feat(auth): use oauth device flow to authenticate with predefined src-cli OAuth client #1223
Conversation
- Add Client which discovers configuration based on .well-known/openid-configuration and caches it - Client initiates device flow with start - Once the flow has started, the client polls until authorized or an error occurs.
--device-flow uses oauthdevice to start the OAuth device flow with a well known client on a sourcegraph server
cmd/src/login.go
Outdated
| } | ||
|
|
||
| fmt.Fprintln(out) | ||
| fmt.Fprintf(out, "🔐 To authenticate, visit %s and enter the code: %s\n", authResp.VerificationURI, authResp.UserCode) |
There was a problem hiding this comment.
no emojis in UI please 😬 since claude, this has an AI vibe slop feeling to it :(
There was a problem hiding this comment.
valid :) I'll remove it
There was a problem hiding this comment.
Removed. We need to do a larger sweep of the other emojis too :|
| fmt.Fprintln(out) | ||
| fmt.Fprintf(out, "To use this access token, set the following environment variables in your terminal:\n\n") | ||
| fmt.Fprintf(out, " export SRC_ENDPOINT=%s\n", endpointArg) | ||
| fmt.Fprintf(out, " export SRC_ACCESS_TOKEN=%s\n", cfg.AccessToken) |
There was a problem hiding this comment.
what you get here is not a SG access token, it's an oauth token and it comes with an access token and refresh token (and expiry) and needs to regularly be refreshed.
I think we need to store the accesstoken/refreshtoken pair in secure storage and add some http Transport that refreshes the credential as needed.
There was a problem hiding this comment.
Will look at using https://github.com/99designs/keyring. We already use it with sg to store some secrets. It uses your OS keychain
This adds the flag
--device-flowtologincommand which then starts the OAuth device authentication flow.ghdoes the same flow when you authenticate from the cli withgh auth login.internal/oauthdevice.well-known/openid-configurationI wanted to add
--client-idin case people wanted to override the default client that is used which can also be used for testing, but when I tried creating a client on S2 it doesn't have the correct configuration as set from the UI to be able to do this.Important
Seems like a lot of code but it's the tests that make up most of it
Test plan
Amp thread