Add HTTP basic auth support for private repositories

[MrPunyapal]

What

Adds optional HTTP Basic authentication so private repositories can be fetched over smart HTTPS.

• New Credentials value object: username (default x-access-token) plus token, with make() and authorizationHeader().
• RemoteRepository accepts credentials through a new optional constructor parameter or the fluent withCredentials(). When set, the Authorization header is sent on both requests: the GET info/refs advertisement and the POST git-upload-pack call.
• First request still goes out unauthenticated. On 401 the request is retried exactly once with the header. A second 401 throws the new AuthenticationFailedException (message includes the repository URL, never the token).
• Without credentials, behavior is unchanged; the 401 error message now hints that the repository may be private.

Why

DocSmith needs to sync documentation from private repositories. The client already speaks plain smart HTTPS, and Basic auth with a personal access token is the standard way to authenticate that transport on GitHub, GitLab, Bitbucket, and Gitea. Keeping auth at this layer keeps docsmith free of transport details.

Tests

The offline wire fixture gained /private.git endpoints that issue a 401 challenge unless the expected Basic header is present.

• Authorized retry succeeds end to end through pack fetch.
• Wrong token fails with AuthenticationFailedException.
• Missing credentials keep the existing failure path with the improved message.
• Exact Basic base64(user:token) header value is asserted against the fixture server.

pint, phpstan, and pest all pass.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 27a5f4e5-dd1c-449d-a9d7-03b5ba8935d7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}