transport: remove SetAuth, fixes #206 (#210)

* remove SetAuth functions, implement at NewUploadPackSession/NewReceivePackSession level.
* propagate transport.Auth from Fetch/Pull/Clone options to the transport API.

22 files changed, 116 insertions, 127 deletions

diff --git a/options.go b/options.go
index 95584c2..cb0859b 100644
--- a/options.go
+++ b/options.go
@@ -22,7 +22,7 @@ var (
 type CloneOptions struct {
 	// The (possibly remote) repository URL to clone from
 	URL string
-	// Auth credentials, if required, to uses with the remote repository
+	// Auth credentials, if required, to use with the remote repository
 	Auth transport.AuthMethod
 	// Name of the remote to be added, by default `origin`
 	RemoteName string
@@ -61,6 +61,8 @@ type PullOptions struct {
 	SingleBranch bool
 	// Limit fetching to the specified number of commits.
 	Depth int
+	// Auth credentials, if required, to use with the remote repository
+	Auth transport.AuthMethod
 }
 
 // Validate validate the fields and set the default values.
@@ -84,6 +86,8 @@ type FetchOptions struct {
 	// Depth limit fetching to the specified number of commits from the tip of
 	// each remote branch history.
 	Depth int
+	// Auth credentials, if required, to use with the remote repository
+	Auth transport.AuthMethod
 }
 
 // Validate validate the fields and set the default values
@@ -108,6 +112,8 @@ type PushOptions struct {
 	// RefSpecs specify what destination ref to update with what source
 	// object. A refspec with empty src can be used to delete a reference.
 	RefSpecs []config.RefSpec
+	// Auth credentials, if required, to use with the remote repository
+	Auth transport.AuthMethod
 }
 
 // Validate validate the fields and set the default values
diff --git a/plumbing/transport/client/client_test.go b/plumbing/transport/client/client_test.go
index 9af70b1..2b2e0ff 100644
--- a/plumbing/transport/client/client_test.go
+++ b/plumbing/transport/client/client_test.go
@@ -58,12 +58,12 @@ type dummyClient struct {
 	*http.Client
 }
 
-func (*dummyClient) NewUploadPackSession(transport.Endpoint) (
+func (*dummyClient) NewUploadPackSession(transport.Endpoint, transport.AuthMethod) (
 	transport.UploadPackSession, error) {
 	return nil, nil
 }
 
-func (*dummyClient) NewReceivePackSession(transport.Endpoint) (
+func (*dummyClient) NewReceivePackSession(transport.Endpoint, transport.AuthMethod) (
 	transport.ReceivePackSession, error) {
 	return nil, nil
 }
diff --git a/plumbing/transport/common.go b/plumbing/transport/common.go
index 00e8a30..3fcdef2 100644
--- a/plumbing/transport/common.go
+++ b/plumbing/transport/common.go
@@ -30,6 +30,7 @@ var (
 	ErrAuthorizationRequired  = errors.New("authorization required")
 	ErrEmptyUploadPackRequest = errors.New("empty git-upload-pack given")
 	ErrInvalidAuthMethod      = errors.New("invalid auth method")
+	ErrAlreadyConnected       = errors.New("session already established")
 )
 
 const (
@@ -41,9 +42,9 @@ const (
 // It is implemented both by the client and the server, making this a RPC.
 type Transport interface {
 	// NewUploadPackSession starts a git-upload-pack session for an endpoint.
-	NewUploadPackSession(Endpoint) (UploadPackSession, error)
+	NewUploadPackSession(Endpoint, AuthMethod) (UploadPackSession, error)
 	// NewReceivePackSession starts a git-receive-pack session for an endpoint.
-	NewReceivePackSession(Endpoint) (ReceivePackSession, error)
+	NewReceivePackSession(Endpoint, AuthMethod) (ReceivePackSession, error)
 }
 
 type Session interface {
@@ -52,8 +53,6 @@ type Session interface {
 	// If the repository does not exist, returns ErrRepositoryNotFound.
 	// If the repository exists, but is empty, returns ErrEmptyRemoteRepository.
 	AdvertisedReferences() (*packp.AdvRefs, error)
-	//TODO: Move to Client level.
-	SetAuth(auth AuthMethod) error
 	io.Closer
 }
 
diff --git a/plumbing/transport/file/client.go b/plumbing/transport/file/client.go
index 5484009..e3f7681 100644
--- a/plumbing/transport/file/client.go
+++ b/plumbing/transport/file/client.go
@@ -28,13 +28,18 @@ func NewClient(uploadPackBin, receivePackBin string) transport.Transport {
 	})
 }
 
-func (r *runner) Command(cmd string, ep transport.Endpoint) (common.Command, error) {
+func (r *runner) Command(cmd string, ep transport.Endpoint, auth transport.AuthMethod) (common.Command, error) {
 	switch cmd {
 	case transport.UploadPackServiceName:
 		cmd = r.UploadPackBin
 	case transport.ReceivePackServiceName:
 		cmd = r.ReceivePackBin
 	}
+
+	if _, err := exec.LookPath(cmd); err != nil {
+		return nil, err
+	}
+
 	return &command{cmd: exec.Command(cmd, ep.Path)}, nil
 }
 
