nix: add 'nix auth fill' command

Expose the authentication framework via a git-credential 'fill'
compatible command, so credentials can be inspected and credential
helpers tested. With --require it prompts interactively when no source
provides the credential.

Assisted-by: Claude:unspecified
Co-authored-by: Eelco Dolstra <edolstra@gmail.com>

Author: Mic92

src/nix/auth-fill.md

@@ -0,0 +1,25 @@
+R""(
+
+# Examples
+
+* Get the credentials for a host:
+
+  ```console
+  # printf 'protocol=https\nhost=cache.example.org\n' | nix auth fill
+  protocol=https
+  host=cache.example.org
+  username=alice
+  password=foobar
+  ```
+
+# Description
+
+Read a [`git-credential`](https://git-scm.com/docs/git-credential)
+request from standard input, resolve it against
+[`auth-sources`](@docroot@/command-ref/conf-file.md#conf-auth-sources),
+and write the resulting fields to standard output.
+
+With `--require`, prompt via `$SSH_ASKPASS` for any field no source
+provides.
+
+)""

src/nix/auth.cc

@@ -0,0 +1,66 @@
+#include "nix/util/auth.hh"
+#include "nix/cmd/command.hh"
+
+namespace nix {
+
+struct CmdAuthFill : Command
+{
+    bool require = false;
+
+    CmdAuthFill()
+    {
+        addFlag({
+            .longName = "require",
+            .description = "Prompt for credentials if no authentication source provides them.",
+            .handler = {&require, true},
+        });
+    }
+
+    std::string description() override
+    {
+        return "obtain a user name and password from the configured authentication sources";
+    }
+
+    std::string doc() override
+    {
+        return
+#include "auth-fill.md"
+            ;
+    }
+
+    Category category() override
+    {
+        return catUtility;
+    }
+
+    void run() override
+    {
+        logger->pause();
+        auto request = auth::AuthData::parseGitAuthData(drainFD(STDIN_FILENO));
+        if (auto authData = auth::getAuthenticator()->fill(request, require))
+            writeFull(STDOUT_FILENO, authData->toGitAuthData());
+    }
+};
+
+struct CmdAuth : NixMultiCommand
+{
+    CmdAuth()
+        : NixMultiCommand("auth", RegisterCommand::getCommandsFor({"auth"}))
+    {
+    }
+
+    std::string description() override
+    {
+        return "authentication-related commands";
+    }
+
+    Category category() override
+    {
+        return catUtility;
+    }
+};
+
+static auto rCmdAuth = registerCommand<CmdAuth>("auth");
+static auto rCmdAuthFill = registerCommand2<CmdAuthFill>({"auth", "fill"});
+
+} // namespace nix

src/nix/meson.build

@@ -77,6 +77,7 @@ subdir('nix-meson-build-support/generate-header')
 nix_sources = [ config_priv_h ] + files(
   'add-to-store.cc',
   'app.cc',
+  'auth.cc',
   'build-trace.cc',
   'build.cc',
   'bundle.cc',