Conversation
- Show the verification URL as readable text alongside the existing link - Add a dedicated Copy button next to the device code so it can be re-copied anytime (e.g. after a clipboard manager clears it) - Render a QR code (vendored qrcode-generator, MIT licensed) so the GitHub device sign-in can be completed from a phone by scanning - GitHubDeviceAuth now also returns verification_uri_complete when GitHub provides it, used to pre-fill the code in the QR flow
…operations - CredentialVault::materializeDockerConfig() now logs the credential's friendly name and registry host (never the secret) whenever it's used to build a Docker auth config - compose.sh logs when up/pull/update run with no credential attached to the stack, so anonymous pulls are visible instead of silent - compose_autoupdate.sh logs the same for scheduled auto-updates, and resolves the credential after the project name is finalized so the log line always includes it
…edential test/renewal check - credential_config.php now also prints the credential's friendly name/registry as a second line so callers can echo it, instead of only logging it to syslog where it was easy to miss - compose.sh and compose_autoupdate.sh now log 'Using registry credential ...' inline alongside the other DEBUG command lines, fixing the case where a configured credential produced no visible log line at all - Add CredentialVault::testCredential(), which performs the standard Docker Registry v2 auth handshake (ping /v2/, follow the Bearer challenge to the token endpoint) to verify a saved credential still authenticates, without ever exposing the secret - Add a 'testCredential' Exec.php action and a Test button per credential row in the UI; failures surface a message suggesting the token may have expired/been revoked and prompting renewal - Add CredentialVault::getCredentialSummary() and a unit test
- GitHubDeviceAuth::start()/poll() accept an existing credential id so a re-authorization updates that credential in place (same id, same stack assignments, original custom name preserved) instead of creating a duplicate - Add a 'Renew access' button in the edit modal for GitHub OAuth credentials that re-runs the device sign-in flow against the existing credential - The 'Credential rejected' result from Test now offers a one-click Renew action (kicks off GitHub sign-in immediately) or opens the edit modal focused on the token field for manual credentials - Add a unit test covering renewal id/name preservation
Add registry credential management and UI enhancements
fix(ui): wait for profile dialog to close
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Unresolved credential authorization, concurrency, cleanup, auto-update, and UI state issues remain.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 1
Open (3)
What changed in this PR
Adds encrypted registry credential management, GitHub device authentication, stack assignment, and Docker Compose integration.
Changes:
- Adds credential vault storage, CRUD/testing endpoints, and authentication UI.
- Propagates credentials through stack actions, startup, and auto-updates.
- Adds QR support, configuration updates, and regression tests.
| File | Summary |
|---|---|
tests/unit/GitHubDeviceAuthTest.php |
Tests GitHub device authentication. |
tests/unit/ExecActionsTest.php |
Tests credential assignment and deletion protection. |
tests/unit/CredentialVaultTest.php |
Tests encrypted vault behavior. |
tests/unit/ComposeCommandBuilderTest.php |
Tests credential action propagation. |
tests/unit/compose.bats |
Updates cleanup-trap coverage. |
tests/bootstrap.php |
Defines credential test paths. |
source/compose.manager/scripts/credential_config.php |
Materializes and removes Docker configs. |
source/compose.manager/scripts/compose.sh |
Applies credentials to Compose operations. |
source/compose.manager/scripts/compose_autoupdate.sh |
Applies credentials to auto-updates. |
source/compose.manager/scripts/compose_args.php |
Emits credential metadata. |
source/compose.manager/scripts/common.sh |
Parses credential action arguments. |
source/compose.manager/README.md |
Marks the plugin as beta. |
source/compose.manager/javascript/qrcode/qrcode.min.js |
Adds QR-code generation. |
source/compose.manager/javascript/credentialManager.js |
Implements credential UI workflows. |
source/compose.manager/javascript/composeManagerMain.js |
Integrates credentials into stack settings. |
source/compose.manager/include/Util.php |
Reads stack credential metadata. |
source/compose.manager/include/Helpers.php |
Adds credentials to commands. |
source/compose.manager/include/GitHubDeviceAuth.php |
Implements GitHub device authentication. |
source/compose.manager/include/Exec.php |
Adds credential endpoints and assignment handling. |
source/compose.manager/include/Defines.php |
Defines credential storage paths. |
source/compose.manager/include/CredentialVault.php |
Provides encrypted credential storage. |
source/compose.manager/include/ComposeManager.php |
Loads credential UI assets and settings. |
source/compose.manager/include/ComposeCommandBuilder.php |
Builds credential-aware action specifications. |
source/compose.manager/include/AutoUpdateRunner.php |
Propagates credentials to scheduled updates. |
source/compose.manager/event/docker_started |
Applies credentials during startup. |
source/compose.manager/default.cfg |
Adds GitHub OAuth configuration. |
source/compose.manager/compose.manager.settings.page |
Adds the Credentials tab. |
compose.manager.plg |
Updates plugin metadata and branch configuration. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces a comprehensive registry credential management system to the Compose Manager plugin. It adds support for securely storing, assigning, and managing registry credentials, allowing users to associate credentials with individual stacks for pull operations. The UI is updated with a new "Credentials" tab, and various backend enhancements ensure credentials are securely handled and integrated throughout the stack lifecycle.
Credential management features:
compose.manager.settings.page), allowing users to add, view, test, and delete registry credentials, and see which stacks use each credential. [1] [2] [3]CredentialVaultandGitHubDeviceAuthclasses. [1] [2]Stack integration and assignment:
UI/UX improvements:
Supporting infrastructure: