Skip to content

Conversation

@holmboe
Copy link
Contributor

@holmboe holmboe commented Jan 11, 2026

Summary

  • Add support for reading credentials from Arcanist's ~/.arcrc file, making it easier for existing Arcanist users to get started with phabfive
  • Add security checks to ensure user configuration files have secure permissions (0600) before reading them
  • Support config.default field in .arcrc to select the default host when multiple hosts are configured
  • Support multiple hosts in .arcrc by requiring PHAB_URL to be set when more than one host is configured and no default is specified

Features

  • .arcrc support: Automatically reads PHAB_URL and PHAB_TOKEN from ~/.arcrc if present
  • Multi-host handling:
    • Single host → uses both URL and token automatically
    • Multiple hosts with config.default → uses the default host
    • Multiple hosts without default → requires PHAB_URL to select which host
  • Priority order:
    1. PHAB_URL from env/config (highest)
    2. config.default from .arcrc
    3. Single host in .arcrc (auto-select)
    4. Multiple hosts without default (error with list)
  • Permission checks: Validates that ~/.config/phabfive.yaml, ~/.config/phabfive.d/*.yaml, and ~/.arcrc have secure permissions (not readable by group/others)
  • URL normalization: Handles various URL formats including those without /api/ suffix

Test plan

  • Added 28 tests covering:
    • Permission checking (_check_secure_permissions)
    • .arcrc loading with various permission modes
    • Single and multiple host scenarios
    • config.default handling
    • URL matching with trailing slashes and ports
    • Legacy certificate format handling
  • All 290 tests pass

Closes #123

🤖 Generated with Claude Code

holmboe and others added 3 commits January 11, 2026 18:15
Users who already use Arcanist have credentials stored in ~/.arcrc.
This change allows phabfive to read PHAB_URL and PHAB_TOKEN from
that file, making it easier for Arcanist users to get started.

Features:
- Security check ensures config files have 0600 permissions before reading
  (applies to ~/.config/phabfive.yaml, ~/.config/phabfive.d/*.yaml, ~/.arcrc)
- Single host in .arcrc: automatically uses both URL and token
- Multiple hosts in .arcrc: requires PHAB_URL to be set to select which host
- URL matching normalizes trailing slashes for reliable matching

Closes #123

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
When multiple hosts are configured in .arcrc, use the config.default
field to select which host to use (if no PHAB_URL is explicitly set).

Priority order:
1. PHAB_URL from env/config (highest)
2. config.default from .arcrc
3. Single host in .arcrc (auto-select)
4. Multiple hosts without default (error with list)

Also fixed _normalize_url to properly handle URLs without /api/ suffix
(e.g., https://example.com -> https://example.com/api/).

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
When multiple hosts are configured in .arcrc, use the config.default
field to select which host to use (if no PHAB_URL is explicitly set).

Priority order:
1. PHAB_URL from env/config (highest)
2. config.default from .arcrc
3. Single host in .arcrc (auto-select)
4. Multiple hosts without default (error with list)

Also fixed _normalize_url to properly handle URLs without /api/ suffix
(e.g., https://phorge.example.com -> https://phorge.example.com/api/).

Standardized example hostnames to use phorge.example.com.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@holmboe holmboe force-pushed the fix/issue-123-arcrc-file branch from 4a1230f to 85b5aed Compare January 11, 2026 17:29
Windows uses ACLs instead of Unix-style permissions, so os.chmod()
and the permission bits from os.stat() don't work as expected.

- Skip _check_secure_permissions() on Windows (os.name == "nt")
- Skip permission-related tests on Windows with pytest.mark.skipif

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@holmboe holmboe requested a review from Timpan4 January 12, 2026 00:32
Copy link
Contributor

@Timpan4 Timpan4 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support Arcanist .arcrc files

3 participants