composer_token.sh

#!/usr/bin/env bash
# composer_token.sh
# Securely sets the GitHub OAuth token for Composer private package access.
# Usage: bash composer_token.sh

set -euo pipefail

COMPOSER_AUTH_FILE="${COMPOSER_HOME:-$HOME/.config/composer}/auth.json"

echo "Composer GitHub OAuth Token Setup"
echo "==================================="
echo "This sets the token used by Composer to access private GitHub repositories."
echo "Token is stored in: $COMPOSER_AUTH_FILE"
echo ""

printf "Token: "
TOKEN=""
while IFS= read -r -s -n1 c; do
    if [[ -z "$c" ]]; then
        echo
        break
    elif [[ "$c" == $'\x7f' ]]; then
        if [[ -n "$TOKEN" ]]; then
            TOKEN="${TOKEN%?}"
            printf '\b \b'
        fi
    else
        TOKEN+="$c"
        printf '*'
    fi
done

if [[ -z "$TOKEN" ]]; then
    echo "Error: No token entered. Aborting." >&2
    exit 1
fi

# Basic sanity check — GitHub PATs start with github_pat_ or ghp_
if [[ "$TOKEN" != github_pat_* && "$TOKEN" != ghp_* ]]; then
    echo "Warning: Token does not look like a GitHub PAT (expected github_pat_ or ghp_ prefix)."
    read -r -p "Continue anyway? [y/N]: " confirm
    [[ "${confirm,,}" == "y" ]] || { echo "Aborted."; exit 1; }
fi

composer config --global github-oauth.github.com "$TOKEN"
unset TOKEN

echo ""
echo "Token saved to $COMPOSER_AUTH_FILE"

# Verify without exposing the value
SAVED=$(php -r "
    \$auth = json_decode(file_get_contents('$COMPOSER_AUTH_FILE'), true);
    echo \$auth['github-oauth']['github.com'] ?? '';
" 2>/dev/null)

if [[ -n "$SAVED" ]]; then
    echo "Verification: Token is set. Length: ${#SAVED} characters, starts with: ${SAVED:0:10}..."
else
    echo "Verification failed: token does not appear to be saved." >&2
    exit 1
fi