New command group: `nextflow auth` #6380

ewels · 2025-09-04T07:18:40Z

This PR introduces a complete authentication system for Seqera Platform with multiple subcommands for managing authentication credentials and configuration.

CleanShot.2025-09-21.at.00.32.54.mp4

Features

New `nextflow auth` command with subcommands:

nextflow auth login - Authenticate with Seqera Platform using OAuth2/PKCE flow
nextflow auth logout - Remove authentication credentials and clear configuration
nextflow auth status - Show current authentication status and user information
nextflow auth config - Display current authentication configuration

Auth0 Device Flow Authentication

Implements Auth0 device flow for secure authentication without requiring a local server
User-friendly flow: displays a code and opens browser to Auth0 verification URL
Automatic polling to detect when user completes authentication
Supports multiple Seqera environments (production, staging, development)
Personal Access Token (PAT) fallback for enterprise/custom deployments

Usage Examples

# Authenticate with Seqera Cloud (production)
nextflow auth login

# Authenticate with custom endpoint
nextflow auth login -u https://my-enterprise-seqera.com/api

# Check authentication status
nextflow auth status

# View current configuration
nextflow auth config

# Logout and clear credentials
nextflow auth logout

Technical Implementation

Core Components

CmdAuth: Main command handler with OAuth2 flow implementation
ColorUtil: ANSI color utility for enhanced terminal output
Comprehensive test suite: 36 tests covering all functionality

Authentication Flow

Prompts for API endpoint (defaults to Seqera Cloud production)
For Seqera Cloud: initiates Auth0 device flow
Displays user code and opens browser to verification URL
Polls Auth0 token endpoint until user completes authentication
For enterprise: prompts for Personal Access Token
Validates credentials and fetches user information
Handles workspace/organization selection
Updates Nextflow configuration with new credentials

Note

Introduces a new nextflow auth CLI with OAuth2 (Auth0) and PAT flows via nf-tower plugin, adds ANSI color utility, integrates into launcher, and includes comprehensive tests.

CLI:
- Add CmdAuth command group with subcommands: login, logout, config, status.
- Integrate auth into Launcher command registry.
- Add ColorUtil for ANSI-colored terminal output.
nf-tower Plugin:
- Implement io.seqera.tower.plugin.cli.AuthCommandImpl (extension of CmdAuth.AuthCommand).
  - Auth0 device flow (Cloud) and PAT entry (Enterprise), token generation/deletion, config read/write, workspace selection, and status display.
- Register new extension point and bump nextflowVersion to 25.08.0-edge in plugins/nf-tower/build.gradle.
Tests:
- Add tests for CmdAuth, ColorUtil, and AuthCommandImpl.
Misc:
- Update author email in nextflow/trace/ReportObserver.groovy.

^{Written by Cursor Bugbot for commit 00b4590. This will update automatically on new commits. Configure here.}

netlify · 2025-09-04T07:18:45Z

✅ Deploy Preview for nextflow-docs-staging canceled.

Name	Link
🔨 Latest commit	`00b4590`
🔍 Latest deploy log	https://app.netlify.com/projects/nextflow-docs-staging/deploys/68dbfface68c9c000860363c

ewels · 2025-09-20T23:54:52Z

Struggling to get the tests to pass. Even master is failing for me locally, whilst passing on GitHub. Not sure what's wrong.

ewels · 2025-09-21T19:45:44Z

@claude Please review this pull request and provide feedback on:

Code quality and best practices
Potential bugs or issues
Performance considerations
Security concerns
Test coverage

Use the repository's CLAUDE.md for guidance on style and conventions. Be constructive and helpful in your feedback.

Use gh pr comment with your Bash tool to leave your review as a comment on the PR.

claude · 2025-09-21T19:45:59Z

Claude encountered an error —— View job

Failed with exit code 128

I'll analyze this and get back to you.

cursor · 2025-09-21T19:45:59Z

modules/nextflow/src/main/groovy/nextflow/cli/ColorUtil.groovy

+        } else {
+            // Reset only what was set
+            if (bold) fmt = fmt.boldOff()
+            if (dim) fmt = fmt.a(Attribute.INTENSITY_BOLD) // Reset dim


Bug: Colorize Method Incorrectly Applies Bold Formatting

When fullReset is false, the colorize method attempts to reset dim formatting using Attribute.INTENSITY_BOLD. This applies bold formatting instead of returning the text to normal intensity, causing text to appear bold when it should be undimmed.

