An idea to handle credentials in CLI

• In the app, click "Copy credential", which will add an encrypted version of the credential to your clipboard. Encryption method TBD - we probably need a key signing pair really - but just for the sake of argument, let's say the credential is a base64 encoded JSON string
• Save the credential to your environment (encoded) as an env var. Like MSF_DHIS2=abcd...
• Edit the workflow.yaml and put in the env var name instead of the credential UUID (with a dollar, so credential: $MSF_DHIS2

Problems:

• I don't like any solution which requires a manual edit to sync artifacts
• It's still quite manual as you have to do this for each credential
• Users will end up with a very messy env
• It's on us to ensure that the encryption method is really tight

Ach, I think a credential store in the CLI feels like a better solution all around.

Give the CLI your access token and lightning endpoint, and it'll call lightning to download credentials from the UUID in the local project file. It could either save credentials into some secure encrypted local storage (so you run like openfn pull --credentials), or it'll just download them in memory and discard them (meaning you need a live internet connection to run)

Start by reviewing the CLI entry points and the local project workflow configuration that supplies credential UUIDs. Compare the proposed openfn pull --credentials flow with environment variables and in-memory downloads, then clarify the storage, encryption, and access-token requirements. Done means the credential-store behavior and its integration with workflow.yaml are defined and implemented.