@@ -43,14 +48,6 @@ type command struct {
 	closed bool
 }
 
-func (c *command) SetAuth(auth transport.AuthMethod) error {
-	if auth != nil {
-		return transport.ErrInvalidAuthMethod
-	}
-
-	return nil
-}
-
 func (c *command) Start() error {
 	return c.cmd.Start()
 }
diff --git a/plumbing/transport/file/receive_pack_test.go b/plumbing/transport/file/receive_pack_test.go
index c07d4ed..1858492 100644
--- a/plumbing/transport/file/receive_pack_test.go
+++ b/plumbing/transport/file/receive_pack_test.go
@@ -46,7 +46,7 @@ func (s *ReceivePackSuite) TestCommandNoOutput(c *C) {
 	}
 
 	client := NewClient("true", "true")
-	session, err := client.NewReceivePackSession(s.Endpoint)
+	session, err := client.NewReceivePackSession(s.Endpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	ar, err := session.AdvertisedReferences()
 	c.Assert(err, IsNil)
@@ -59,7 +59,7 @@ func (s *ReceivePackSuite) TestMalformedInputNoErrors(c *C) {
 	}
 
 	client := NewClient("yes", "yes")
-	session, err := client.NewReceivePackSession(s.Endpoint)
+	session, err := client.NewReceivePackSession(s.Endpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	ar, err := session.AdvertisedReferences()
 	c.Assert(err, NotNil)
@@ -69,7 +69,7 @@ func (s *ReceivePackSuite) TestMalformedInputNoErrors(c *C) {
 func (s *ReceivePackSuite) TestNonExistentCommand(c *C) {
 	cmd := "/non-existent-git"
 	client := NewClient(cmd, cmd)
-	session, err := client.NewReceivePackSession(s.Endpoint)
+	session, err := client.NewReceivePackSession(s.Endpoint, s.EmptyAuth)
 	c.Assert(err, ErrorMatches, ".*no such file or directory.*")
 	c.Assert(session, IsNil)
 }
diff --git a/plumbing/transport/file/server.go b/plumbing/transport/file/server.go
index d83d5d9..74085c2 100644
--- a/plumbing/transport/file/server.go
+++ b/plumbing/transport/file/server.go
@@ -19,7 +19,8 @@ func ServeUploadPack(path string) error {
 		return err
 	}
 
-	s, err := server.DefaultServer.NewUploadPackSession(ep)
+	// TODO: define and implement a server-side AuthMethod
+	s, err := server.DefaultServer.NewUploadPackSession(ep, nil)
 	if err != nil {
 		return fmt.Errorf("error creating session: %s", err)
 	}
@@ -36,7 +37,8 @@ func ServeReceivePack(path string) error {
 		return err
 	}
 
-	s, err := server.DefaultServer.NewReceivePackSession(ep)
+	// TODO: define and implement a server-side AuthMethod
+	s, err := server.DefaultServer.NewReceivePackSession(ep, nil)
 	if err != nil {
 		return fmt.Errorf("error creating session: %s", err)
 	}
diff --git a/plumbing/transport/file/upload_pack_test.go b/plumbing/transport/file/upload_pack_test.go
index de232c4..d9adee2 100644
--- a/plumbing/transport/file/upload_pack_test.go
+++ b/plumbing/transport/file/upload_pack_test.go
@@ -52,7 +52,7 @@ func (s *UploadPackSuite) TestCommandNoOutput(c *C) {
 	}
 
 	client := NewClient("true", "true")
-	session, err := client.NewUploadPackSession(s.Endpoint)
+	session, err := client.NewUploadPackSession(s.Endpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	ar, err := session.AdvertisedReferences()
 	c.Assert(err, IsNil)
@@ -65,7 +65,7 @@ func (s *UploadPackSuite) TestMalformedInputNoErrors(c *C) {
 	}
 
 	client := NewClient("yes", "yes")
-	session, err := client.NewUploadPackSession(s.Endpoint)
+	session, err := client.NewUploadPackSession(s.Endpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	ar, err := session.AdvertisedReferences()
 	c.Assert(err, NotNil)
@@ -75,7 +75,7 @@ func (s *UploadPackSuite) TestMalformedInputNoErrors(c *C) {
 func (s *UploadPackSuite) TestNonExistentCommand(c *C) {
 	cmd := "/non-existent-git"
 	client := NewClient(cmd, cmd)
-	session, err := client.NewUploadPackSession(s.Endpoint)
+	session, err := client.NewUploadPackSession(s.Endpoint, s.EmptyAuth)
 	c.Assert(err, ErrorMatches, ".*no such file or directory.*")
 	c.Assert(session, IsNil)
 }
diff --git a/plumbing/transport/git/common.go b/plumbing/transport/git/common.go
index 8c35c19..5eae22a 100644
--- a/plumbing/transport/git/common.go
+++ b/plumbing/transport/git/common.go
@@ -1,7 +1,6 @@
 package git
 
 import (
-	"errors"
 	"fmt"
 	"io"
 	"net"
@@ -13,22 +12,21 @@ import (
 	"gopkg.in/src-d/go-git.v4/utils/ioutil"
 )
 
