Add auth_plugin with tests

conan/internal/cache/home_paths.py

@@ -55,6 +55,10 @@ def profiles_path(self):
     def profile_plugin_path(self):
         return os.path.join(self._home, _EXTENSIONS_FOLDER, _PLUGINS, "profile.py")
 
+    @property
+    def auth_plugin_path(self):
+        return os.path.join(self._home, _EXTENSIONS_FOLDER, _PLUGINS, "auth.py")
+
     @property
     def sign_plugin_path(self):
         return os.path.join(self._home, _EXTENSIONS_FOLDER, _PLUGINS, "sign", "sign.py")

conans/client/migrations.py

@@ -52,6 +52,9 @@ def _apply_migrations(self, old_version):
         # Update profile plugin
         from conan.internal.api.profile.profile_loader import migrate_profile_plugin
         migrate_profile_plugin(self.cache_folder)
+        # Update auth plugin
+        from conans.client.rest.remote_credentials import migrate_auth_plugin
+        migrate_auth_plugin(self.cache_folder)
 
         if old_version and old_version < "2.0.14-":
             _migrate_pkg_db_lru(self.cache_folder, old_version)

conans/client/rest/remote_credentials.py

@@ -4,16 +4,29 @@
 
 from jinja2 import Template
 
+from conan.internal.cache.home_paths import HomePaths
+
+from conans.client.loader import load_python_file
 from conan.api.output import ConanOutput
 from conans.client.userio import UserInput
-from conans.errors import ConanException
+from conans.errors import ConanException, scoped_traceback
 from conans.util.files import load
 
+_default_auth_plugin = """
+# This file was generated by Conan. Remove this comment if you edit this file or Conan
+# will destroy your changes.
+
+def auth_plugin(remote, user=None, password=None):
+    # TODO: Connect this function to your own keyring for user login credentials
+    return None, None
+"""
+
 
 class RemoteCredentials:
     def __init__(self, cache_folder, global_conf):
         self._global_conf = global_conf
         self._urls = {}
+        self.auth_plugin_path = HomePaths(cache_folder).auth_plugin_path
         creds_path = os.path.join(cache_folder, "credentials.json")
         if not os.path.exists(creds_path):
             return
@@ -32,7 +45,19 @@ def auth(self, remote, user=None, password=None):
         if user is not None and password is not None:
             return user, password
 
-        # First prioritize the cache "credentials.json" file
+        # First get the auth_plugin
+        auth_plugin = self._load_auth_plugin()
+        if auth_plugin is not None:
+            try:
+                plugin_user, plugin_password = auth_plugin(remote, user=user, password=password)
+            except Exception as e:
+                msg = f"Error while processing 'auth.py' plugin"
+                msg = scoped_traceback(msg, e, scope="/extensions/plugins")
+                raise ConanException(msg)
+            if plugin_user and plugin_password:
+                return plugin_user, plugin_password
+
+        # Then prioritize the cache "credentials.json" file
         creds = self._urls.get(remote)
         if creds is not None:
             try:
@@ -66,3 +91,18 @@ def _get_env(remote, user):
         if passwd:
             ConanOutput().info("Got password '******' from environment")
         return user, passwd
+
+    def _load_auth_plugin(self):
+        if not os.path.exists(self.auth_plugin_path):
+            raise ConanException("The 'auth.py' plugin file doesn't exist. If you want "
+                                 "to disable it, edit its contents instead of removing it")
+
+        mod, _ = load_python_file(self.auth_plugin_path)
+        if hasattr(mod, "auth_plugin"):
+            return mod.auth_plugin
+
+def migrate_auth_plugin(cache_folder):
+    from conans.client.migrations import update_file
+
+    auth_plugin_file = HomePaths(cache_folder).auth_plugin_path
+    update_file(auth_plugin_file, _default_auth_plugin)

test/integration/configuration/test_auth_plugin.py

@@ -0,0 +1,60 @@
+import os
+import textwrap
+
+import pytest
+
+from conan.test.utils.tools import TestClient
+from conans.util.files import save
+
+
+class TestErrorsAuthPlugin:
+    """ when the plugin fails, we want a clear message and a helpful trace
+    """
+    def test_error_profile_plugin(self):
+        c = TestClient(default_server_user=True)
+        auth_plugin = textwrap.dedent("""\
+            def auth_plugin(remote, user=None, password=None):
+                raise Exception("Test Error")
+            """)
+        save(os.path.join(c.cache.plugins_path, "auth.py"), auth_plugin)
+        c.run("remote logout default")
+        c.run("remote login default", assert_error=True)
+        assert "Error while processing 'auth.py' plugin" in c.out
+        assert "Test Error" in c.out
+
+    def test_remove_plugin_file(self):
+        c = TestClient()
+        c.run("version")  # to trigger the creation
+        os.remove(os.path.join(c.cache.plugins_path, "auth.py"))
+        c.run("remote add default http://fake")
+        c.run("remote login default", assert_error=True)
+        assert "ERROR: The 'auth.py' plugin file doesn't exist" in c.out
+
+    @pytest.mark.parametrize("password", ["password", "bad-password"])
+    def test_profile_plugin_direct_credentials(self, password):
+        should_fail = password == "bad-password"
+        c = TestClient(default_server_user=True)
+        auth_plugin = textwrap.dedent(f"""\
+            def auth_plugin(remote, user=None, password=None):
+                return "admin", "{password}"
+            """)
+        save(os.path.join(c.cache.plugins_path, "auth.py"), auth_plugin)
+        c.run("remote logout default")
+        c.run("remote login default", assert_error=should_fail)
+        if should_fail:
+            assert "ERROR: Wrong user or password. [Remote: default]" in c.out
+        else:
+            assert "Changed user of remote 'default' from 'None' (anonymous) to 'admin' (authenticated)" in c.out
+
+    def test_profile_plugin_fallback(self):
+        c = TestClient(default_server_user=True)
+        auth_plugin = textwrap.dedent("""\
+                def auth_plugin(remote, user=None, password=None):
+                    return None, None
+                """)
+        save(os.path.join(c.cache.plugins_path, "auth.py"), auth_plugin)
+        c.run("remote logout default")
+        c.run("remote login default")
+        # As the auth plugin is not returning any password the code is falling back to the rest of
+        # the input methods in this case the stdin provided by TestClient.
+        assert "Changed user of remote 'default' from 'None' (anonymous) to 'admin' (authenticated)" in c.out