Add OAuth2 login command#271
Conversation
| } | ||
|
|
||
| struct Callback { | ||
| access_token: String, |
There was a problem hiding this comment.
Would be better to have a one-time code here and request the token over https to avoid having the token in the URL.
There was a problem hiding this comment.
Yes, it makes sense to do. I thought at the current stage it's a bit overkill keeping in mind that the tokens are stored unencrypted on the disk and if you have access to the localhost you can't protect them only with one-time code. However, it's better to implement from the beginning since the gateway API must be changed.
| Ok(url) | ||
| } | ||
|
|
||
| async fn receive_callback(listener: &TcpListener) -> anyhow::Result<Callback> { |
There was a problem hiding this comment.
Need to check who sent the request for security.
There was a problem hiding this comment.
I think this would be too much, since the worst that could happen someone sends an invalid token.
| .context("Failed to start local OAuth2 callback server")?; | ||
| let login_url = login_url(&target.url, listener.local_addr()?)?; | ||
|
|
||
| output!(ctx, "Open this URL to authenticate:\n {login_url}"); |
There was a problem hiding this comment.
Let's try to open the browser and keep that as fallback ?
2 participants
Closes #
Please check if the PR fulfills these requirements
What kind of change does this PR introduce?
Feature
What was changed?
Add
reduct-cli login <alias-or-url>for OAuth2 authentication through a local loopback callback server. The command stores a received token in an alias configuration or prints an authenticated direct URL.Add focused coverage for login targets, callback parsing, redirect URL generation, configuration persistence, and receiving HTTP callbacks.
Add a reusable Kilo
create-prskill that fetches the shared PR template and records the created PR in the changelog.Related issues
None.
Does this PR introduce a breaking change?
No.
Other information:
Testing:
cargo test --locked cmd::loginpassed.cargo test --lockedcould not complete because 74 existing integration-style tests require ReductStore atlocalhost:8383, which was not running.