-var (
-	errAlreadyConnected = errors.New("tcp connection already connected")
-)
-
 // DefaultClient is the default git client.
 var DefaultClient = common.NewClient(&runner{})
 
 type runner struct{}
 
 // Command returns a new Command for the given cmd in the given Endpoint
-func (r *runner) Command(cmd string, ep transport.Endpoint) (common.Command, error) {
+func (r *runner) Command(cmd string, ep transport.Endpoint, auth transport.AuthMethod) (common.Command, error) {
+	// auth not allowed since git protocol doesn't support authentication
+	if auth != nil {
+		return nil, transport.ErrInvalidAuthMethod
+	}
 	c := &command{command: cmd, endpoint: ep}
 	if err := c.connect(); err != nil {
 		return nil, err
 	}
-
 	return c, nil
 }
 
@@ -39,11 +37,6 @@ type command struct {
 	endpoint  transport.Endpoint
 }
 
-// SetAuth cannot be called since git protocol doesn't support authentication
-func (c *command) SetAuth(auth transport.AuthMethod) error {
-	return transport.ErrInvalidAuthMethod
-}
-
 // Start executes the command sending the required message to the TCP connection
 func (c *command) Start() error {
 	cmd := endpointToCommand(c.command, c.endpoint)
@@ -54,7 +47,7 @@ func (c *command) Start() error {
 
 func (c *command) connect() error {
 	if c.connected {
-		return errAlreadyConnected
+		return transport.ErrAlreadyConnected
 	}
 
 	var err error
diff --git a/plumbing/transport/http/common.go b/plumbing/transport/http/common.go
index 957fd07..a26cf0c 100644
--- a/plumbing/transport/http/common.go
+++ b/plumbing/transport/http/common.go
@@ -35,16 +35,16 @@ func NewClient(c *http.Client) transport.Transport {
 	}
 }
 
-func (c *client) NewUploadPackSession(ep transport.Endpoint) (
+func (c *client) NewUploadPackSession(ep transport.Endpoint, auth transport.AuthMethod) (
 	transport.UploadPackSession, error) {
 
-	return newUploadPackSession(c.c, ep), nil
+	return newUploadPackSession(c.c, ep, auth)
 }
 
-func (c *client) NewReceivePackSession(ep transport.Endpoint) (
+func (c *client) NewReceivePackSession(ep transport.Endpoint, auth transport.AuthMethod) (
 	transport.ReceivePackSession, error) {
 
-	return newReceivePackSession(c.c, ep), nil
+	return newReceivePackSession(c.c, ep, auth)
 }
 
 type session struct {
@@ -54,16 +54,6 @@ type session struct {
 	advRefs  *packp.AdvRefs
 }
 
-func (s *session) SetAuth(auth transport.AuthMethod) error {
-	a, ok := auth.(AuthMethod)
-	if !ok {
-		return transport.ErrInvalidAuthMethod
-	}
-
-	s.auth = a
-	return nil
-}
-
 func (*session) Close() error {
 	return nil
 }
diff --git a/plumbing/transport/http/common_test.go b/plumbing/transport/http/common_test.go
index 217999d..1fd0dd5 100644
--- a/plumbing/transport/http/common_test.go
+++ b/plumbing/transport/http/common_test.go
@@ -13,7 +13,8 @@ import (
 func Test(t *testing.T) { TestingT(t) }
 
 type ClientSuite struct {
-	Endpoint transport.Endpoint
+	Endpoint  transport.Endpoint
+	EmptyAuth transport.AuthMethod
 }
 
 var _ = Suite(&ClientSuite{})
@@ -76,9 +77,8 @@ func (s *ClientSuite) testNewHTTPError(c *C, code int, msg string) {
 
 func (s *ClientSuite) TestSetAuth(c *C) {
 	auth := &BasicAuth{}
-	r, err := DefaultClient.NewUploadPackSession(s.Endpoint)
+	r, err := DefaultClient.NewUploadPackSession(s.Endpoint, auth)
 	c.Assert(err, IsNil)
-	r.SetAuth(auth)
 	c.Assert(auth, Equals, r.(*upSession).auth)
 }
 
@@ -88,7 +88,6 @@ func (*mockAuth) Name() string   { return "" }
 func (*mockAuth) String() string { return "" }
 
 func (s *ClientSuite) TestSetAuthWrongType(c *C) {
-	r, err := DefaultClient.NewUploadPackSession(s.Endpoint)
-	c.Assert(err, IsNil)
-	c.Assert(r.SetAuth(&mockAuth{}), Equals, transport.ErrInvalidAuthMethod)
+	_, err := DefaultClient.NewUploadPackSession(s.Endpoint, &mockAuth{})
+	c.Assert(err, Equals, transport.ErrInvalidAuthMethod)
 }
diff --git a/plumbing/transport/http/receive_pack.go b/plumbing/transport/http/receive_pack.go
index a8384c7..7a37049 100644
--- a/plumbing/transport/http/receive_pack.go
+++ b/plumbing/transport/http/receive_pack.go
@@ -14,8 +14,8 @@ type rpSession struct {
 	*session
 }
 
