gh auth login #1445

vilmibm · 2020-07-28T21:44:52Z

This PR adds gh auth login.

interactive mode - paste token

interactive mode - browser flow

non-interactive mode

Part of #1413

Open questions:

I'm not sure what support for the device auth flow looks like and was hoping follow up with that later; is that reasonable?
We're not set up to test the browser auth flow. Should I hack in support for that or continue to rely on manual testing?
For the survey-based tests, I didn't test the printing of informational messages to STDERR. I figured just ensuring that the correct config was written given a set of prompt stubs was good enough. Is it?

mislav

It's great that we're finally going to have this command 🎉

internal/config/testing.go

pkg/cmd/auth/login/login.go

mislav · 2020-07-30T13:21:36Z

pkg/cmd/auth/login/login_test.go

+		{
+			name: "hostname set",
+			opts: &LoginOptions{
+				Hostname: "rebecca.chambers",


pkg/prompt/stubber.go

mislav · 2020-07-30T13:27:30Z

pkg/cmd/auth/login/login.go

+		fmt.Fprintln(opts.IO.ErrOut)
+		fmt.Fprintln(opts.IO.ErrOut, heredoc.Doc(`
+				Tip: you can generate a Personal Access Token here https://github.com/settings/tokens
+				The minimum required scopes are 'repo' and 'read:org'.`))


Nit, but I'd be fine with printing information like this to stdout since it's part of the essential output of the login command. I do not expect that people will be redirecting stdout of login to a script or anyting

I'm torn; on the one hand, printing to STDOUT is absolutely fine here (and survey is using STDOUT). On the other, we print this kind of stuff to STDERR in other commands and I'd like to be consistent.

On the other, we print this kind of stuff to STDERR in other commands and I'd like to be consistent.

True. But the way I see it, the only reason we separate out "special" notices from regular output is because we expect that the user might be piping regular output to a file or a script. If the user is not doing that (for this command, they are not likely to), there is no incentive for us to print notices on a separate stream.

Some software writes to the tty in raw mode for these types of informational notices, so the text is neither in stdout nor stderr.

pkg/cmd/auth/login/login.go

mislav · 2020-07-30T15:42:51Z

I'm not sure what support for the device auth flow looks like and was hoping follow up with that later; is that reasonable?

Yes, I think device flow should absolutely be a follow-up. The device flow can be feature-detected and fits under the "Login with a web browser” flow as far as the user is concerned, so its implementation will not require almost any UI tweaks.

We're not set up to test the browser auth flow. Should I hack in support for that or continue to rely on manual testing?

Uh, I declared bankruptcy on testing the browser auth flow since I did not have any ideas how to stub it back then. If you do, that would be awesome! Especially because after this, I would really like us to opensource the auth package so hub can use it as well.

For the survey-based tests, I didn't test the printing of informational messages to STDERR. I figured just ensuring that the correct config was written given a set of prompt stubs was good enough. Is it?

I think that's good enough, especially since we might be tweaking the flow still. Credentials being correctly saved is most of what matters

vilmibm · 2020-07-30T20:53:52Z

note to self: do some bolding / green check / formatting on browser flow prompts

vilmibm · 2020-07-31T22:29:21Z

@mislav

I've...

rebased on ghe-api branch
properly validate scopes now (both in terms of handling admin:read and using the correct host)
made the login command create its own http client from an in-memory config
streamlined config interactions (only one write per command invocation, now)
added check for already having a valid authentication for the given host

mislav

Everything looks great; thank you!

The only potential blocker from my standpoint is GITHUB_TOKEN handling. As it stands, this branch only respects configuration from ~/.config/gh/hosts.yml file, but if a user supplied an invalid or revoked GITHUB_TOKEN via their environment, any attempt of a gh command will fail with a HTTP 401, but gh auth login will show “You're already logged into github.com as mislav. Do you want to re-authenticate?” And even if I went through re-authentication process, a new token will be written to my config file, but the old (broken) GITHUB_TOKEN from environment still takes precedence and sabotages my gh operations.

api/client.go

pkg/cmd/auth/login/login.go

mislav · 2020-08-04T10:58:51Z

pkg/cmd/auth/login/login.go

+				defer opts.IO.In.Close()
+				token, err := ioutil.ReadAll(opts.IO.In)


I'm not sure, but I think the logic to actually read the token from stdin might belong in loginRun instead of here. Typically, we used RunE so far to just to argument/flags processing, but avoided executing any command logic. I'm on the fence about this, so I could go either way. What do you think?

