feat(oauth): use oauth device flow to authenticate with predefined src-cli OAuth client #1223

burmudar · 2025-12-03T13:22:52Z

This adds the flag --device-flow to login command which then starts the OAuth device authentication flow. gh does the same flow when you authenticate from the cli with gh auth login.

add package internal/oauthdevice
discover oauth configuration via path .well-known/openid-configuration
add client to handle flow, in particular to discover the endpoints it should use and ultimately poll for the token once the user as authorized the application.

I wanted to add --client-id in case people wanted to override the default client that is used which can also be used for testing, but when I tried creating a client on S2 it doesn't have the correct configuration as set from the UI to be able to do this.

Important

Seems like a lot of code but it's the tests that make up most of it

Test plan

Unit tests

go test -v ./internal/oauthdevice/...
=== RUN   TestDiscover_Success
--- PASS: TestDiscover_Success (0.00s)
=== RUN   TestDiscover_Caching
--- PASS: TestDiscover_Caching (0.00s)
=== RUN   TestDiscover_Error
--- PASS: TestDiscover_Error (0.00s)
=== RUN   TestStart_Success
--- PASS: TestStart_Success (0.00s)
=== RUN   TestStart_WithScopes
--- PASS: TestStart_WithScopes (0.00s)
=== RUN   TestStart_Error
--- PASS: TestStart_Error (0.00s)
=== RUN   TestStart_NoDeviceEndpoint
--- PASS: TestStart_NoDeviceEndpoint (0.00s)
=== RUN   TestPoll_Success
--- PASS: TestPoll_Success (0.00s)
=== RUN   TestPoll_AuthorizationPending
--- PASS: TestPoll_AuthorizationPending (0.00s)
=== RUN   TestPoll_SlowDown
--- PASS: TestPoll_SlowDown (0.00s)
=== RUN   TestPoll_ExpiredToken
--- PASS: TestPoll_ExpiredToken (0.00s)
=== RUN   TestPoll_AccessDenied
--- PASS: TestPoll_AccessDenied (0.00s)
=== RUN   TestPoll_Timeout
--- PASS: TestPoll_Timeout (0.00s)
=== RUN   TestPoll_ContextCancellation
--- PASS: TestPoll_ContextCancellation (0.00s)
PASS
ok      github.com/sourcegraph/src-cli/internal/oauthdevice     0.625s

Tested manually against my local SG

Amp thread

eseliger · 2025-12-03T13:40:55Z

cmd/src/login.go

+	}
+
+	fmt.Fprintln(out)
+	fmt.Fprintf(out, "🔐 To authenticate, visit %s and enter the code: %s\n", authResp.VerificationURI, authResp.UserCode)


no emojis in UI please 😬 since claude, this has an AI vibe slop feeling to it :(

valid :) I'll remove it

Removed. We need to do a larger sweep of the other emojis too :|

eseliger · 2025-12-03T13:42:28Z

cmd/src/login.go

+		fmt.Fprintln(out)
+		fmt.Fprintf(out, "To use this access token, set the following environment variables in your terminal:\n\n")
+		fmt.Fprintf(out, "   export SRC_ENDPOINT=%s\n", endpointArg)
+		fmt.Fprintf(out, "   export SRC_ACCESS_TOKEN=%s\n", cfg.AccessToken)


what you get here is not a SG access token, it's an oauth token and it comes with an access token and refresh token (and expiry) and needs to regularly be refreshed.

I think we need to store the accesstoken/refreshtoken pair in secure storage and add some http Transport that refreshes the credential as needed.

Will look at using https://github.com/99designs/keyring. We already use it with sg to store some secrets. It uses your OS keychain

oh nice, cross OS too :)

burmudar · 2025-12-08T10:42:03Z

This change is part of the following stack:

feat(oauth): use oauth device flow to authenticate with predefined src-cli OAuth client #1223 ◀
- feat(oauth): Add refresh to oauthdevice.Client #1227
  - feat(oauth): Use keyring to store oauth token #1228

_{Change managed by git-spice.}

burmudar · 2025-12-08T10:45:31Z

cmd/src/login.go

+	fmt.Fprintf(out, "To authenticate, visit %s and enter the code: %s\n", authResp.VerificationURI, authResp.UserCode)
+	if authResp.VerificationURIComplete != "" {
+		fmt.Fprintln(out)
+		fmt.Fprintf(out, "Alternatively, you can open: %s\n", authResp.VerificationURIComplete)


Should:

always try to open the browser

always print the url

keegancsmith · 2025-12-08T14:29:09Z

cmd/src/login.go

+
+  Use OAuth device flow to authenticate:
+
+    $ src login --device-flow https://sourcegraph.com


Do other CLI's require a flag for this? If I remember they are normally interactive right? You could still interactively decide between creating an access token vs oauth flows right?

No they don't. It just happens. The plan it to make it part of the normal flow if you don't have SRC_ACCESS_TOKEN set

src login is a misnomer currently haha, it should probably be renamed to src whoami and then src login is the interactive flow always 😬

keegancsmith · 2025-12-08T14:29:46Z

cmd/src/login.go

+
+  Override the default client id used during device flow when authenticating:
+
+    $ src login --device-flow https://sourcegraph.com --client-id sgo_my_own_client_id


doesn't seem worth supporting a custom client-id given you shipped a predefined one. If a user still hasn't upgraded sourcegraph just fallback to the old flow?

agreed. It's already removed just have to update

burmudar self-assigned this Dec 3, 2025

burmudar requested review from a team and eseliger December 3, 2025 13:37

burmudar marked this pull request as ready for review December 3, 2025 13:37

eseliger reviewed Dec 3, 2025

View reviewed changes

burmudar marked this pull request as draft December 4, 2025 06:51

burmudar added 7 commits December 8, 2025 12:26

removed unused func

004a382

update usage

9f9d240

spelling

bb43d20

remove emoji

85dc6a4

add refresh token to device response unmarshall

3c7d643

make NewClient take ClientID as param

75bf1b4

add flag to set client-id for device-flow

fd1668e

burmudar force-pushed the wb/add-oauth-device-flow branch from 465fe85 to fd1668e Compare December 8, 2025 10:40

This was referenced Dec 8, 2025

feat(oauth): Add refresh to oauthdevice.Client #1227

Draft

feat(oauth): Use keyring to store oauth token #1228

Draft

burmudar changed the title ~~feat(auth): use oauth device flow to authenticate with predefined src-cli OAuth client~~ feat(oauth): use oauth device flow to authenticate with predefined src-cli OAuth client Dec 8, 2025

burmudar commented Dec 8, 2025

View reviewed changes

keegancsmith reviewed Dec 8, 2025

View reviewed changes


		Use OAuth device flow to authenticate:

		$ src login --device-flow https://sourcegraph.com


		Override the default client id used during device flow when authenticating:

		$ src login --device-flow https://sourcegraph.com --client-id sgo_my_own_client_id

feat(oauth): use oauth device flow to authenticate with predefined src-cli OAuth client #1223

Are you sure you want to change the base?

feat(oauth): use oauth device flow to authenticate with predefined src-cli OAuth client #1223

Uh oh!

Conversation

burmudar commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test plan

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

burmudar commented Dec 8, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

burmudar commented Dec 3, 2025 •

edited

Loading