Repository navigation
feat(auth): log in with Auth0's device flow - #469
Merged
Merged
Conversation
Every device flow step merges here. This branch merges into main at release time, with a merge commit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Adds the building blocks for device flow login. Nothing calls them yet: src/lib/auth0.ts (the device code and token requests, polling, DeviceFlowError), the host to Auth0 tenant table in src/auth.ts, and a fake Auth0 server with temporary tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
finishLogin() forgets the tracked user and reads /user/profile once, which also creates the Prismic user for a new social or SSO signup. It returns the email for C4's "Logged in" message. Nothing calls it yet. Co-authored-by: lihbr <lihbr@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Adds the credential store for device flow logins. Nothing calls it yet: src/credentials.ts (one keychain key per config directory, the encrypted credentials.enc, a plaintext fallback whose reason is kept for telemetry, and older credential files), src/lib/keyring.ts (/usr/bin/security on macOS, @napi-rs/keyring elsewhere, now a dependency) and src/lib/lock.ts (the credentials.lock directory lock), with temporary tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
) Adds login details to the "Prismic CLI End" event instead of new events. Nothing sets them yet: store and storeReason on every command (initTracking), loginResult, loginResumed and loginDurationS after a login (trackLogin), and revoked after a logout (trackLogout). getLoginResult maps DeviceFlowError reasons onto loginResult. Start and End stay the same until C4 calls these, with temporary tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Adds token refresh for device flow logins. Nothing calls it yet: getSessionToken() in src/auth.ts (returns the saved token while it has more than 5 minutes left, otherwise refreshes under the credentials lock with the tenant saved with the session, ends the session on invalid_grant, and keeps the current token while Auth0 can't be reached) and refreshAccessToken() in src/lib/auth0.ts, with temporary tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Adds revokeRefreshToken() to src/lib/auth0.ts, and endSession() and replaceSession() to src/auth.ts. endSession() revokes the session at the Auth0 tenant that issued it, then deletes the saved login, the keychain key and the tracked user, keeps the host, and returns { revoked, warnings }. replaceSession() saves a new login, then revokes the previous session. Nothing calls them until C4. Temporary tests use the fake Auth0 server.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The CLI put the token in the /validate URL as ?token=, where logs can capture it. It now sends it as an Authorization: Bearer header, like the other Prismic requests. With no token, it still sends no credentials. Needs authentication-server#123, in prod since Nov 13. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`prismic login`, `prismic init` and the automatic login use Auth0's device flow. The CLI shows a link and a code to approve on any device, so remote machines and AI agents can log in. An agent stops after 90 seconds, and its next run continues the same code. Logins go to the new keychain-backed store, refresh under a lock, and logout revokes them at Auth0. The localhost login server and the old background refresh are gone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
lihbr
marked this pull request as ready for review
November 13, 2026 02:50
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 5eface2. Configure here.
1 of 3 tasks
…484) A Ctrl-C while a new login was being saved printed "Login cancelled." and recorded a cancel, although the login had saved. The save keeps the credentials lock while it revokes the previous session, and the Ctrl-C handler waited for that lock. The handler now checks whether the login saved, prints "Logged in to Prismic." and records a success. It still exits 130. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The four Auth0 requests now send `User-Agent: prismic-cli/<version> (<platform>)`. Auth0 keeps it with each login, so the dashboard's profile page can show which CLI version and system each login came from. Requests to Prismic keep the plain `prismic-cli`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
With Auth0's device flow,
prismic loginandprismic initprint a link and a code, and you log in by approving them in any browser.Plan: https://app.notion.com/p/40e3bee086698197b150c01b9f8a4c78
/validatein a header. Merges once the backend accepts it.prismic login --helptextThis branch has Angelo's #445 (one client file) and #478 (log in again when a token is refused) from
main. C4 switches #478's login to the device flow.Merge with a merge commit, not a squash, so each step's commit reaches the changelog.
🤖 Generated with Claude Code
Note
High Risk
Overhauls authentication, token storage, encryption, and concurrent login/logout behavior—security-critical paths for every CLI command.
Overview
Replaces the old localhost callback login with Auth0’s device flow:
prismic login/prismic initprint a verification URL and user code, poll until approval, and store access + refresh tokens with automatic renewal on 401s (no more detached refresh subprocess).Adds a
credentialslayer that persists sessions in the OS keyring when possible (macOSsecurity, elsewhere@napi-rs/keyring) or falls back to a versioned credentials file, optionally AES-encrypted (credentials.enc), with file locks so parallel CLI processes can resume or coordinate logins. Logout now revokes the refresh token and clears stored secrets while keeping the host.Auth0 requests carry
User-Agent: prismic-cli/<version> (<platform>)for dashboard attribution. Telemetry records login outcome, store mode, and revocation. Tests use a fake Auth0 server and fixtures; CI adds a macOS job for login-related tests that depend on keychain behavior.Reviewed by Cursor Bugbot for commit 30624f0. Bugbot is set up for automated code reviews on this repo. Configure here.