I was very unsure. I think this falls under the category of argument parsing if you consider the value on STDIN to be an argument. I felt that the "inputs" of this command were a hostname and a token and that loginRun should only care about those two things and be less concerned with whence they came. I decided to see how uncomfortable the testing felt and that turned out to feel fine so I'm content to leave it like this.

That reasoning makes sense!

pkg/cmd/auth/login/login.go

mislav · 2020-08-04T11:09:41Z

pkg/cmd/auth/login/login.go

+		fmt.Fprintln(opts.IO.ErrOut)
+		fmt.Fprintln(opts.IO.ErrOut, heredoc.Doc(`
+				Tip: you can generate a Personal Access Token here https://github.com/settings/tokens
+				The minimum required scopes are 'repo' and 'read:org'.`))


On the other, we print this kind of stuff to STDERR in other commands and I'd like to be consistent.

True. But the way I see it, the only reason we separate out "special" notices from regular output is because we expect that the user might be piping regular output to a file or a script. If the user is not doing that (for this command, they are not likely to), there is no incentive for us to print notices on a separate stream.

pkg/httpmock/stub.go

danshearer · 2020-08-05T09:39:24Z

This is an excellent improvement. Thanks!

Also, the wee screencasts let me see the entire scope of what you are trying to do in seconds. Great.

mislav

Just a minor point about GITHUB_TOKEN handling, but would be also fine if we addressed various authentication issues and error messaging around GITHUB_TOKEN in a follow-up. 🌟

mislav · 2020-08-05T18:25:31Z

pkg/cmd/auth/login/client.go

+	return nil
+}
+
+var clientFromCfg = func(hostname string, cfg config.Config) (*api.Client, error) {


Is there a reason why this and validateHostCfg are overridable functions (i.e. assigned to a var)?

clientFromCfg is overriden in tests; validateHostCfg is not and that's just vestigial, I'll fix that.

mislav · 2020-08-06T15:49:19Z

api/client.go


-// Returns whether or not scopes are present, appID, and error
-func (c Client) HasScopes(wantedScopes ...string) (bool, string, error) {
-	url := "https://api.github.com/user"


It's great that this no longer depends on the /user endpoint!

mislav · 2020-08-06T15:52:17Z

api/client.go

 	}

-	return false, appID, nil
+	if !search["read:org"] && !search["admin:org"] {


Love the simplicity of this new implementation for checking scopes 🏅

mislav · 2020-08-06T16:52:43Z

pkg/cmd/auth/login/login.go

+
+				opts.Token = strings.TrimSpace(string(token))
+			} else if ghToken != "" {
+				opts.Token = ghToken


I think that making GITHUB_TOKEN here indistinguishable from the one passed via --with-token is not the behavior that I would expect. That could result in GITHUB_TOKEN being stored to hosts.yml, which I don't think should ever happen since GITHUB_TOKEN is environment-only.

It's useful to think of GITHUB_TOKEN as credentials stored in a virtual layer "above" (and entirely separate of) hosts.yml. So I think that gh auth login/status should be aware of GITHUB_TOKEN being set and help you determine whether the credentials are valid, but they can't help you interactively refresh the credentials since only the user can change an environment variable.

That could result in GITHUB_TOKEN being stored to hosts.yml, which I don't think should ever happen since GITHUB_TOKEN is environment-only.

I was going quickly and didn't even think about this 🤦‍♀️ I will at least push a commit to not save the config if GITHUB_TOKEN is being validated.

mislav · 2020-08-06T16:55:40Z

pkg/cmd/auth/login/login.go

+			return errors.New("empty hostname would leak oauth_token")
+		}
+
+		err := cfg.Set(opts.Hostname, "oauth_token", opts.Token)


This only stores oauth_token key for a host and not the user key, but maybe that's fine since we don't really need the user key for anything other than reassurance for people manually inspecting their config file.

oh, that's a good point though; I might as well set that.