-func newReceivePackSession(c *http.Client, ep transport.Endpoint) transport.ReceivePackSession {
-	return &rpSession{&session{}}
+func newReceivePackSession(c *http.Client, ep transport.Endpoint, auth transport.AuthMethod) (transport.ReceivePackSession, error) {
+	return &rpSession{&session{}}, nil
 }
 
 func (s *rpSession) AdvertisedReferences() (*packp.AdvRefs, error) {
diff --git a/plumbing/transport/http/upload_pack.go b/plumbing/transport/http/upload_pack.go
index 26257f5..e828857 100644
--- a/plumbing/transport/http/upload_pack.go
+++ b/plumbing/transport/http/upload_pack.go
@@ -19,16 +19,22 @@ type upSession struct {
 	*session
 }
 
-func newUploadPackSession(c *http.Client,
-	ep transport.Endpoint) transport.UploadPackSession {
+func newUploadPackSession(c *http.Client, ep transport.Endpoint, auth transport.AuthMethod) (transport.UploadPackSession, error) {
+	s := &session{
+		auth:     basicAuthFromEndpoint(ep),
+		client:   c,
+		endpoint: ep,
+	}
+	if auth != nil {
+		a, ok := auth.(AuthMethod)
+		if !ok {
+			return nil, transport.ErrInvalidAuthMethod
+		}
 
-	return &upSession{
-		session: &session{
-			auth:     basicAuthFromEndpoint(ep),
-			client:   c,
-			endpoint: ep,
-		},
+		s.auth = a
 	}
+
+	return &upSession{session: s}, nil
 }
 
 func (s *upSession) AdvertisedReferences() (*packp.AdvRefs, error) {
diff --git a/plumbing/transport/http/upload_pack_test.go b/plumbing/transport/http/upload_pack_test.go
index d3e4989..13b7f75 100644
--- a/plumbing/transport/http/upload_pack_test.go
+++ b/plumbing/transport/http/upload_pack_test.go
@@ -35,7 +35,7 @@ func (s *UploadPackSuite) SetUpSuite(c *C) {
 
 // Overwritten, different behaviour for HTTP.
 func (s *UploadPackSuite) TestAdvertisedReferencesNotExists(c *C) {
-	r, err := s.Client.NewUploadPackSession(s.NonExistentEndpoint)
+	r, err := s.Client.NewUploadPackSession(s.NonExistentEndpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	info, err := r.AdvertisedReferences()
 	c.Assert(err, Equals, transport.ErrAuthorizationRequired)
diff --git a/plumbing/transport/internal/common/common.go b/plumbing/transport/internal/common/common.go
index 831c4d7..2285e26 100644
--- a/plumbing/transport/internal/common/common.go
+++ b/plumbing/transport/internal/common/common.go
@@ -37,15 +37,13 @@ type Commander interface {
 	// error should be returned if the endpoint is not supported or the
 	// command cannot be created (e.g. binary does not exist, connection
 	// cannot be established).
-	Command(cmd string, ep transport.Endpoint) (Command, error)
+	Command(cmd string, ep transport.Endpoint, auth transport.AuthMethod) (Command, error)
 }
 
 // Command is used for a single command execution.
 // This interface is modeled after exec.Cmd and ssh.Session in the standard
 // library.
 type Command interface {
-	// SetAuth sets the authentication method.
-	SetAuth(transport.AuthMethod) error
 	// StderrPipe returns a pipe that will be connected to the command's
 	// standard error when the command starts. It should not be called after
 	// Start.
@@ -82,17 +80,17 @@ func NewClient(runner Commander) transport.Transport {
 }
 
 // NewUploadPackSession creates a new UploadPackSession.
-func (c *client) NewUploadPackSession(ep transport.Endpoint) (
+func (c *client) NewUploadPackSession(ep transport.Endpoint, auth transport.AuthMethod) (
 	transport.UploadPackSession, error) {
 
-	return c.newSession(transport.UploadPackServiceName, ep)
+	return c.newSession(transport.UploadPackServiceName, ep, auth)
 }
 
 // NewReceivePackSession creates a new ReceivePackSession.
-func (c *client) NewReceivePackSession(ep transport.Endpoint) (
+func (c *client) NewReceivePackSession(ep transport.Endpoint, auth transport.AuthMethod) (
 	transport.ReceivePackSession, error) {
 
-	return c.newSession(transport.ReceivePackServiceName, ep)
+	return c.newSession(transport.ReceivePackServiceName, ep, auth)
 }
 
 type session struct {
@@ -107,8 +105,8 @@ type session struct {
 	errLines      chan string
 }
 