cursor · 2025-09-21T19:45:59Z

modules/nextflow/src/main/groovy/nextflow/cli/CmdAuth.groovy

+            // Check if TOWER_WORKFLOW_ID environment variable is set
+            def envWorkspaceId = System.getenv('TOWER_WORKFLOW_ID')
+            if (envWorkspaceId) {
+                println "\nDefault workspace: ${ColorUtil.colorize('TOWER_WORKFLOW_ID environment variable is set', 'yellow')}"


Bug: Incorrect Environment Variable Check in Nextflow Auth

The nextflow auth commands incorrectly check for the TOWER_WORKFLOW_ID environment variable when configuring and displaying the default workspace. This prevents the system from recognizing the intended TOWER_WORKSPACE_ID environment variable for workspace selection.

Additional Locations (1)

modules/nextflow/src/main/groovy/nextflow/cli/CmdAuth.groovy#L1186-L1187

pditommaso · 2025-09-22T14:45:54Z

Let's start refactoring this as nf-seqera plugin (in the plugins directory, same as nf-tower)

jorgee · 2025-09-26T09:57:00Z

I get confused a bit on how -url is managed.
In usage examples, it seems the -url is used to support login for enterprise, but inside the code it is also used to decide to use cloud dev, stage or prod.
To manage it, the code has a couple of maps with the api and Auth0 URLs, and Auth0 client Id for all environments hardcoded in the code. There is also a complex sequence to check if the URL is from platform (cloud) or enterprise and if it is enterprise then uses PAT instead of Auth0.

I think it is better to simplify it by -url is for enterprise with PAT and no url is for cloud. Moreover, instead of hardcoding all environments, keep just the production values as default and allow to test in other environments using env variables. In fact, we already have the TOWER_API_ENDPOINT, we just would need to add the ones for auth endpoint and client id.

What do you think about it?

jorgee · 2025-09-26T10:16:16Z

modules/nextflow/src/main/groovy/nextflow/cli/CmdAuth.groovy

+                if (isCloudEndpoint(apiUrl)) {
+                    def tokenId = decodeTokenId(existingToken as String)
+                    deleteTokenViaApi(existingToken as String, apiUrl, tokenId)
+                } else {
+                    println " - Enterprise installation detected - PAT will not be deleted from platform."
+                }
+
+                removeAuthFromConfig()
+


What happens if there was a previous token already defined in the config. Could it be deleted by mistake?

Yes it will be deleted, by design. Maybe we could add a confirmation prompt?

ewels · 2025-09-26T12:29:33Z

@jorgee I think that we still need the logic to detect the 3 prod / stage / dev URLs for cloud - it's needed to trigger the logic to try the Auth0 flow rather than just booting people to use a PAT.

If we have that logic in the code, then I don't really see a reason to not also include the key and auth0 URL personally, it's only a handful of extra lines of code. And it'd be a swap for env vars. Given that I don't envision ever needing to test with any other auth0 URLs I'm not really sure it'd be any simpler..?

Signed-off-by: Phil Ewels <[email protected]>

Set TOWER_ACCESS_TOKEN with new PAT. Signed-off-by: Phil Ewels <[email protected]>

Signed-off-by: Phil Ewels <[email protected]>

Signed-off-by: jorgee <[email protected]>

jorgee · 2025-09-29T12:22:44Z

It seems login is not working well when there is a profile with tower properties. I had already defined a profile and it was removed from the profile and wrote a new one. I will debug it, but I was wondering if it will be easier to write everything in a separate file and just add the include it in the .nextflow/config. We will just need to add or remove the line instead of looking for the tower config.

Signed-off-by: jorgee <[email protected]>

jorgee · 2025-09-30T08:17:34Z

Pushed changes to move Auth functionality to nf-tower

Signed-off-by: jorgee <[email protected]>

jorgee · 2025-09-30T17:46:54Z

plugins/nf-tower/src/main/io/seqera/tower/plugin/cli/AuthCommandImpl.groovy

+        apiUrl = normalizeApiUrl(apiUrl)
+        ColorUtil.printColored(" - Seqera Platform API endpoint: ${ColorUtil.colorize(apiUrl, 'magenta')} (can be customised with ${ColorUtil.colorize('-url', 'cyan')})", "dim")
+
+        // Check if this is a cloud endpoint or enterprise
+        def endpointInfo = getCloudEndpointInfo(apiUrl)
+        if( endpointInfo.isCloud ) {
+            try {
+                performAuth0Login(apiUrl, endpointInfo.environment as String)
+            } catch( Exception e ) {
+                log.debug("Authentication failed", e)
+                println ""
+                throw new AbortOperationException("${e.message}")
+            }
+        } else {
+            // Enterprise endpoint - use PAT authentication
+            handleEnterpriseAuth(apiUrl)
+        }


