info-auth

Info-Auth - PKU 统一凭据管理 CLI

Secure credential management for all PKU IAAA-based CLI tools. Allows AI Agents to trigger login flows without ever seeing passwords.

Why This Exists

AI Agents (like OpenClaw/Claude Code) cannot and should not handle user passwords directly. This tool lets users store credentials once in the OS keyring, then all CLI tools auto-authenticate from the keyring.

Architecture

• Crate location: crates/info-auth/
• Backend: OS keyring via keyring crate
  • Linux: D-Bus Secret Service (GNOME Keyring / KDE Wallet)
  • macOS: Apple Keychain
  • Windows: Windows Credential Manager
• Keyring service name: info-pku

CLI Commands

Command	Alias	Function
store	save	Interactively input and store credentials to OS keyring
status		Show credential storage status (never shows password)
check		Show session status for ALL services (treehole/course/campuscard/elective)
clear		Remove credentials from OS keyring

Credential Resolution Order

When any CLI tool runs login -p, credentials are resolved in this order:

1. OS Keyring — stored via info-auth store (recommended)
2. Environment variables — PKU_USERNAME + PKU_PASSWORD (for CI/automation)
3. Interactive prompt — fallback, asks for username/password via stdin

SMS verification codes follow a similar pattern:

1. Environment variable — PKU_SMS_CODE (Agent can set this after asking user)
2. Interactive prompt — fallback

For AI Agents — Quick Start

First-time setup (user does this once manually)

info-auth store
# User enters username + password interactively
# Credentials stored in OS keyring, encrypted

Agent workflow

# 1. Check which services have valid sessions
info-auth check

# 2. Login to any service (auto-reads credentials from keyring)
treehole login -p
course login -p
campuscard login -p
elective login -p          # may need: --dual major / --dual minor

# 3. If SMS verification is needed (treehole first login):
#    Ask user for the code, then set env var:
PKU_SMS_CODE=123456 treehole login -p

# 4. Use the service
treehole list
course courses --all
campuscard info
elective show

Key rules for Agents

• NEVER pass passwords as CLI arguments
• NEVER try to read the keyring directly — use info-auth status to check
• If info-auth check shows "未登录" or "会话已过期", run <tool> login -p
• If login fails with "系统密钥链中未存储凭据", ask user to run info-auth store

Development Notes

• All user-facing strings in Chinese
• Error handling: anyhow::Result with .context("中文描述")
• The store command requires password confirmation (enter twice)
• keyring_has_credential() returns diagnostic info on failure for debugging