Add persisted credentials for CLI client

cmd/permctl/permctl.go

@@ -2,17 +2,24 @@
 package main
 
 import (
-	"fmt"
 	"os"
+	"path/filepath"
 
 	"github.com/Permify/permify-cli/core/cli"
 )
 
 func main() {
 	home := os.Getenv("HOME")
-	defaultConfig := fmt.Sprintf("%s/.permctl", home)
+	if home == "" {
+		// os.UserHomeDir covers Windows USERPROFILE and other platforms.
+		if derived, err := os.UserHomeDir(); err == nil {
+			home = derived
+		}
+	}
+
+	defaultConfig := filepath.Join(home, ".permctl")
 	shortDescription := "permctl is a cli for managing and communicating with permify"
-	permctl	:= cli.New("permctl", shortDescription, defaultConfig)	
+	permctl := cli.New("permctl", shortDescription, defaultConfig)
 	cli.AddComponents(permctl.Cmd)
 	permctl.Execute()
 }

core/cli/configure.go

@@ -97,12 +97,54 @@ func validateFlags(cmd *cobra.Command, args []string) error {
 func runE(cmd *cobra.Command, _ []string) error {
 	configFile, _ := cmd.Flags().GetString("config")
 
-	url, err := tui.StringPrompt("enter permify url", "", config.CliConfig.PermifyURL)
+	storedCreds, err := client.LoadCredentials()
 	if err != nil {
 		return err
 	}
 
+	defaultURL := config.CliConfig.PermifyURL
+	if defaultURL == "" {
+		defaultURL = storedCreds.Endpoint
+	}
+
+	url, err := tui.StringPrompt("enter permify url", "", defaultURL)
+	if err != nil {
+		return err
+	}
+
+	token, err := tui.StringPrompt("enter api token (optional)", "", storedCreds.Token)
+	if err != nil {
+		return err
+	}
+
+	certPath, err := tui.StringPrompt("enter client certificate path (optional)", "", storedCreds.CertPath)
+	if err != nil {
+		return err
+	}
+
+	certKey, err := tui.StringPrompt("enter client certificate key path (optional)", "", storedCreds.CertKey)
+	if err != nil {
+		return err
+	}
+
+	if (certPath == "") != (certKey == "") {
+		return fmt.Errorf("both certificate path and key must be provided or omitted")
+	}
+
+	storeErr := client.StoreCredentials(client.Credentials{
+		Endpoint: url,
+		Token:    token,
+		CertPath: certPath,
+		CertKey:  certKey,
+	})
+	if storeErr != nil {
+		logger.Log.Error(storeErr)
+	}
+
 	resp, err := client.New(url)
+	if err != nil {
+		return err
+	}
 
 	// Todo: Implement pagination
 	tenants, err := resp.Tenancy.List(context.Background(), &v1.TenantListRequest{})
@@ -117,7 +159,7 @@ func runE(cmd *cobra.Command, _ []string) error {
 		tenantNames = append(tenantNames, nameID)
 		tenantIds[nameID] = tenant.Id
 	}
-	
+
 	tenant, err := tui.Choice("Select a tenant: ", tenantNames)
 	if err != nil {
 		logger.Log.Error(err)