-func (c *client) newSession(s string, ep transport.Endpoint) (*session, error) {
-	cmd, err := c.cmdr.Command(s, ep)
+func (c *client) newSession(s string, ep transport.Endpoint, auth transport.AuthMethod) (*session, error) {
+	cmd, err := c.cmdr.Command(s, ep, auth)
 	if err != nil {
 		return nil, err
 	}
@@ -158,11 +156,6 @@ func (c *client) listenErrors(r io.Reader) chan string {
 	return errLines
 }
 
-// SetAuth delegates to the command's SetAuth.
-func (s *session) SetAuth(auth transport.AuthMethod) error {
-	return s.Command.SetAuth(auth)
-}
-
 // AdvertisedReferences retrieves the advertised references from the server.
 func (s *session) AdvertisedReferences() (*packp.AdvRefs, error) {
 	if s.advRefs != nil {
diff --git a/plumbing/transport/server/receive_pack_test.go b/plumbing/transport/server/receive_pack_test.go
index 2c4036a..73ba60b 100644
--- a/plumbing/transport/server/receive_pack_test.go
+++ b/plumbing/transport/server/receive_pack_test.go
@@ -34,7 +34,7 @@ func (s *ReceivePackSuite) TestSendPackAddDeleteReference(c *C) {
 
 // Overwritten, server returns error earlier.
 func (s *ReceivePackSuite) TestAdvertisedReferencesNotExists(c *C) {
-	r, err := s.Client.NewReceivePackSession(s.NonExistentEndpoint)
+	r, err := s.Client.NewReceivePackSession(s.NonExistentEndpoint, s.EmptyAuth)
 	c.Assert(err, Equals, transport.ErrRepositoryNotFound)
 	c.Assert(r, IsNil)
 }
diff --git a/plumbing/transport/server/server.go b/plumbing/transport/server/server.go
index 6787e9d..542b439 100644
--- a/plumbing/transport/server/server.go
+++ b/plumbing/transport/server/server.go
@@ -30,7 +30,7 @@ func NewServer(loader Loader) transport.Transport {
 	return &server{loader, &handler{}}
 }
 
-func (s *server) NewUploadPackSession(ep transport.Endpoint) (transport.UploadPackSession, error) {
+func (s *server) NewUploadPackSession(ep transport.Endpoint, auth transport.AuthMethod) (transport.UploadPackSession, error) {
 	sto, err := s.loader.Load(ep)
 	if err != nil {
 		return nil, err
@@ -39,7 +39,7 @@ func (s *server) NewUploadPackSession(ep transport.Endpoint) (transport.UploadPa
 	return s.handler.NewUploadPackSession(sto)
 }
 
-func (s *server) NewReceivePackSession(ep transport.Endpoint) (transport.ReceivePackSession, error) {
+func (s *server) NewReceivePackSession(ep transport.Endpoint, auth transport.AuthMethod) (transport.ReceivePackSession, error) {
 	sto, err := s.loader.Load(ep)
 	if err != nil {
 		return nil, err
diff --git a/plumbing/transport/server/upload_pack_test.go b/plumbing/transport/server/upload_pack_test.go
index 8919e8e..137f887 100644
--- a/plumbing/transport/server/upload_pack_test.go
+++ b/plumbing/transport/server/upload_pack_test.go
@@ -25,7 +25,7 @@ func (s *UploadPackSuite) SetUpTest(c *C) {
 
 // Overwritten, it's not an error in server-side.
 func (s *UploadPackSuite) TestAdvertisedReferencesEmpty(c *C) {
-	r, err := s.Client.NewUploadPackSession(s.EmptyEndpoint)
+	r, err := s.Client.NewUploadPackSession(s.EmptyEndpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	ar, err := r.AdvertisedReferences()
 	c.Assert(err, IsNil)
@@ -34,7 +34,7 @@ func (s *UploadPackSuite) TestAdvertisedReferencesEmpty(c *C) {
 
 // Overwritten, server returns error earlier.
 func (s *UploadPackSuite) TestAdvertisedReferencesNotExists(c *C) {
-	r, err := s.Client.NewUploadPackSession(s.NonExistentEndpoint)
+	r, err := s.Client.NewUploadPackSession(s.NonExistentEndpoint, s.EmptyAuth)
 	c.Assert(err, Equals, transport.ErrRepositoryNotFound)
 	c.Assert(r, IsNil)
 }
diff --git a/plumbing/transport/ssh/common.go b/plumbing/transport/ssh/common.go
index 03d2fe1..7d72d26 100644
--- a/plumbing/transport/ssh/common.go
+++ b/plumbing/transport/ssh/common.go
@@ -1,7 +1,6 @@
 package ssh
 
 import (
-	"errors"
 	"fmt"
 	"strings"
 
@@ -11,21 +10,20 @@ import (
 	"golang.org/x/crypto/ssh"
 )
 
-var (
-	errAlreadyConnected = errors.New("ssh session already created")
-)
-
 // DefaultClient is the default SSH client.
 var DefaultClient = common.NewClient(&runner{})
 
 type runner struct{}
 
-func (r *runner) Command(cmd string, ep transport.Endpoint) (common.Command, error) {
+func (r *runner) Command(cmd string, ep transport.Endpoint, auth transport.AuthMethod) (common.Command, error) {
 	c := &command{command: cmd, endpoint: ep}
+	if auth != nil {
+		c.setAuth(auth)
+	}
+
 	if err := c.connect(); err != nil {
 		return nil, err
 	}
-
 	return c, nil
 }
 
