: Heroku.
   const remoteUrl = git.httpGitUrl(app.name || '')
   if (!context.flags['no-remote'] && git.inGitRepo()) {
     await git.createRemote(context.flags.remote || 'heroku', remoteUrl)
+    await git.configureCredentialHelper()
   }
 
   return remoteUrl

src/commands/auth/login.ts

@@ -2,6 +2,8 @@ import {Command, flags} from '@heroku-cli/command'
 import * as Heroku from '@heroku-cli/schema'
 import * as color from '@heroku/heroku-cli-util/color'
 
+import Git from '../../lib/git/git.js'
+
 export default class Login extends Command {
   static aliases = ['login']
   static description = 'login with your Heroku credentials'
@@ -19,6 +21,15 @@ export default class Login extends Command {
     await this.heroku.login({browser: flags.browser, expiresIn: flags['expires-in'], method})
     const {body: account} = await this.heroku.get<Heroku.Account>('/account', {retryAuth: false})
     this.log(`Logged in as ${color.user(account.email!)}`)
+
+    const git = new Git()
+    try {
+      await git.configureCredentialHelper()
+      await git.eraseCredentials()
+    } catch {
+      // ignore
+    }
+
     await this.config.runHook('recache', {type: 'login'})
   }
 }

src/commands/auth/logout.ts

@@ -1,18 +1,34 @@
-
 import {Command} from '@heroku-cli/command'
 import {ux} from '@oclif/core/ux'
 
+import AccountsModule from '../../lib/accounts/accounts.js'
+import Git from '../../lib/git/git.js'
+
 export default class Logout extends Command {
   static aliases = ['logout']
   static baseFlags = Command.baseFlagsWithoutPrompt()
   static description = 'clears local login credentials and invalidates API session'
   static promptFlagActive = false
 
   async run() {
-    this.parse(Logout)
+    await this.parse(Logout)
 
     ux.action.start('Logging out')
+    const cachedNetrcAccount = await AccountsModule.currentNetrc()
     await this.heroku.logout()
+
+    const git = new Git()
+    try {
+      await git.removeCredentialHelper()
+      await git.eraseCredentials()
+    } catch {
+      // ignore
+    }
+
+    if (cachedNetrcAccount) {
+      await AccountsModule.remove(cachedNetrcAccount)
+    }
+
     await this.config.runHook('recache', {type: 'logout'})
     ux.action.stop()
   }

src/commands/auth/whoami.ts

@@ -18,7 +18,7 @@ export default class AuthWhoami extends Command {
       const {body: account} = await this.heroku.get<Heroku.Account>('/account', {retryAuth: false})
       this.log(account.email)
     } catch (error: any) {
-      if (error.statusCode === 401) this.notloggedin()
+      if (error.http.statusCode === 401) this.notloggedin()
       throw error
     }
   }

src/commands/ci/config/unset.ts

@@ -35,7 +35,7 @@ export default class CiConfigUnset extends Command {
 
     await ux.action.start(`Unsetting ${Object.keys(vars).join(', ')}`)
 
-    setPipelineConfigVars(this.heroku, pipeline.id, vars)
+    await setPipelineConfigVars(this.heroku, pipeline.id, vars)
 
     ux.action.stop()
   }

src/commands/git/clone.ts

@@ -28,5 +28,6 @@ remote: Counting objects: 42, done.
     const directory = args.DIRECTORY || (app.name as string)
     const remote = flags.remote || 'heroku'
     await git.spawn(['clone', '-o', remote, git.url(app.name!), directory])
+    await git.configureCredentialHelper()
   }
 }

src/commands/git/credentials.ts

@@ -1,5 +1,6 @@
-import {Command} from '@heroku-cli/command'
+import {Command, vars} from '@heroku-cli/command'
 import {Args, ux} from '@oclif/core'
+import * as readline from 'node:readline'
 
 export class GitCredentials extends Command {
   static args = {
@@ -14,14 +15,24 @@ export class GitCredentials extends Command {
       case 'erase':
       // eslint-ignore-next-line no-fallthrough
       case 'store': {
-      // ignore
+        // ignore
         break
       }
 
       case 'get': {
-        if (!this.heroku.auth) throw new Error('not logged in')
+        const {host, protocol} = await this.readInput()
+
+        const {httpGitHost} = vars
+        if (protocol !== 'https' || host !== httpGitHost) {
+          return
+        }
+
+        if (!this.heroku.auth) {
+          throw new Error('not logged in')
+        }
+
         ux.stdout(`protocol=https
-host=git.heroku.com
+host=${httpGitHost}
 username=heroku
 password=${this.heroku.auth}`)
         break
@@ -32,4 +43,37 @@ password=${this.heroku.auth}`)
       }
     }
   }
+
+  /**
+   * Reads git-credential input from stdin
+   * Format: key=value pairs, one per line, terminated by blank line
+   * Returns parsed object with protocol, host, username, and path
+   */
+  private async readInput(): Promise<{host?: string; path?: string; protocol?: string; username?: string;}> {
+    return new Promise(resolve => {
+      const rl = readline.createInterface({
+        input: process.stdin,
+        terminal: false,
+      })
+
+      const input: Record<string, string> = {}
+
+      rl.on('line', (line: string) => {
+        if (!line.trim()) {
+          rl.close()
+          return
+        }
+
+        const [key, value] = line.split('=', 2)
+        if (key && value) {
+          input[key] = value
+        }
+      })
+
+      rl.on('close', () => {
+        process.stdin.pause()
+        resolve(input)
+      })
+    })
+  }
 }

src/commands/git/remote.ts

@@ -40,5 +40,7 @@ ${color.command('heroku git:remote --remote heroku-staging -a example-staging')}
 
     const newRemote = await git.remoteUrl(remote)
     this.log(`set git remote ${color.cyan(remote)} to ${color.cyan(newRemote)}`)
+
+    await git.configureCredentialHelper()
   }
 }