Skip to content

fix(builderbot-auth): default non-macOS session storage to a file #327

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
corydouthat-sq wants to merge 2 commits into
base: main
Choose a base branch
from
Open

fix(builderbot-auth): default non-macOS session storage to a file #327

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
22bd854
fix(builderbot-auth): default non-macOS session storage to a file
corydouthat-sq Sep 15, 2026
b038bda
fix(builderbot-auth): make the file session store process-safe and pr…
corydouthat-sq Sep 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion bb-cli/docs/bb-auth-local-testing.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ Expected result:
- kgoose validates the state cookie, exchanges the Auth0 code server-side, and redirects to the CLI loopback callback with a one-time exchange code
- the CLI exchanges that code through kgoose and stores the returned session credential

By default, the CLI stores browser auth sessions in the OS keyring. For local debugging without touching keyring state, use the `BB_AUTH_STORAGE=file` command above.
By default, the CLI stores browser auth sessions in the OS keyring on macOS. On Windows and Linux the default is a JSON file, `<bb home>/auth-sessions.json`, protected by file permissions rather than a keyring (mode 0600 on Unix; on Windows the file's ACL is reset so only the current user has access). Writes replace the file atomically and are serialized across the desktop app and the CLI through a sibling `auth-sessions.json.lock`. For local debugging without touching the default store on any platform, use the `BB_AUTH_STORAGE=file` command above.

## Test In Staging

Expand Down
2 changes: 1 addition & 1 deletion crates/builderbot-auth/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
name = "builderbot-auth"
version = "0.1.0"
edition = "2021"
rust-version = "1.88.0"
rust-version = "1.89.0"

@morgmart morgmart Sep 16, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 P1 · Align the CLI Rust minimum (blocking)

The authentication crate now requires Rust 1.89, while the bb CLI package that depends on it still declares Rust 1.88. Building the CLI with its advertised minimum compiler will fail during dependency resolution even though CI passes on newer toolchains.

User effect: Contributors and packaging environments using the CLI's documented minimum Rust version will be unable to build bb.

Recommended fix: Raise the bb CLI package's declared minimum Rust version to at least 1.89, or implement locking without increasing the authentication crate's minimum.

Test: Add or update the minimum-supported-Rust validation so the CLI and its path dependencies are checked with the declared compiler version.

license = "Apache-2.0"
publish = false

Expand Down
Loading