core/client/credentials_storage.go

@@ -0,0 +1,74 @@
+package client
+
+import (
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+
+	"gopkg.in/yaml.v3"
+)
+
+// Credentials represents persisted client configuration for the Permify CLI.
+type Credentials struct {
+	Endpoint string `yaml:"endpoint"`
+	Token    string `yaml:"token"`
+	CertPath string `yaml:"cert_path"`
+	CertKey  string `yaml:"cert_key"`
+}
+
+// credentialsFilePath resolves the OS-specific location for the credentials file.
+func credentialsFilePath() (string, error) {
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return "", fmt.Errorf("resolve user home directory: %w", err)
+	}
+	return filepath.Join(home, ".permify", "credentials"), nil
+}
+
+// LoadCredentials fetches stored credentials from disk, returning an empty struct when none exist.
+func LoadCredentials() (Credentials, error) {
+	file, err := credentialsFilePath()
+	if err != nil {
+		return Credentials{}, err
+	}
+
+	data, err := os.ReadFile(file)
+	if errors.Is(err, fs.ErrNotExist) {
+		return Credentials{}, nil
+	}
+	if err != nil {
+		return Credentials{}, fmt.Errorf("read credentials file %s: %w", file, err)
+	}
+
+	var creds Credentials
+	if err := yaml.Unmarshal(data, &creds); err != nil {
+		return Credentials{}, fmt.Errorf("parse credentials file %s: %w", file, err)
+	}
+
+	return creds, nil
+}
+
+// StoreCredentials writes the provided credentials to disk with user-only permissions.
+func StoreCredentials(creds Credentials) error {
+	file, err := credentialsFilePath()
+	if err != nil {
+		return err
+	}
+
+	if err := os.MkdirAll(filepath.Dir(file), 0700); err != nil {
+		return fmt.Errorf("create credentials directory: %w", err)
+	}
+
+	data, err := yaml.Marshal(creds)
+	if err != nil {
+		return fmt.Errorf("marshal credentials: %w", err)
+	}
+
+	if err := os.WriteFile(file, data, 0600); err != nil {
+		return fmt.Errorf("write credentials file %s: %w", file, err)
+	}
+
+	return nil
+}

core/client/grpc.go

@@ -2,19 +2,91 @@
 package client
 
 import (
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"strings"
+
 	permify "github.com/Permify/permify-go/v1"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/credentials/insecure"
 )
 
-// New initializes a new permify client
+// New initializes a new permify client with optional persisted credentials.
 func New(endpoint string) (*permify.Client, error) {
+	storedCreds, err := LoadCredentials()
+	if err != nil {
+		return nil, err
+	}
+
+	finalEndpoint := endpoint
+	if finalEndpoint == "" {
+		finalEndpoint = storedCreds.Endpoint
+	}
+	if finalEndpoint == "" {
+		return nil, errors.New("permify endpoint missing: provide an endpoint or store one in ~/.permify/credentials")
+	}
+
+	useTLS := isSecureEndpoint(finalEndpoint) || storedCreds.CertPath != "" || storedCreds.CertKey != ""
+
+	dialOptions, err := buildDialOptions(storedCreds, useTLS)
+	if err != nil {
+		return nil, err
+	}
+
 	client, err := permify.NewClient(
 		permify.Config{
-			Endpoint: endpoint,
+			Endpoint: finalEndpoint,
 		},
-		// Todo: Implement secure call with tls certificate
-		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		dialOptions...,
 	)
 	return client, err
 }
+
+func buildDialOptions(creds Credentials, useTLS bool) ([]grpc.DialOption, error) {
+	options := []grpc.DialOption{}
+
+	transportCredentials, err := buildTransportCredentials(creds, useTLS)
+	if err != nil {
+		return nil, err
+	}
+	options = append(options, grpc.WithTransportCredentials(transportCredentials))
+
+	if creds.Token != "" {
+		bearer := fmt.Sprintf("Bearer %s", creds.Token)
+		if transportCredentials.Info().SecurityProtocol != "insecure" {
+			options = append(options, grpc.WithPerRPCCredentials(secureTokenCredentials{"authorization": bearer}))
+		} else {
+			options = append(options, grpc.WithPerRPCCredentials(nonSecureTokenCredentials{"authorization": bearer}))
+		}
+	}
+
+	return options, nil
+}
+
+func buildTransportCredentials(creds Credentials, useTLS bool) (credentials.TransportCredentials, error) {
+	if creds.CertPath != "" || creds.CertKey != "" {
+		if creds.CertPath == "" || creds.CertKey == "" {
+			return nil, errors.New("both certificate path and certificate key must be provided")
+		}
+
+		certificate, err := tls.LoadX509KeyPair(creds.CertPath, creds.CertKey)
+		if err != nil {
+			return nil, fmt.Errorf("load tls key pair: %w", err)
+		}
+
+		return credentials.NewTLS(&tls.Config{Certificates: []tls.Certificate{certificate}}), nil
+	}
+
+	if useTLS {
+		return credentials.NewTLS(&tls.Config{}), nil
+	}
+
+	return insecure.NewCredentials(), nil
+}
+
+func isSecureEndpoint(endpoint string) bool {
+	value := strings.ToLower(endpoint)
+	return strings.HasPrefix(value, "https://") || strings.HasPrefix(value, "grpcs://")
+}