This is what I referred to in my previous comment #6380 (comment).
In normalizeApi, it is converting http to https and, in getCloudEndpoint, it is checking if the provided apiUrl is in a legacy format '/api' to compare it with the dev, stage and prod endpoints
Assuming that url flag is just for login in enterprise, it could be simplify by

if (apiUrl) handleEnterpriseAuth(apiUrl) else performAuth0Login()

No need to normalizeApi function nor getCloudEndpointInfo. If the problem is providing the Auth0 url and clientId when testing we could be kept in a map api_endpoint -> auth0_Info and just use the TOWER_ENDPOINT_API to retrive them as it is used in the rest of the nf-tower calls.

ewels force-pushed the nextflow-auth branch 8 times, most recently from e9b3f26 to c01e56b Compare September 6, 2025 19:41

ewels force-pushed the nextflow-auth branch 3 times, most recently from 5e79a3b to c5a3283 Compare September 20, 2025 23:32

ewels changed the title ~~WIP: First attempt at auth0 flow for nextflow auth login~~ New command group: nextflow auth Sep 21, 2025

ewels marked this pull request as ready for review September 21, 2025 19:43

cursor bot reviewed Sep 21, 2025

View reviewed changes

bentsherman assigned jorgee Sep 22, 2025

jorgee reviewed Sep 26, 2025

View reviewed changes

ewels added 7 commits September 29, 2025 13:40

WIP: First attempt at auth0 flow for 'nextflow auth login'

0f9904e

Signed-off-by: Phil Ewels <[email protected]>

Handle Enterprise installs without auth0

b599fe1

Signed-off-by: Phil Ewels <[email protected]>

Add auth0 client ID

5fa52fc

Signed-off-by: Phil Ewels <[email protected]>

Hardcode 'platform' as audience as shouldn't ever need to edit this

f031622

Signed-off-by: Phil Ewels <[email protected]>

Add additional allowed API URLs for auth0 flow

a0d800a

Signed-off-by: Phil Ewels <[email protected]>

Use auth0 to generate a Platform PAT, add to bashrc

ec86e14

Set TOWER_ACCESS_TOKEN with new PAT. Signed-off-by: Phil Ewels <[email protected]>

WIP: Started work on 'nextflow auth logout'

356e8f5

Signed-off-by: Phil Ewels <[email protected]>

ewels and others added 24 commits September 29, 2025 13:40

Rewrite: Save to ~/.nextflow/config instead of using env vars

b6b6127

Signed-off-by: Phil Ewels <[email protected]>

Always set tower.enabled true when logging in

ec03361

Signed-off-by: Phil Ewels <[email protected]>

nextflow auth config

cf344f9

Signed-off-by: Phil Ewels <[email protected]>

Add code comment next to workspace ID saying what the org / ws is

f6f3694

Signed-off-by: Phil Ewels <[email protected]>

New nextflow auth status command

ba279b1

Signed-off-by: Phil Ewels <[email protected]>

Don't prompt for API URL, just have it as a CLI option

0b01234

Signed-off-by: Phil Ewels <[email protected]>

Add warnings to login and logout if TOWER_ACCESS_TOKEN is set

1909da0

Signed-off-by: Phil Ewels <[email protected]>

Bugfix: change how workspace name and fullName are used

0b3ffab

Signed-off-by: Phil Ewels <[email protected]>

Tell the user we're using their env var token in 'auth config'

