nix-cache-login/CHANGELOG.md

# Changelog

## [Unreleased]

Changes yet to be released are documented here.

## v0.2.1

- Fix netrc parsing for one-line entries such as `machine ... login ... password ...`
- Always write netrc entries as one line with a non-empty login (`dummy`)
- Add regression tests for one-line netrc parsing and write format

## v0.2.0

- Improve config discovery for server workflows:
  - honor `$NIX_CACHE_LOGIN_CONFIG` when `--config` is not set
  - fall back to `/etc/nix-cache-login/config.toml` when per-user config is absent
- Update `--config` help text to document config path resolution order
- Set `NIX_CACHE_LOGIN_CONFIG` in the NixOS server module so interactive commands (like `status`) use the same config as the timer service
- Install `/etc/nix-cache-login/config.toml` via the NixOS server module from `services.nix-cache-login-server.configFile`
- Add a NixOS server module VM test and wire it into flake checks

## v0.1.3

- Improve `status` for server use by detecting service-account mode from config
- Detect whether the current token is a service-account token and validate it matches configured `client_id`
- Add explicit `status` health states for service-account mode (`OK`, `WARNING`, `EXPIRED`)
- Make `status` exit non-zero for `WARNING` and `EXPIRED` states
- Add unit tests for status mode/token detection helpers

## v0.1.2

- Fix path expansion when running in systemd
- Fix bug in netrc writing
- Add nixos, home-manager, and darwin-nix modules

## v0.1.0

Initial release.

- `login` — browser-based Authorization Code + PKCE flow
- `refresh` — refresh access token using stored refresh token
- `service-account` — headless client credentials flow for servers
- `status` — decode JWT from netrc, show expiry info
- `logout` — revoke tokens and clean up netrc
- TOML config with environment variable expansion
- netrc read/write preserving other entries
- Nix flake with package, app, checks, and devShell