feat: upstream authentication improvements

[jrepp]

Summary

This PR merges two upstream authentication improvements from google/goblet that enhance token handling for multi-organization and GitHub Enterprise deployments.

Merged Upstream PRs

PR #11: Pass upstream URL to token generation

Source: #11
Author: @mdehoog

Enables custom token generation mechanisms for different upstreams. This is critical when Goblet caches repositories from different organizations where each requires its own authentication token (e.g., GitHub App installation tokens).

Changes:

• Modified TokenSource from oauth2.TokenSource to a function that accepts upstream URL parameter
• Updated all token generation calls to pass the upstream URL
• Allows per-upstream token customization

PR #10: Use token type for authentication

Source: #10
Author: @mdehoog

Respects the OAuth2 token type (Bearer vs Basic) for authentication. GitHub Enterprise expects personal access tokens to use basic auth instead of bearer tokens.

Changes:

• Changed hardcoded Bearer to use t.Type() in git fetch commands
• Combined with empty token check logic
• No impact on existing users (Bearer is the default)

Files Changed

• goblet.go - Updated TokenSource type signature
• goblet-server/main.go - Adapted to new TokenSource function signature
• managed_repository.go - Updated all token calls to:
  • Pass upstream URL parameter
  • Use dynamic token type instead of hardcoded "Bearer"
  • Maintain empty token check logic

Testing

• ✅ Merged both PRs successfully
• ✅ Resolved merge conflicts by combining both improvements
• ✅ No compilation errors

Use Cases

Multi-Organization Support:

TokenSource: func(upstreamURL *url.URL) (*oauth2.Token, error) {
    // Generate org-specific token based on URL
    org := extractOrg(upstreamURL)
    return getTokenForOrg(org)
}

GitHub Enterprise with Basic Auth:

// Token with Type() returning "Basic" will now work correctly
token := &oauth2.Token{
    AccessToken: "ghp_personaltoken",
    TokenType:   "Basic",
}

Breaking Changes

Minor API Change:

• TokenSource in ServerConfig changed from oauth2.TokenSource to func(*url.URL) (*oauth2.Token, error)
• Existing code needs to wrap TokenSource.Token() calls:

  // Before:
  TokenSource: ts,
  
  // After:
  TokenSource: func(upstreamURL *url.URL) (*oauth2.Token, error) {
      return ts.Token()
  },

Related Issues

Addresses needs for:

• Multi-organization GitHub deployments
• GitHub Enterprise compatibility
• Custom token generation per upstream

---

Credit: Both features developed by @mdehoog
Upstream PRs: #11, #10

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[jrepp]

Apologies, this was created on the wrong repository. Closing.