feat: vcs and secret management support

1 files changed, 32 insertions, 0 deletions

diff --git a/src/marlin.core/functional/TokenGitCredential.cs b/src/marlin.core/functional/TokenGitCredential.cs
new file mode 100644
index 0000000..5dfef66
--- /dev/null
+++ b/src/marlin.core/functional/TokenGitCredential.cs
@@ -0,0 +1,32 @@
+namespace marlin.core.functional;
+
+using System.Diagnostics;
+using System.Text;
+
+/// <summary>
+/// HTTPS auth via a bearer/basic token. Injected as an Authorization header for a
+/// single git invocation through GIT_CONFIG_* env vars, so it never appears in argv
+/// (visible via ps) or in git's own error output (which echoes the URL, not headers).
+/// </summary>
+public sealed class TokenGitCredential : IGitCredential
+{
+    private readonly string _username;
+    private readonly string _token;
+
+    public TokenGitCredential(string token, string username = "x-access-token")
+    {
+        this._token = token;
+        this._username = username;
+    }
+
+    public Task<IAsyncDisposable> ApplyAsync(ProcessStartInfo psi)
+    {
+        string header = Convert.ToBase64String(Encoding.UTF8.GetBytes($"{this._username}:{this._token}"));
+
+        psi.Environment["GIT_CONFIG_COUNT"] = "1";
+        psi.Environment["GIT_CONFIG_KEY_0"] = "http.extraheader";
+        psi.Environment["GIT_CONFIG_VALUE_0"] = $"AUTHORIZATION: basic {header}";
+
+        return Task.FromResult<IAsyncDisposable>(NoopAsyncDisposable.Instance);
+    }
+}