Add OAuth device authorization login - #382
Conversation
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 9 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="internal/auth/auth.go">
<violation number="1" location="internal/auth/auth.go:270">
P2: When the device endpoint returns control characters in a verification URI or user code, `LoginDevice` writes them verbatim to the terminal. Sanitize server-provided values before passing these messages to the logger.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| if err != nil { | ||
| return err | ||
| } | ||
| opts.log(fmt.Sprintf("Open %s and enter code: %s\n", authorization.VerificationURI, authorization.UserCode)) |
There was a problem hiding this comment.
P2: When the device endpoint returns control characters in a verification URI or user code, LoginDevice writes them verbatim to the terminal. Sanitize server-provided values before passing these messages to the logger.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At internal/auth/auth.go, line 270:
<comment>When the device endpoint returns control characters in a verification URI or user code, `LoginDevice` writes them verbatim to the terminal. Sanitize server-provided values before passing these messages to the logger.</comment>
<file context>
@@ -228,6 +254,67 @@ func (m *Manager) Login(ctx context.Context, opts LoginOptions) error {
+ if err != nil {
+ return err
+ }
+ opts.log(fmt.Sprintf("Open %s and enter code: %s\n", authorization.VerificationURI, authorization.UserCode))
+ if authorization.VerificationURIComplete != "" {
+ opts.log(fmt.Sprintf("Direct link: %s\n", authorization.VerificationURIComplete))
</file context>
There was a problem hiding this comment.
Leaving this as is. These values come from HEY's own OAuth server over TLS — the same server this CLI already trusts with its tokens — and the browser flow prints that server's authorization URL to the terminal the same way. A server that could put control characters here could do far worse, so a sanitizer at this one sink would guard against nobody in particular.
|
Good thinking @ivankuznetsov 😍 We have this in the works. |
…ut of the method count The poll loop waits at most the code's remaining lifetime and does not exchange an expired code again; the command no longer imposes its own 16-minute cap on top of expires_in. --no-browser only shapes the browser flow, so --token/--cookie with it work as before and only --device rejects it. Both option types share one progress-logging helper, and the device request test asserts method, encoding and identity fields like its siblings.
98a1587 to
15a4d59
Compare
|
Rebased onto main at 15a4d59 (the README hunk moved to Where this stands: HEY's OAuth server does not yet serve |
Summary
hey auth login --deviceand the matchinghey login --deviceshortcutslow_downbackoff, expiry, cancellation, denial, and refresh-token persistenceCloses #381.
Server dependency
This PR implements and tests only the CLI side. It expects HEY to provide:
POST /oauth/device_authorizationsverification_uripage for user code entry/approvalPOST /oauth/tokensUntil those server/web pieces exist,
--devicewill return the device-authorization endpoint error. Endpoint names and response details can be adjusted to match the HEY implementation during review.Verification
make checkgo test ./internal/auth ./internal/cmdmake fmt-checkmake lintgit diff --checkSummary by cubic
Adds
hey auth login --device(and thehey login --deviceshortcut) for signing in on headless machines using the OAuth device authorization grant (RFC 8628). Users see a short user code to enter at a verification URL; the secret device code is never displayed.expires_inlifetime, handlingslow_down,expired_token, andaccess_denied; success saves access and refresh tokens.--devicecannot be combined with--token,--cookie, or--no-browser;--no-browserwith--token/--cookiestill works as before.POST /oauth/device_authorizationsand device-code grant support atPOST /oauth/tokens; until those exist,--devicereturns the endpoint error. Closes Support OAuth device authorization for headless CLI sign-in #381.Written for commit 15a4d59. Summary will update on new commits.