state machine impl

[pfitzseb]

and first iteration of a server

[aviks]

Looks like a great improvement in clarity on first glance. Might be useful to document the state machine in a diagram.

[pfitzseb]

That's the plan. I was kinda hoping to automate that though :)

[StefanKarpinski]

Would also be great to put type annotations on various fields where possible.

[pfitzseb]

This now has a few (integration) tests via a mock server and properly typed structs.

State machine:

[pfitzseb]

There's also the question whether we care about Julia versions older than 1.3 here. I can just switch to Downloads.jl if not.

[bmharsha]

We are encountering following error https://gist.github.com/bmharsha/590067fb52899d520146bd8ea3e08001#file-error1-md when we tried using PkgAuthentication.jl from this PR. Pkg server was set to pkg.juliahub.com when we encountered this error. This server requires end-users to be authenticated inorder to download packages.

[StefanKarpinski]

I made some tweaks to this and asked some questions in a PR to this PR: #9. Let's address the questions (marked with "QUESTION") and then we can figure out whether to merge my changes or not. I'm especially interested in the expiration logic. Is the key ever expiry rather than expires or expires_at or expires_in? If both expires_at and expires_in are set, I think the best thing to do is to take the minimum of expires_at and the locally computed expiration time based on the current time and expires_in. Ideally the server should be sending both expires_at and expires_in. The reason for this is so that if there's significant clock skew between the client and the server the worst case that can happen is that the client just refreshes their token every time, which is slow but works. Otherwise if there's clock skew the client could end up refreshing too infrequently, leading to auth failures.

[pfitzseb]

Left a review over at #9 that should address your questions.

Adding another toml["expires_in"] + mtime > time() check totally makes sense, yes.

[pfitzseb]

Alright, pushed a commit that addressed your concerns and improved the expires_in/expires_at situation.

[StefanKarpinski]

Looks great to me aside from the one question about @debug versus @warn.