b31b1c7

Signed-off-by: Phil Ewels <[email protected]>

Add colour

b9547ff

Signed-off-by: Phil Ewels <[email protected]>

Refactor colour helpers to take string argument

fa056b5

Signed-off-by: Phil Ewels <[email protected]>

Minor tweak

320bee4

Signed-off-by: Phil Ewels <[email protected]>

Switch from PKCE to device-flow auth, with code confirmation

39d3c64

Signed-off-by: Phil Ewels <[email protected]>

Add support for Platform auth on stage and prod

261e1e6

Signed-off-by: Phil Ewels <[email protected]>

Tweak formatting

8a2b847

Signed-off-by: Phil Ewels <[email protected]>

Auth flow with code, appended to URL

a340b66

Signed-off-by: Phil Ewels <[email protected]>

Prompt to open browser, don't do it without warning

4c7cf83

Signed-off-by: Phil Ewels <[email protected]>

Rename AuthColorUtil to ColorUtil, expect to use it elsewhere

564890b

Signed-off-by: Phil Ewels <[email protected]>

Improve styling and flow for status / auth

4015186

Signed-off-by: Phil Ewels <[email protected]>

lots of testing and tweaking CLI

95908ff

Signed-off-by: Phil Ewels <[email protected]>

Code cleanup

3a67b90

Signed-off-by: Phil Ewels <[email protected]>

Add some tests

248fedc

Signed-off-by: Phil Ewels <[email protected]>

move authcommand implementation to nf-tower

5c7a192

Signed-off-by: jorgee <[email protected]>

Fix log

4bdf462

Signed-off-by: jorgee <[email protected]>

Fixing nf-tower load in AuthCommand

0273b40

Signed-off-by: jorgee <[email protected]>

jorgee force-pushed the nextflow-auth branch from 24d0865 to 0273b40 Compare September 30, 2025 08:14

Spliting auth tests in nexflow and nf-tower

00b4590

Signed-off-by: jorgee <[email protected]>

jorgee reviewed Sep 30, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

New command group: `nextflow auth` #6380

New command group: `nextflow auth` #6380

ewels commented Sep 4, 2025 •

edited by cursor bot

Loading

Uh oh!

netlify bot commented Sep 4, 2025 •

edited

Loading

Uh oh!

ewels commented Sep 20, 2025

Uh oh!

ewels commented Sep 21, 2025

Uh oh!

claude bot commented Sep 21, 2025 •

edited

Loading

Uh oh!

cursor bot Sep 21, 2025

Uh oh!

cursor bot Sep 21, 2025

Uh oh!

pditommaso commented Sep 22, 2025

Uh oh!

jorgee commented Sep 26, 2025

Uh oh!

jorgee Sep 26, 2025

Uh oh!

ewels Sep 26, 2025

Uh oh!

ewels commented Sep 26, 2025

Uh oh!

jorgee commented Sep 29, 2025

Uh oh!

jorgee commented Sep 30, 2025

Uh oh!

jorgee Sep 30, 2025 •

edited

Loading

Uh oh!

Uh oh!

New command group: nextflow auth #6380

Are you sure you want to change the base?

New command group: nextflow auth #6380

Conversation

ewels commented Sep 4, 2025 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Features

New nextflow auth command with subcommands:

Auth0 Device Flow Authentication

Usage Examples

Technical Implementation

Core Components

Authentication Flow

Uh oh!

netlify bot commented Sep 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for nextflow-docs-staging canceled.

Uh oh!

ewels commented Sep 20, 2025

Uh oh!

ewels commented Sep 21, 2025

Uh oh!

claude bot commented Sep 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot Sep 21, 2025

Choose a reason for hiding this comment

Bug: Colorize Method Incorrectly Applies Bold Formatting

Uh oh!

cursor bot Sep 21, 2025

Choose a reason for hiding this comment

Bug: Incorrect Environment Variable Check in Nextflow Auth

Uh oh!

pditommaso commented Sep 22, 2025

Uh oh!

jorgee commented Sep 26, 2025

Uh oh!

jorgee Sep 26, 2025

Choose a reason for hiding this comment

Uh oh!

ewels Sep 26, 2025

Choose a reason for hiding this comment

Uh oh!

ewels commented Sep 26, 2025

Uh oh!

jorgee commented Sep 29, 2025

Uh oh!

jorgee commented Sep 30, 2025

Uh oh!

jorgee Sep 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

New command group: `nextflow auth` #6380

New command group: `nextflow auth` #6380

ewels commented Sep 4, 2025 •

edited by cursor bot

Loading

New `nextflow auth` command with subcommands:

netlify bot commented Sep 4, 2025 •

edited

Loading

claude bot commented Sep 21, 2025 •

edited

Loading

jorgee Sep 30, 2025 •

edited

Loading