Info-Auth - PKU 统一凭据管理 CLI

Secure credential management for all PKU IAAA-based CLI tools. Allows AI Agents to trigger login flows without ever seeing passwords.

Why This Exists

AI Agents (like OpenClaw/Claude Code) cannot and should not handle user passwords directly. This tool lets users store credentials once in the OS keyring, then all CLI tools auto-authenticate from the keyring.

Architecture

• Crate location: crates/info-auth/
• Backend: OS keyring via keyring crate
  • Linux: D-Bus Secret Service (GNOME Keyring / KDE Wallet)
  • macOS: Apple Keychain
  • Windows: Windows Credential Manager
• Keyring service name: info-pku

CLI Commands

Credential Resolution Order

When any CLI tool runs login -p, credentials are resolved in this order:

1. OS Keyring — stored via info-auth store (recommended)
2. Environment variables — PKU_USERNAME + PKU_PASSWORD (for CI/automation)
3. Interactive prompt — fallback, asks for username/password via stdin

SMS verification codes follow a similar pattern:

1. Environment variable — PKU_SMS_CODE (Agent can set this after asking user)
2. Interactive prompt — fallback

For AI Agents — Quick Start

First-time setup (user does this once manually)

info-auth store
# User enters username + password interactively
# Credentials stored in OS keyring, encrypted

Agent workflow

# 1. Check which services have valid sessions
info-auth check

# 2. Login to any service (auto-reads credentials from keyring)
treehole login -p
course login -p
campuscard login -p
elective login -p          # may need: --dual major / --dual minor

# 3. If SMS verification is needed (treehole first login):
#    Ask user for the code, then set env var:
PKU_SMS_CODE=123456 treehole login -p

# 4. Use the service
treehole list
course courses --all
campuscard info
elective show

Key rules for Agents

• NEVER pass passwords as CLI arguments
• NEVER try to read the keyring directly — use info-auth status to check
• If info-auth check shows "未登录" or "会话已过期", run <tool> login -p
• If login fails with "系统密钥链中未存储凭据", ask user to run info-auth store

Development Notes

• All user-facing strings in Chinese
• Error handling: anyhow::Result with .context("中文描述")
• The store command requires password confirmation (enter twice)
• keyring_has_credential() returns diagnostic info on failure for debugging