feat: wso2 login runs browser authorization code with PKCE end to end - #26
Conversation
The shell binary now carries an HTTP client, so the offline guarantee is stated where it is still true: nothing wso2 version reaches to resolve module inventory may depend on net/http. Claude-Session: https://claude.ai/code/session_01RojiAgW9hi3b9f9G6ZXBVp
An abandoned login waited forever on a bound callback port: the flow honoured a cancelled context but the command never armed one. The authorization URL is an instruction to act on, not the command's result, so it moves to the diagnostic stream and leaves standard output carrying only the identity report. Also share the --context parsing both commands had grown separately, and prove the refusals that were only asserted by construction: no browser suppression, an identity token missing its nonce, and a login the issuer answers without a refresh token. Claude-Session: https://claude.ai/code/session_01RojiAgW9hi3b9f9G6ZXBVp
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Copilot reviewed 13 out of 14 changed files in this pull request and generated no comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Implements #20 (part of #17). Third PR of the
wso2 loginstack — stacked on #25; only the last four commits are new here.What this does
internal/auth/oauthflow: discovery via go-oidc requiring S256, first-free loopback port of 10425–10428 on127.0.0.1/callback, authorization URL always printed (to stderr, as a diagnostic) while the browser opens best-effort (WSO2_NO_BROWSERsuppresses the attempt), Authorization Code + PKCE exchange, ID-token verification with nonce, 5-minute deadline so an abandoned login cannot hang a bound port forever.internal/app/login.go:wso2 loginresolves the selected context/identity, refuses by kind with stable typed problems (auth.non_interactive,auth.login_not_required,auth.kind_not_implemented,auth.discovery_failed,auth.context_not_selected), stores the session under the identity's credential reference inside the rotation lock, and reports subject, email, organization, and product namespaces — never token material.AllowAnyLoopbackPort,OmitS256,OmitNonce,HTTPClient()).Verification
Full
go test ./... -race -count=1green including the acceptance gate;golangci-lint run0 issues. State-mismatch rejection is mutation-checked (removing the state check fails the test); output streams are asserted token-free.Noted for reviewers: the acceptance suite's no-
net/httpbinary invariant was narrowed to the version/inventory path, since the login command legitimately links HTTP now.docs/architecture.mdmentionswso2 login --device-code, which this slice rejects as an unknown flag while the kind refusesauth.kind_not_implemented— flagged as a doc/UX question rather than resolved here.Stack
feature/loginfeat/login-context-schema-v2feat/login-auth-testbedhttps://claude.ai/code/session_01RojiAgW9hi3b9f9G6ZXBVp