@@ -38,7 +36,7 @@ type command struct {
 	auth      AuthMethod
 }
 
-func (c *command) SetAuth(auth transport.AuthMethod) error {
+func (c *command) setAuth(auth transport.AuthMethod) error {
 	a, ok := auth.(AuthMethod)
 	if !ok {
 		return transport.ErrInvalidAuthMethod
@@ -73,11 +71,13 @@ func (c *command) Close() error {
 // environment var.
 func (c *command) connect() error {
 	if c.connected {
-		return errAlreadyConnected
+		return transport.ErrAlreadyConnected
 	}
 
-	if err := c.setAuthFromEndpoint(); err != nil {
-		return err
+	if c.auth == nil {
+		if err := c.setAuthFromEndpoint(); err != nil {
+			return err
+		}
 	}
 
 	var err error
diff --git a/plumbing/transport/test/receive_pack.go b/plumbing/transport/test/receive_pack.go
index e798154..107e733 100644
--- a/plumbing/transport/test/receive_pack.go
+++ b/plumbing/transport/test/receive_pack.go
@@ -23,11 +23,12 @@ type ReceivePackSuite struct {
 	Endpoint            transport.Endpoint
 	EmptyEndpoint       transport.Endpoint
 	NonExistentEndpoint transport.Endpoint
+	EmptyAuth           transport.AuthMethod
 	Client              transport.Transport
 }
 
 func (s *ReceivePackSuite) TestAdvertisedReferencesEmpty(c *C) {
-	r, err := s.Client.NewReceivePackSession(s.EmptyEndpoint)
+	r, err := s.Client.NewReceivePackSession(s.EmptyEndpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	defer func() { c.Assert(r.Close(), IsNil) }()
 	ar, err := r.AdvertisedReferences()
@@ -36,14 +37,14 @@ func (s *ReceivePackSuite) TestAdvertisedReferencesEmpty(c *C) {
 }
 
 func (s *ReceivePackSuite) TestAdvertisedReferencesNotExists(c *C) {
-	r, err := s.Client.NewReceivePackSession(s.NonExistentEndpoint)
+	r, err := s.Client.NewReceivePackSession(s.NonExistentEndpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	defer func() { c.Assert(r.Close(), IsNil) }()
 	ar, err := r.AdvertisedReferences()
 	c.Assert(err, Equals, transport.ErrRepositoryNotFound)
 	c.Assert(ar, IsNil)
 
-	r, err = s.Client.NewReceivePackSession(s.NonExistentEndpoint)
+	r, err = s.Client.NewReceivePackSession(s.NonExistentEndpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	req := packp.NewReferenceUpdateRequest()
 	req.Commands = []*packp.Command{
@@ -56,7 +57,7 @@ func (s *ReceivePackSuite) TestAdvertisedReferencesNotExists(c *C) {
 }
 
 func (s *ReceivePackSuite) TestCallAdvertisedReferenceTwice(c *C) {
-	r, err := s.Client.NewReceivePackSession(s.Endpoint)
+	r, err := s.Client.NewReceivePackSession(s.Endpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	ar1, err := r.AdvertisedReferences()
 	c.Assert(err, IsNil)
@@ -67,7 +68,7 @@ func (s *ReceivePackSuite) TestCallAdvertisedReferenceTwice(c *C) {
 }
 
 func (s *ReceivePackSuite) TestDefaultBranch(c *C) {
-	r, err := s.Client.NewReceivePackSession(s.Endpoint)
+	r, err := s.Client.NewReceivePackSession(s.Endpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	defer func() { c.Assert(r.Close(), IsNil) }()
 
@@ -79,7 +80,7 @@ func (s *ReceivePackSuite) TestDefaultBranch(c *C) {
 }
 
 func (s *ReceivePackSuite) TestCapabilities(c *C) {
-	r, err := s.Client.NewReceivePackSession(s.Endpoint)
+	r, err := s.Client.NewReceivePackSession(s.Endpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	defer func() { c.Assert(r.Close(), IsNil) }()
 
@@ -196,7 +197,7 @@ func (s *ReceivePackSuite) receivePackNoCheck(c *C, ep transport.Endpoint,
 		ep.String(), url, callAdvertisedReferences,
 	)
 
-	r, err := s.Client.NewReceivePackSession(ep)
+	r, err := s.Client.NewReceivePackSession(ep, s.EmptyAuth)
 	c.Assert(err, IsNil, comment)
 	defer func() { c.Assert(r.Close(), IsNil, comment) }()
 
@@ -247,7 +248,7 @@ func (s *ReceivePackSuite) checkRemoteHead(c *C, ep transport.Endpoint, head plu
 func (s *ReceivePackSuite) checkRemoteReference(c *C, ep transport.Endpoint,
 	refName string, head plumbing.Hash) {
 
