Repository navigation
configure: add OidcBrowserAuth and --dataall_url front-page discovery - #53
Merged
TejasRGitHub merged 6 commits intoSep 25, 2026
Merged
Conversation
- Auth-type scoped prompts keep the Cognito and Custom flows unchanged - --dataall_url reads issuer, client id and API endpoint from the deployed frontend bundle and stores the page origin as frontend_url - Tutorial updated Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
With --auth_type OidcBrowserAuth and no flags, ask for the front page URL right after the auth type so the issuer, client id and API endpoint are discovered instead of typed. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The front page bundle says whether the deployment uses Cognito or an OIDC provider, so the type and its values (client id, IdP, redirect URI, API endpoint) are filled in without prompts. An empty URL keeps the manual flow. Commands with an unknown --profile now fail with a one-line message. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
click processes a prompted value twice (value_proc and handle_parse_result), which fetched the bundle and printed the results twice. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
TejasRGitHub
marked this pull request as ready for review
September 25, 2026 15:32
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This was referenced Sep 25, 2026
Connect from a data.all front page URL (client(dataall_url=...)), 0.6.0
data-dot-all/dataall-core#55
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Feature or Bugfix
Detail
Companion to data-dot-all/dataall-core#52 (merged), which adds
OidcBrowserAuth, thefrontend_url/scopes/fallback_redirect_uriprofile fields and a clean error for clients without a profile.dataall_cli configurenow starts by asking for the data.all front page URL. The deployed frontend bundle says whether the deployment uses Cognito or an OIDC provider, so the auth type and its values (identity provider URL, client id, redirect URI, API endpoint) are read from it and not prompted for; only the profile name is asked (plus the optional client secret and auth server for Cognito). An empty URL keeps the manual flow;--dataall_urldoes the same non-interactively. The page origin is stored asfrontend_urland sent asOrigin/Refererfor deployments whose API only accepts calls carrying the UI origin.OidcBrowserAuthis selectable with defaultsredirect_uri=http://localhost:8765/callback,fallback_redirect_uri=http://localhost:8766/callback,scopes=openid offline_access. If--auth_typecontradicts what the page reports, the CLI warns and keeps only the page URL.AuthScopedOption, a smallclick.Optionsubclass, prompts an option only for the auth types it applies to and skips discovered values, so unrelated keys are not written toconfig.yaml. Cognito and Custom prompts keep their order, wording and defaults; the pre-existing functional test inputs pass with one leading newline for the new first prompt.--profileprintsError: Profile 'x' is not configured; run: dataall_cli configure --profile xand exits 1 instead of a traceback.offline_access), device login on hosts without a browser.dataall-core>=0.5.0,<0.6.0(the release that ships Bump anyio from 4.11.0 to 4.14.2 #52) andpoetry.lockregenerated withpoetry lock; only thedataall-coreentry changed.httpx, used by the discovery helper, already comes throughdataall-core. Verified in a fresh venv against PyPI: all 34 tests pass.Verified end to end against an Okta custom authorization server:
configurefrom the front page, browser login, API call, forced-expiry refresh.Relates
Security
--dataall_urlperforms two GETs withhttpx(the front page, then thestatic/js/main.*.jsit references) and extracts values with anchored regular expressions on known variable names. The values only prefill profile fields the user could type by hand; nothing is executed or deserialized beyondresponse.text. Noeval.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
🤖 Generated with Claude Code