Repository navigation
Add Google and magic link logins, read mod-api 3.9.0 tokens (3.0.0) - #7
Merged
Merged
Conversation
- New `auth login-google` and `auth login-magiclink` request API tokens (aud=api) with a random state the local server checks - Browser logins open the browser and accept the token from the local redirect or pasted into the terminal, whichever arrives first; `login-sso` uses the same flow and drops -d and its confirmation prompt - `-y` is kept on every login command as a hidden no-op for existing scripts - MOD-branded sign-in pages, shipped as package data - Split modules: auth (API calls), token_receiver (local server + paste), pages, cli (terminal and browser interaction) - Decode the JWT payload as base64url - Add tests, run them in CI along with a uv install and a package-data check Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
login-sso sends a random state like the other browser logins, and the local server only accepts a redirect carrying it, so a web page probing localhost ports can't log the CLI in with another account's token. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mod-api 3.9.0 tokens carry the user in `sub` instead of `user_id`. No fallback: tokens minted before the cutover are rejected by the API anyway. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Logins need mod-api 3.9.0's token format (aud, sub); released CLIs fail after login against it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
auth login-forum signs in through the API's /users/tokens_modforum. login-sso stays as a hidden alias, so scripts using it keep working. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Windows tries ::1 first for localhost and spends ~2s on each refused connection, so the five-request test ran past the receiver's timeout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…in CI - every OS runs the oldest and newest Python, 3.11-3.13 run on Linux only - the pip and uv jobs run the tests against the installed package - lowest-deps job runs the tests on click 8.0 and Python 3.10 - lint job runs pylint --errors-only - tests for the config files and the bundle tarball - drop ubuntu-22.04, cancel superseded runs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The CLI waited a hardcoded 15 minutes, a copy of mod-api's default MOD_MAGICLINK_TTL. POST /users/tokens_magiclink now returns expires_in, and the wait comes from there; the forum and Google logins keep their own five minutes, so every start returns the state and how long to wait. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Logins against mod-api 3.9.0, whose tokens carry the user in
subinstead ofuser_id. Released CLIs readuser_idand fail after every login against it, so this is a major bump: 3.0.0.New logins
modcli auth login-google: Google account, opens the browsermodcli auth login-magiclink [--email]: sign-in link sent by email; confirm it in the browser on this machinemodcli auth login-forum: MOD Forum account, opens the browser (waslogin-sso, kept as a hidden alias so scripts keep working)modcli auth login: username and password, unchangedEvery browser login requests an API token (
aud=api) and sends a randomstatewith itslocal_url. The local server accepts only a redirect carrying thatstate, so a web page probing localhost ports can't log the CLI in with someone else's token. The token is accepted from the local redirect or pasted into the terminal, whichever arrives first; when the browser runs on another machine (CLI over SSH), paste the token the result page shows.login-ssodrops-dand its confirmation prompt.-ystays on every login command as a hidden no-op.Other changes
config.set_tokenreadssub(no fallback: tokens minted before the cutover are rejected by the API anyway) and decodes the payload as base64urlauth(API calls and URLs),token_receiver(local server and paste),pages+sign_in.html(shipped as package data),cli(terminal and browser interaction)uv run pytest), run in CI with a uv install and a package-data check;devis a dependency groupCompatibility
subuser_idfrom tokens