1# token, tokens [rm <id>]: a token is printed once, on a line of its own,2# and only its hash is kept. --repo must name a repo you can read, and says3# what any command says about one that isn't there; --ttl sets how long it4# lasts (30d by default, at most 365d). Expired and revoked tokens are gone5# from the list, and removing a user's keys removes their tokens.6. "$(dirname "$0")/../lib.sh"7user dami8user ana9repo --private dami/secret10repo dami/open11export FORGE_BASE_URL=https://forge.test12db=$FORGE_ROOT/.forge/identity.db1314ssh_as dami token ci >"$T/tok" 2>"$T/err" || fail "token"15tok=$(cat "$T/tok")16case $tok in forge_*) ;; *) fail "not a token: $tok" ;; esac17eq "$(wc -l <"$T/tok" | tr -d ' ')" 118has "$T/err" '"ci" for every repo dami can read, until 2026-10-01 00:00 UTC'19has "$T/err" "git clone https://dami:$tok@forge.test/<owner>/<repo>.git"20if grep -aqF "$tok" "$db" "$db-wal" 2>/dev/null; then fail "the token itself is in identity.db"; fi2122ok ssh_as dami token --repo dami/secret --ttl 2d deploy key23has "$T_LOG" '"deploy key" for dami/secret, until 2026-09-03 00:00 UTC'24ok ssh_as dami tokens25has "$T_LOG" '^id +for +made +expires +last used +name$'26has "$T_LOG" ' dami/secret .* 2026-09-03 00:00 +never +deploy key$'27has "$T_LOG" ' \(all you read\) .* ci$'28id=$(awk '$NF == "ci" { print $1 }' "$T_LOG")2930# Someone else's private repo is not there, as for any command.31fails ssh_as ana token --repo dami/secret32denied=$(output)33aside dami/secret34fails ssh_as ana token --repo dami/secret35back dami/secret36eq "$denied" "$(output)"37eq "$denied" "forge: no repo dami/secret"38ok ssh_as ana token --repo dami/open39ok ssh_as ana tokens40has "$T_LOG" ' dami/open '41lacks "$T_LOG" 'dami/secret|deploy key'4243fails_with 'at most 365d' ssh_as dami token --ttl 366d44fails_with 'like 30d or 12h' ssh_as dami token --ttl 1w45fails_with 'needs a value' ssh_as dami token --repo46fails_with 'usage: token' ssh_as dami token --scope x4748# Revoked: gone, and only by its owner.49fails_with "no token $id" ssh_as ana tokens rm "$id"50ok ssh_as dami tokens rm "$id"51has "$T_LOG" "revoked token $id \"ci\""52ok ssh_as dami tokens53lacks "$T_LOG" ' ci$'54fails_with "no token $id" ssh_as dami tokens rm "$id"5556# Expired: three days on, the 2d token is gone too.57FORGE_NOW=$((T_NOW + 3 * 86400)) ssh_as dami tokens >"$T_LOG" 2>&1 || fail "tokens"58has "$T_LOG" '^no tokens'5960# A user's tokens go with their keys.61ok forge user rm ana62eq "$(FORGE_STATE=$FORGE_ROOT/.forge node -e '63const { DatabaseSync } = require("node:sqlite");64console.log(new DatabaseSync(process.argv[1]).prepare("SELECT count(*) AS n FROM tokens WHERE user = ?").get("ana").n)' "$db" 2>/dev/null)" 0