feat(model): add CredentialFormatBasicAuth for HTTP Basic auth headers#157
feat(model): add CredentialFormatBasicAuth for HTTP Basic auth headers#157
Conversation
Add new credential format constant to support HTTP Basic Authentication via Authorization headers in Burp DAST scanning, as an alternative to form-fill application logins.
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
|
Claude finished @kanbru's task —— View job Code Review AnalysisTodo List:
Has Go, TypeScript, or Python Changes: Yes Findings
Recommendations
|
WalkthroughA new credential format constant was added: ✨ Finishing touches
🧪 Generate unit tests (beta)
Important Action Needed: IP Allowlist UpdateIf your organization protects your Git platform with IP whitelisting, please add the new CodeRabbit IP address to your allowlist:
Reviews will stop working after February 8, 2026 if the new IP is not added to your allowlist. Comment |
|
Claude finished @kanbru's task —— View job PR Review AnalysisTodo List:
Has Go, TypeScript, or Python Changes: Yes Findings
Recommendations
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@pkg/model/model/credential.go`:
- Around line 68-73: Duplicate CredentialFormat constants
(FormatEnv/FormatFile/FormatToken) in credential_format.go mirror the
authoritative constants (CredentialFormatEnv, CredentialFormatFile,
CredentialFormatToken) in credential.go; remove the dead duplicates or replace
them with aliases to the canonical constants in credential.go, update any
references to use
CredentialFormatEnv/CredentialFormatFile/CredentialFormatToken, and run a build
to ensure no remaining references to the old symbols; keep the new
CredentialFormatAPIAuth and CredentialFormatBasicAuth definitions only in
credential.go so there is a single source of truth.
| // Credential Formats for capabilities to use (and advertise) | ||
| CredentialFormatEnv CredentialFormat = "env" // things like tokens can be release into env vars for caps to use | ||
| CredentialFormatFile CredentialFormat = "file" // credentials requested as files to be stored at a specific location | ||
| CredentialFormatToken CredentialFormat = "token" // returned in a struct for direct use by caps | ||
| CredentialFormatAPIAuth CredentialFormat = "api-auth" // API authentication credentials | ||
| CredentialFormatEnv CredentialFormat = "env" // things like tokens can be release into env vars for caps to use | ||
| CredentialFormatFile CredentialFormat = "file" // credentials requested as files to be stored at a specific location | ||
| CredentialFormatToken CredentialFormat = "token" // returned in a struct for direct use by caps | ||
| CredentialFormatAPIAuth CredentialFormat = "api-auth" // API authentication credentials | ||
| CredentialFormatBasicAuth CredentialFormat = "basic-auth" // HTTP Basic auth Authorization header |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Find CredentialFormat usage patterns
rg -n --type=go "CredentialFormat" -A 2 -B 2Repository: praetorian-inc/tabularium
Length of output: 3708
🏁 Script executed:
#!/bin/bash
# Look for switch statements or validation on CredentialFormat
rg -n --type=go "switch.*[Cc]redential|case.*[Cc]redential|[Cc]redential.*case"Repository: praetorian-inc/tabularium
Length of output: 51
🏁 Script executed:
#!/bin/bash
# Check for validation functions or lists that might enumerate format values
rg -n --type=go "Valid|valid|format.*string|credential.*format" | head -50Repository: praetorian-inc/tabularium
Length of output: 4474
🏁 Script executed:
#!/bin/bash
# Check credential_format.go file completely
cat -n pkg/model/model/credential_format.goRepository: praetorian-inc/tabularium
Length of output: 433
🏁 Script executed:
#!/bin/bash
# Find CredentialFormatter implementations
rg -n --type=go "type.*CredentialFormatter|func.*Apply.*CredentialFormat"Repository: praetorian-inc/tabularium
Length of output: 145
🏁 Script executed:
#!/bin/bash
# Search for any code that enumerates or validates credential formats
rg -n --type=go "FormatEnv|FormatFile|FormatToken|CredentialFormatEnv|CredentialFormatFile|CredentialFormatToken|CredentialFormatAPIAuth|CredentialFormatBasicAuth" | head -30Repository: praetorian-inc/tabularium
Length of output: 1219
🏁 Script executed:
#!/bin/bash
# Search for usages of Format* constants from credential_format.go
rg -n --type=go "FormatEnv|FormatFile|FormatToken" --no-filename | grep -v "credential_format.go"Repository: praetorian-inc/tabularium
Length of output: 730
🏁 Script executed:
#!/bin/bash
# Search for which credential format constants are actually used in code
rg -n --type=go "CredentialFormat(Env|File|Token|APIAuth|BasicAuth)" | grep -v "credential.go:" | head -20Repository: praetorian-inc/tabularium
Length of output: 267
🏁 Script executed:
#!/bin/bash
# Check if there are any validation checks on credential format values
rg -n --type=go "switch.*Format|case.*env|case.*file|case.*token|case.*api-auth|case.*basic-auth" -iRepository: praetorian-inc/tabularium
Length of output: 51
🏁 Script executed:
#!/bin/bash
# Check if the old Format* constants are used anywhere
rg -n --type=go "FormatEnv|FormatFile|FormatToken" --no-headingRepository: praetorian-inc/tabularium
Length of output: 961
🏁 Script executed:
#!/bin/bash
# Check for any implementations that might handle credential formats
rg -n --type=go "Apply.*Credential|Cleanup()" -A 5 | head -40Repository: praetorian-inc/tabularium
Length of output: 413
🏁 Script executed:
#!/bin/bash
# Look for where credential formats might be validated or processed
rg -n --type=go "credential.*format|format.*credential" -i -A 3 | head -50Repository: praetorian-inc/tabularium
Length of output: 4007
Consider consolidating duplicate CredentialFormat constants.
credential_format.go defines unused FormatEnv, FormatFile, and FormatToken constants that mirror those in credential.go lines 69-73. The active constants (with extended formats) live in credential.go; the old ones in credential_format.go are dead code. Either remove the duplicates from credential_format.go or consolidate the definitions to maintain a single source of truth.
Regarding the new "basic-auth" and "api-auth" formats: no downstream validation code rejects them—the formats are used only in struct fields without explicit validation logic.
🤖 Prompt for AI Agents
In `@pkg/model/model/credential.go` around lines 68 - 73, Duplicate
CredentialFormat constants (FormatEnv/FormatFile/FormatToken) in
credential_format.go mirror the authoritative constants (CredentialFormatEnv,
CredentialFormatFile, CredentialFormatToken) in credential.go; remove the dead
duplicates or replace them with aliases to the canonical constants in
credential.go, update any references to use
CredentialFormatEnv/CredentialFormatFile/CredentialFormatToken, and run a build
to ensure no remaining references to the old symbols; keep the new
CredentialFormatAPIAuth and CredentialFormatBasicAuth definitions only in
credential.go so there is a single source of truth.
2 participants
Summary
CredentialFormatBasicAuthconstant to support HTTP Basic Authentication via Authorization headersTest plan