-	r, err := s.Client.NewUploadPackSession(ep)
+	r, err := s.Client.NewUploadPackSession(ep, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	defer func() { c.Assert(r.Close(), IsNil) }()
 	ar, err := r.AdvertisedReferences()
@@ -267,7 +268,7 @@ func (s *ReceivePackSuite) TestSendPackAddDeleteReference(c *C) {
 }
 
 func (s *ReceivePackSuite) testSendPackAddReference(c *C) {
-	r, err := s.Client.NewReceivePackSession(s.Endpoint)
+	r, err := s.Client.NewReceivePackSession(s.Endpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	defer func() { c.Assert(r.Close(), IsNil) }()
 
@@ -289,7 +290,7 @@ func (s *ReceivePackSuite) testSendPackAddReference(c *C) {
 }
 
 func (s *ReceivePackSuite) testSendPackDeleteReference(c *C) {
-	r, err := s.Client.NewReceivePackSession(s.Endpoint)
+	r, err := s.Client.NewReceivePackSession(s.Endpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	defer func() { c.Assert(r.Close(), IsNil) }()
 
diff --git a/plumbing/transport/test/upload_pack.go b/plumbing/transport/test/upload_pack.go
index 5af4b29..c1a9050 100644
--- a/plumbing/transport/test/upload_pack.go
+++ b/plumbing/transport/test/upload_pack.go
@@ -22,11 +22,12 @@ type UploadPackSuite struct {
 	Endpoint            transport.Endpoint
 	EmptyEndpoint       transport.Endpoint
 	NonExistentEndpoint transport.Endpoint
+	EmptyAuth           transport.AuthMethod
 	Client              transport.Transport
 }
 
 func (s *UploadPackSuite) TestAdvertisedReferencesEmpty(c *C) {
-	r, err := s.Client.NewUploadPackSession(s.EmptyEndpoint)
+	r, err := s.Client.NewUploadPackSession(s.EmptyEndpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	ar, err := r.AdvertisedReferences()
 	c.Assert(err, Equals, transport.ErrEmptyRemoteRepository)
@@ -34,13 +35,13 @@ func (s *UploadPackSuite) TestAdvertisedReferencesEmpty(c *C) {
 }
 
 func (s *UploadPackSuite) TestAdvertisedReferencesNotExists(c *C) {
-	r, err := s.Client.NewUploadPackSession(s.NonExistentEndpoint)
+	r, err := s.Client.NewUploadPackSession(s.NonExistentEndpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	ar, err := r.AdvertisedReferences()
 	c.Assert(err, Equals, transport.ErrRepositoryNotFound)
 	c.Assert(ar, IsNil)
 
-	r, err = s.Client.NewUploadPackSession(s.NonExistentEndpoint)
+	r, err = s.Client.NewUploadPackSession(s.NonExistentEndpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	req := packp.NewUploadPackRequest()
 	req.Wants = append(req.Wants, plumbing.NewHash("6ecf0ef2c2dffb796033e5a02219af86ec6584e5"))
@@ -50,7 +51,7 @@ func (s *UploadPackSuite) TestAdvertisedReferencesNotExists(c *C) {
 }
 
 func (s *UploadPackSuite) TestCallAdvertisedReferenceTwice(c *C) {
-	r, err := s.Client.NewUploadPackSession(s.Endpoint)
+	r, err := s.Client.NewUploadPackSession(s.Endpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	ar1, err := r.AdvertisedReferences()
 	c.Assert(err, IsNil)
@@ -61,7 +62,7 @@ func (s *UploadPackSuite) TestCallAdvertisedReferenceTwice(c *C) {
 }
 
 func (s *UploadPackSuite) TestDefaultBranch(c *C) {
-	r, err := s.Client.NewUploadPackSession(s.Endpoint)
+	r, err := s.Client.NewUploadPackSession(s.Endpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	defer func() { c.Assert(r.Close(), IsNil) }()
 
@@ -73,7 +74,7 @@ func (s *UploadPackSuite) TestDefaultBranch(c *C) {
 }
 
 func (s *UploadPackSuite) TestAdvertisedReferencesFilterUnsupported(c *C) {
-	r, err := s.Client.NewUploadPackSession(s.Endpoint)
+	r, err := s.Client.NewUploadPackSession(s.Endpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	defer func() { c.Assert(r.Close(), IsNil) }()
 
@@ -83,7 +84,7 @@ func (s *UploadPackSuite) TestAdvertisedReferencesFilterUnsupported(c *C) {
 }
 
 func (s *UploadPackSuite) TestCapabilities(c *C) {
-	r, err := s.Client.NewUploadPackSession(s.Endpoint)
+	r, err := s.Client.NewUploadPackSession(s.Endpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	defer func() { c.Assert(r.Close(), IsNil) }()
 
@@ -93,7 +94,7 @@ func (s *UploadPackSuite) TestCapabilities(c *C) {
 }
 
 func (s *UploadPackSuite) TestFullUploadPack(c *C) {
-	r, err := s.Client.NewUploadPackSession(s.Endpoint)
+	r, err := s.Client.NewUploadPackSession(s.Endpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	defer func() { c.Assert(r.Close(), IsNil) }()
 