Merge pull request cli#1445 from cli/auth-cmd

tierninho · 2020-08-13T00:11:53Z

@vilmibm Curious if we need a URL validation on this as it accepts jibberish and even a blank space

? What account do you want to log into? GitHub Enterprise
? GHE hostname: ghsdfsdf
- Logging into ghsdfsdf
? How would you like to authenticate? Login with a web browser
- Press Enter to open ghsdfsdf in your browser...

The app hangs as the browser just goes to a dead page as expected.

Happy to open an issue if needed.

mislav mentioned this pull request Jul 28, 2020

Dedicated authentication command #1413

Closed

4 tasks

karr1d approved these changes Jul 29, 2020

View reviewed changes

ekr696-beep approved these changes Jul 29, 2020

View reviewed changes

vilmibm force-pushed the auth-cmd branch 2 times, most recently from cd8edcf to 9cbcab2 Compare July 29, 2020 21:41

ekr696-beep approved these changes Jul 29, 2020

View reviewed changes

vilmibm marked this pull request as ready for review July 29, 2020 21:53

vilmibm requested review from ampinsk and mislav July 29, 2020 21:53

vilmibm force-pushed the auth-cmd branch from 6d4eab5 to e9d1f42 Compare July 29, 2020 21:59

mislav suggested changes Jul 30, 2020

View reviewed changes

vilmibm changed the title ~~WIP gh auth login~~ gh auth login Jul 31, 2020

vilmibm changed the base branch from trunk to ghe-api July 31, 2020 22:12

vilmibm force-pushed the auth-cmd branch 2 times, most recently from f33828f to d1d310d Compare July 31, 2020 22:15

vilmibm requested a review from mislav July 31, 2020 22:17

mislav mentioned this pull request Aug 3, 2020

Add GHE compatibility to the API adapter #1415

Merged

5 tasks

Base automatically changed from ghe-api to trunk August 3, 2020 15:19

mislav suggested changes Aug 4, 2020

View reviewed changes

vilmibm force-pushed the auth-cmd branch from 6a4f7b5 to 0db226a Compare August 4, 2020 22:48

vilmibm requested a review from mislav August 4, 2020 22:59

vilmibm mentioned this pull request Aug 6, 2020

auth logout #1491

Merged

mislav approved these changes Aug 6, 2020

View reviewed changes

gh auth login

35f18b6

vilmibm force-pushed the auth-cmd branch from 1f20ce7 to 35f18b6 Compare August 6, 2020 17:43

vilmibm merged commit 813ac79 into trunk Aug 6, 2020

leodica added a commit to leodica/cli that referenced this pull request Aug 6, 2020

Merge pull request #1 from leodica/trunk

229d6b5

Merge pull request cli#1445 from cli/auth-cmd

mislav mentioned this pull request Aug 21, 2020

Authenticating without a browser #1562

Closed

Chuxel mentioned this pull request Aug 29, 2020

How to use GitHub CLI? microsoft/vscode-dev-containers#513

Closed

mislav deleted the auth-cmd branch September 7, 2020 09:47

bdougie mentioned this pull request Sep 15, 2020

"gh auth login" not working in the Action. domitriusclark/mdnext#40

Closed

shazron mentioned this pull request Jun 14, 2021

aio login without a browser (paste token) adobe/aio-cli-plugin-auth#54

Open

		defer opts.IO.In.Close()
		token, err := ioutil.ReadAll(opts.IO.In)

Uh oh!

gh auth login #1445

gh auth login #1445

Uh oh!

Conversation

vilmibm commented Jul 28, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

interactive mode - paste token

interactive mode - browser flow

non-interactive mode

Open questions:

Uh oh!

mislav left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mislav commented Jul 30, 2020

Uh oh!

vilmibm commented Jul 30, 2020

Uh oh!

vilmibm commented Jul 31, 2020

Uh oh!

mislav left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

danshearer commented Aug 5, 2020

Uh oh!

mislav left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tierninho commented Aug 13, 2020

vilmibm commented Jul 28, 2020 •

edited

Loading