From d0f5c67aa1abd74227a5b7b624077870ec98060f Mon Sep 17 00:00:00 2001 From: nicodes Date: Sat, 10 Oct 2026 07:08:04 +0200 Subject: [PATCH] Remove legacy Termcade publishing key support --- README.md | 3 +-- internal/registry/client.go | 2 +- internal/registry/client_test.go | 6 ++++++ internal/registry/device.go | 2 +- 4 files changed, 9 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 258d222..713b575 100644 --- a/README.md +++ b/README.md @@ -241,8 +241,7 @@ termcade publish https://github.com/you/mygame v1.0.0 mygame.tcade For automated publishing, log in and run `termcade keys new `. The API asks Termcade's Clerk tenant to create an `ak_…` key restricted to that handle. Set it as `TERMCADE_TOKEN` when running `termcade publish`. Manage keys -with `termcade keys list` and `termcade keys revoke `. Existing `tck_…` keys -remain usable during the transition. Publishing keys cannot sign in or manage +with `termcade keys list` and `termcade keys revoke `. Publishing keys cannot sign in or manage accounts; browser-approved `termcade login` continues to use separate CLI sessions. The registry fetches that asset once, validates it against the same manifest diff --git a/internal/registry/client.go b/internal/registry/client.go index 7d9cf45..c4b54af 100644 --- a/internal/registry/client.go +++ b/internal/registry/client.go @@ -265,7 +265,7 @@ func (c *Client) doContext(ctx context.Context, method, path string, body, out a } func (c *Client) authorizationValue() string { - if strings.HasPrefix(c.token, "tcc_") || strings.HasPrefix(c.token, "tck_") || strings.HasPrefix(c.token, "ak_") { + if strings.HasPrefix(c.token, "tcc_") || strings.HasPrefix(c.token, "ak_") { return "Bearer " + c.token } return c.token diff --git a/internal/registry/client_test.go b/internal/registry/client_test.go index 0253ef7..4f92d6d 100644 --- a/internal/registry/client_test.go +++ b/internal/registry/client_test.go @@ -191,3 +191,9 @@ func TestClerkPublishingKeyUsesBearerWithoutBecomingLogin(t *testing.T) { t.Fatal(err) } } + +func TestLegacyPublishingKeysAreNotAccepted(t *testing.T) { + if IsPublishKey("tck_" + strings.Repeat("A", 43)) { + t.Fatal("legacy key accepted") + } +} diff --git a/internal/registry/device.go b/internal/registry/device.go index 939ab3c..c372482 100644 --- a/internal/registry/device.go +++ b/internal/registry/device.go @@ -28,7 +28,7 @@ var ( userCodeRE = regexp.MustCompile(`^[ABCDEFGHJKMNPQRSTUVWXYZ23456789]{4}-[ABCDEFGHJKMNPQRSTUVWXYZ23456789]{4}$`) deviceCodeRE = regexp.MustCompile(`^tcd_[A-Za-z0-9_-]{43}$`) cliTokenRE = regexp.MustCompile(`^tcc_[A-Za-z0-9_-]{43}$`) - publishKeyRE = regexp.MustCompile(`^(tck_[A-Za-z0-9_-]{43}|ak_[A-Za-z0-9_-]{20,512})$`) + publishKeyRE = regexp.MustCompile(`^ak_[A-Za-z0-9_-]{20,512}$`) ) func IsCLIToken(value string) bool { return cliTokenRE.MatchString(value) }