@@ -111,7 +112,7 @@ func (s *UploadPackSuite) TestFullUploadPack(c *C) {
 }
 
 func (s *UploadPackSuite) TestUploadPack(c *C) {
-	r, err := s.Client.NewUploadPackSession(s.Endpoint)
+	r, err := s.Client.NewUploadPackSession(s.Endpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	defer func() { c.Assert(r.Close(), IsNil) }()
 
@@ -125,7 +126,7 @@ func (s *UploadPackSuite) TestUploadPack(c *C) {
 }
 
 func (s *UploadPackSuite) TestUploadPackInvalidReq(c *C) {
-	r, err := s.Client.NewUploadPackSession(s.Endpoint)
+	r, err := s.Client.NewUploadPackSession(s.Endpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	defer func() { c.Assert(r.Close(), IsNil) }()
 
@@ -139,7 +140,7 @@ func (s *UploadPackSuite) TestUploadPackInvalidReq(c *C) {
 }
 
 func (s *UploadPackSuite) TestUploadPackNoChanges(c *C) {
-	r, err := s.Client.NewUploadPackSession(s.Endpoint)
+	r, err := s.Client.NewUploadPackSession(s.Endpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	defer func() { c.Assert(r.Close(), IsNil) }()
 
@@ -153,7 +154,7 @@ func (s *UploadPackSuite) TestUploadPackNoChanges(c *C) {
 }
 
 func (s *UploadPackSuite) TestUploadPackMulti(c *C) {
-	r, err := s.Client.NewUploadPackSession(s.Endpoint)
+	r, err := s.Client.NewUploadPackSession(s.Endpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 	defer func() { c.Assert(r.Close(), IsNil) }()
 
@@ -168,7 +169,7 @@ func (s *UploadPackSuite) TestUploadPackMulti(c *C) {
 }
 
 func (s *UploadPackSuite) TestFetchError(c *C) {
-	r, err := s.Client.NewUploadPackSession(s.Endpoint)
+	r, err := s.Client.NewUploadPackSession(s.Endpoint, s.EmptyAuth)
 	c.Assert(err, IsNil)
 
 	req := packp.NewUploadPackRequest()
diff --git a/remote.go b/remote.go
index c3fa042..a071b07 100644
--- a/remote.go
+++ b/remote.go
@@ -72,7 +72,7 @@ func (r *Remote) Push(o *PushOptions) (err error) {
 		return fmt.Errorf("remote names don't match: %s != %s", o.RemoteName, r.c.Name)
 	}
 
-	s, err := newSendPackSession(r.c.URL)
+	s, err := newSendPackSession(r.c.URL, o.Auth)
 	if err != nil {
 		return err
 	}
@@ -132,7 +132,7 @@ func (r *Remote) fetch(o *FetchOptions) (refs storer.ReferenceStorer, err error)
 		o.RefSpecs = r.c.Fetch
 	}
 
-	s, err := newUploadPackSession(r.c.URL)
+	s, err := newUploadPackSession(r.c.URL, o.Auth)
 	if err != nil {
 		return nil, err
 	}
@@ -175,22 +175,22 @@ func (r *Remote) fetch(o *FetchOptions) (refs storer.ReferenceStorer, err error)
 	return remoteRefs, err
 }
 
-func newUploadPackSession(url string) (transport.UploadPackSession, error) {
+func newUploadPackSession(url string, auth transport.AuthMethod) (transport.UploadPackSession, error) {
 	c, ep, err := newClient(url)
 	if err != nil {
 		return nil, err
 	}
 
-	return c.NewUploadPackSession(ep)
+	return c.NewUploadPackSession(ep, auth)
 }
 
-func newSendPackSession(url string) (transport.ReceivePackSession, error) {
+func newSendPackSession(url string, auth transport.AuthMethod) (transport.ReceivePackSession, error) {
 	c, ep, err := newClient(url)
 	if err != nil {
 		return nil, err
 	}
 
-	return c.NewReceivePackSession(ep)
+	return c.NewReceivePackSession(ep, auth)
 }
 
 func newClient(url string) (transport.Transport, transport.Endpoint, error) {
diff --git a/repository.go b/repository.go
index 34078e5..b2320b9 100644
--- a/repository.go
+++ b/repository.go
@@ -168,6 +168,7 @@ func (r *Repository) Clone(o *CloneOptions) error {
 	remoteRefs, err := remote.fetch(&FetchOptions{
 		RefSpecs: r.cloneRefSpec(o, c),
 		Depth:    o.Depth,
+		Auth:     o.Auth,
 	})
 	if err != nil {
 		return err
@@ -343,6 +344,7 @@ func (r *Repository) Pull(o *PullOptions) error {
 
 	remoteRefs, err := remote.fetch(&FetchOptions{
 		Depth: o.Depth,
+		Auth:  o.Auth,
 	})
 
 	updated := true