feat: add Red Hat SSO support to pull images using their checksum

.prettierignore

@@ -0,0 +1 @@
+src/rh-api/gen/

eslint.config.mjs

@@ -55,6 +55,7 @@ export default [
       '**/coverage/',
       'extensions/*.ts',
       'scripts/**',
+      'src/rh-api/gen/*',
     ],
   },
   js.configs.recommended,

package.json

@@ -71,7 +71,8 @@
     }
   },
   "scripts": {
-    "build": "vite build",
+    "generate:subscription-v1": "npx openapi-typescript src/rh-api/subscription-schema-v1.json -o src/rh-api/gen/subscription-v1.d.ts",
+    "build": "pnpm generate:subscription-v1 && vite build",
     "test": "vitest run --coverage --passWithNoTests",
     "test:watch": "vitest watch --coverage --passWithNoTests",
     "format:check": "prettier --check \"src/**/*.ts\"",
@@ -86,6 +87,7 @@
     "@crc-org/macadam.js": "0.0.1-202504301306-5ade487",
     "@podman-desktop/api": "1.18.0",
     "compare-versions": "^6.1.1",
+    "openapi-fetch": "^0.13.5",
     "semver": "^7.7.1",
     "ssh2": "^1.16.0"
   },

src/authentication.ts

@@ -0,0 +1,38 @@
+/**********************************************************************
+ * Copyright (C) 2025 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ ***********************************************************************/
+
+import * as extensionApi from '@podman-desktop/api';
+
+import { SubscriptionManagerClientV1 } from './rh-api/rh-api-sm';
+
+export async function initAuthentication(): Promise<SubscriptionManagerClientV1> {
+  const currentSession = await extensionApi.authentication.getSession(
+    'redhat.authentication-provider',
+    ['api.iam.registry_service_accounts', 'api.console'],
+    { createIfNone: true },
+  );
+
+  if (!currentSession) {
+    throw new Error('unable to connect to Red Hat SSO, please configure the RH authentication');
+  } else {
+    return new SubscriptionManagerClientV1({
+      BASE: 'https://api.access.redhat.com/management/v1/',
+      TOKEN: currentSession.accessToken,
+    });
+  }
+}