Function browser_auth_flow

crates/openshell-cli/src/auth.rs:91–176

Run the browser-based CF Access auth flow. 1. Generates a one-time confirmation code 2. Starts an ephemeral localhost HTTP server 3. Opens the browser to the gateway's `/auth/connect` page 4. Waits for the XHR POST callback with the CF JWT and matching code 5. Returns the token

(gateway_endpoint: &str)

/// 4. Waits for the XHR POST callback with the CF JWT and matching code
/// 5. Returns the token
pub async fn browser_auth_flow(gateway_endpoint: &str) -> Result<String> {
    // Short-circuit when the browser is suppressed (CI, e2e tests, headless
    // environments).  Without this early return the function still binds a TCP
    // listener, spawns a callback server, and waits the full AUTH_TIMEOUT
    // (120 s) for a POST that will never arrive.
    let no_browser = std::env::var("OPENSHELL_NO_BROWSER")
        .is_ok_and(|v| v == "1" || v.eq_ignore_ascii_case("true"));
    if no_browser {
        return Err(miette::miette!(
            "authentication skipped (OPENSHELL_NO_BROWSER is set).\n\
             Authenticate later with: openshell gateway login"
        ));
    }

    #[cfg(test)]
    if std::env::var("OPENSHELL_TEST_BROWSER_AUTH_FAIL")
        .is_ok_and(|v| v == "1" || v.eq_ignore_ascii_case("true"))
    {
        return Err(miette::miette!(
            "browser authentication failed (OPENSHELL_TEST_BROWSER_AUTH_FAIL is set)"
        ));
    }

    let listener = TcpListener::bind("127.0.0.1:0").await.into_diagnostic()?;
    let local_addr = listener.local_addr().into_diagnostic()?;
    let callback_port = local_addr.port();

    let code = generate_confirmation_code();

    let auth_url = format!(
        "{}/auth/connect?callback_port={callback_port}&code={code}",
        gateway_endpoint.trim_end_matches('/')
    );

    // Channel to receive the token from the callback handler.
    let (tx, rx) = oneshot::channel::<String>();

    // Spawn the callback server.
    let server_handle = tokio::spawn(run_callback_server(
        listener,
        tx,
        code.clone(),
        gateway_endpoint.to_string(),
    ));

    // Prompt the user before opening the browser.
    eprintln!("  Confirmation code: {code}");
    eprintln!("  Verify this code matches your browser before clicking Connect.");
    eprintln!();

    eprint!("Press Enter to open the browser for authentication...");
    std::io::stderr().flush().ok();
    let mut input = String::new();
    std::io::stdin().read_line(&mut input).ok();
    drop(input);

    if let Err(e) = open_browser_url(&auth_url) {
        debug!(error = %e, "failed to open browser");