Uh oh!
There was an error while loading. Please reload this page.
remote/oidc: browser mode for hyp remote login (T6) - #200
Merged
Conversation
platypiiforce-pushed
the
chunk3-credentials-kind
branch
from
June 29, 2026 18:37
280281f to
a6bb8cbCompareplatypii
changed the base branch from
chunk3-credentials-kind
to
oidc-client-loginJune 29, 2026 18:38
runRemoteLogin gains an interactive browser authorization-code mode (LLP 0046 D1), selected by default when no static token is supplied: - Flag parsing: --token-file / stdin keep the static path unchanged (kind: 'static', the headless escape hatch, D8); --org <name> selects an org; --browser forces the flow even with stdin piped; --no-browser prints the URL instead of opening it. - The identity base is derived from the configured target URL's origin as <origin>/v1/identity, so no second URL is configured (D6). - On success the resolved org is printed and the OIDC session is stored via writeSession. - A server-surfaced callback error (access_denied, no_membership, org_selection_required, org_not_permitted) is translated to a clear message; org_selection_required instructs a --org re-run rather than enumerating the user's orgs (D7). A small `deps.login` seam keeps the browser path unit-testable. Tests cover --org + identity-base forwarding, --no-browser, each error mapping, the unconfigured-target refusal, and the unchanged static token-file and piped-stdin paths.
platypii
commented
Jun 29, 2026
ContributorAuthor
Review (independent agent review)Verdict: approve-with-nits. Solid split of static vs browser modes, faithful to D1/D6/D7/D8, with complete error mapping (no enumeration of the user's orgs) and no secret leakage. Mode decision (TTY→browser, piped→static, Findings
Addressed in this PR
12 tests green, typecheck clean. |
Review follow-ups (PR #200): - the target name now skips the value slot of --token-file/--org via a firstPositional() helper, so `login --org acme` (name omitted) is a usage error instead of misreading 'acme' as the target. - a static path with --org now prints a note that --org applies only to the browser flow, instead of silently dropping it. - tests: --browser overriding piped stdin, only-flags usage error, --org-missing-value exit, and the static --org-ignored note.
platypiiforce-pushed
the
chunk4-login-command
branch
from
June 29, 2026 18:41
3f3841e to
36ab1feCompareUh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Chunk 4 of the OIDC client login (LLP 0046-0048), milestone 2. Stacked on #199 (base
chunk3-credentials-kind); review/merge after #197-#199.What
runRemoteLogingains an interactive browser authorization-code mode (LLP 0046 D1), the default when no static token is supplied:--token-file/stdin keep the static path unchanged (D8);--org <name>selects an org;--browserforces the flow;--no-browserprints the URL.<origin>/v1/identity(D6).writeSession.access_denied,no_membership,org_selection_required,org_not_permitted) translated to clear messages;org_selection_requiredinstructs a--orgre-run rather than enumerating orgs (D7).Tests
remote-login-command.test.js(8 tests) ---org/identity forwarding,--no-browser, each error mapping, unconfigured-target refusal, unchanged static + piped-stdin paths. Typecheck clean; remote/CLI suite green (69).🤖 Generated with Claude Code