Uh oh!
There was an error while loading. Please reload this page.
feat(login): standards RFC 8628 device login for Hanzo IAM - #4
Merged
Conversation
`dev login --device-auth` (default provider hanzo) now speaks standard
OAuth 2.0 Device Authorization Grant against Hanzo IAM, so headless/CLI
login works on hanzo.id / lux.id / zoolabs.id. Previously --device-auth
always used OpenAI's proprietary /api/accounts/deviceauth + PKCE scheme
(ignoring --provider), which Hanzo IAM does not serve — the genesis of
the "expected value at line 1 column 1" failure.
- oidc_device_auth.rs: brand-agnostic RFC 8628 flow. POST {issuer}/oauth/
device, then poll {issuer}/oauth/token with grant_type=device_code,
handling authorization_pending / slow_down (interval backoff) /
access_denied / expired_token. Both interval AND expires_in are clamped
(a hostile issuer can't overflow Instant+Duration or pin the poll).
Prefers verification_uri_complete. Persists via the same token store
the browser flow uses. Pure classify_poll() is unit-tested (8 tests).
- device-auth routes by provider: hanzo (default) -> RFC 8628; openai ->
the existing OpenAI device scheme (untouched); claude -> guidance.
- HANZO_CLIENT_ID hanzo-dev -> hanzo-app (hanzo-dev returns Invalid
client_id live; hanzo-app is the canonical <org>-app client). issuer/
client overridable via the experimental flags for lux-app/zoo-app.
Verified: cargo check (login+cli), clippy clean, 8 unit tests pass.Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
dev login --device-auth(default provider hanzo) now speaks the standard OAuth 2.0 Device Authorization Grant (RFC 8628) against Hanzo IAM, so headless/CLI login works on hanzo.id / lux.id / zoolabs.id.Previously
--device-authalways used OpenAI's proprietary/api/accounts/deviceauth+ PKCE scheme (it ignored--provider), which Hanzo IAM does not serve — the genesis of theexpected value at line 1 column 1failure when signing into Hanzo ID.Changes
login/src/oidc_device_auth.rs(new) — brand-agnostic RFC 8628 flow:POST {issuer}/oauth/device, then poll{issuer}/oauth/tokenwithgrant_type=urn:ietf:params:oauth:grant-type:device_code, handlingauthorization_pending/slow_down(interval backoff) /access_denied/expired_token. Prefersverification_uri_completefor one-click approval. Persists via the same token store the browser flow uses. Pureclassify_poll()is unit-tested.--device-authroutes by provider —hanzo(default) → RFC 8628;openai→ the existing OpenAI device scheme (untouched);claude→ guidance (API-key only).HANZO_CLIENT_IDhanzo-dev→hanzo-app—hanzo-devreturnsInvalid client_idlive;hanzo-appis the canonical<org>-<app>client that responds on hanzo.id. issuer/client overridable via the experimental flags forlux-app/zoo-app.Tests
cargo check -p codex-login -p codex-cliclean;clippy -p codex-logincleanDepends on
hanzoai/iam
feat/device-code-login— the IAM must have device_code re-enabled and the<org>-appclients granted device_code for the end-to-end flow to complete. Code-complete + contract-verified on both sides; releasedevafter the IAM deploy.