feat(auth): add CLI auth module with token storage and browser login flow

Author: fullstackjam

internal/auth/auth.go

@@ -0,0 +1,106 @@
+package auth
+
+import (
+	"crypto/rand"
+	"encoding/json"
+	"fmt"
+	"math/big"
+	"os"
+	"path/filepath"
+	"time"
+)
+
+// StoredAuth represents the persisted authentication state for the CLI.
+type StoredAuth struct {
+	Token     string    `json:"token"`
+	Username  string    `json:"username"`
+	ExpiresAt time.Time `json:"expires_at"`
+	CreatedAt time.Time `json:"created_at"`
+}
+
+// TokenPath returns the path to the auth token file (~/.openboot/auth.json).
+func TokenPath() string {
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return ""
+	}
+	return filepath.Join(home, ".openboot", "auth.json")
+}
+
+// LoadToken reads and unmarshals the stored auth token from disk.
+// Returns nil, nil if the file does not exist or the token is expired.
+func LoadToken() (*StoredAuth, error) {
+	path := TokenPath()
+	data, err := os.ReadFile(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("failed to read auth file: %w", err)
+	}
+
+	var auth StoredAuth
+	if err := json.Unmarshal(data, &auth); err != nil {
+		return nil, fmt.Errorf("failed to parse auth file: %w", err)
+	}
+
+	if time.Now().After(auth.ExpiresAt) {
+		return nil, nil
+	}
+
+	return &auth, nil
+}
+
+// SaveToken persists the auth token to disk with restrictive permissions.
+func SaveToken(auth *StoredAuth) error {
+	path := TokenPath()
+
+	dir := filepath.Dir(path)
+	if err := os.MkdirAll(dir, 0700); err != nil {
+		return fmt.Errorf("failed to create auth directory: %w", err)
+	}
+
+	data, err := json.MarshalIndent(auth, "", "  ")
+	if err != nil {
+		return fmt.Errorf("failed to marshal auth data: %w", err)
+	}
+
+	if err := os.WriteFile(path, data, 0600); err != nil {
+		return fmt.Errorf("failed to write auth file: %w", err)
+	}
+
+	return nil
+}
+
+// DeleteToken removes the stored auth token file.
+func DeleteToken() error {
+	path := TokenPath()
+	err := os.Remove(path)
+	if err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("failed to delete auth file: %w", err)
+	}
+	return nil
+}
+
+// IsAuthenticated returns true if a valid, non-expired token exists on disk.
+func IsAuthenticated() bool {
+	auth, err := LoadToken()
+	return err == nil && auth != nil
+}
+
+// GenerateCode produces an 8-character uppercase alphanumeric code using
+// crypto/rand for secure randomness.
+func GenerateCode() string {
+	const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
+	code := make([]byte, 8)
+	for i := range code {
+		n, err := rand.Int(rand.Reader, big.NewInt(int64(len(charset))))
+		if err != nil {
+			// Extremely unlikely; fallback to a fixed value to avoid panic.
+			code[i] = 'X'
+			continue
+		}
+		code[i] = charset[n.Int64()]
+	}
+	return string(code)
+}

internal/auth/login.go

@@ -0,0 +1,149 @@
+package auth
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"os/exec"
+	"time"
+
+	"github.com/openbootdotdev/openboot/internal/ui"
+)
+
+const DefaultAPIBase = "https://openboot.dev"
+
+// GetAPIBase returns the API base URL, checking the OPENBOOT_API_URL
+// environment variable first and falling back to DefaultAPIBase.
+func GetAPIBase() string {
+	if base := os.Getenv("OPENBOOT_API_URL"); base != "" {
+		return base
+	}
+	return DefaultAPIBase
+}
+
+type cliStartRequest struct {
+	Code string `json:"code"`
+}
+
+type cliStartResponse struct {
+	CodeID string `json:"code_id"`
+}
+
+type cliPollResponse struct {
+	Status    string `json:"status"`
+	Token     string `json:"token,omitempty"`
+	Username  string `json:"username,omitempty"`
+	ExpiresAt string `json:"expires_at,omitempty"`
+}
+
+// LoginInteractive performs the full CLI-to-browser authentication flow:
+// generates a code, starts the auth session, opens the browser for approval,
+// and polls until approved or timed out.
+func LoginInteractive(apiBase string) (*StoredAuth, error) {
+	code := GenerateCode()
+
+	codeID, err := startAuthSession(apiBase, code)
+	if err != nil {
+		return nil, err
+	}
+
+	fmt.Fprintf(os.Stderr, "\n")
+	ui.Info(fmt.Sprintf("Your one-time code is: %s", ui.Green(code)))
+	fmt.Fprintf(os.Stderr, "\n")
+	ui.Info("Opening browser to approve...")
+
+	approvalURL := fmt.Sprintf("%s/cli-auth?code=%s", apiBase, code)
+	if err := openBrowser(approvalURL); err != nil {
+		ui.Warn(fmt.Sprintf("Could not open browser automatically. Please visit:\n  %s", approvalURL))
+	}
+
+	fmt.Fprintf(os.Stderr, "\nWaiting for approval...\n")
+
+	result, err := pollForApproval(apiBase, codeID)
+	if err != nil {
+		return nil, err
+	}
+
+	expiresAt, err := time.Parse(time.RFC3339, result.ExpiresAt)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse expiration time: %w", err)
+	}
+
+	stored := &StoredAuth{
+		Token:     result.Token,
+		Username:  result.Username,
+		ExpiresAt: expiresAt,
+		CreatedAt: time.Now(),
+	}
+
+	if err := SaveToken(stored); err != nil {
+		return nil, fmt.Errorf("failed to save auth token: %w", err)
+	}
+
+	ui.Success(fmt.Sprintf("Authenticated as %s", stored.Username))
+	return stored, nil
+}
+
+func startAuthSession(apiBase, code string) (string, error) {
+	body, err := json.Marshal(cliStartRequest{Code: code})
+	if err != nil {
+		return "", fmt.Errorf("failed to marshal start request: %w", err)
+	}
+
+	resp, err := http.Post(
+		fmt.Sprintf("%s/api/auth/cli/start", apiBase),
+		"application/json",
+		bytes.NewReader(body),
+	)
+	if err != nil {
+		return "", fmt.Errorf("failed to start auth session: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("auth start failed with status %d", resp.StatusCode)
+	}
+
+	var result cliStartResponse
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return "", fmt.Errorf("failed to parse auth start response: %w", err)
+	}
+
+	return result.CodeID, nil
+}
+
+func pollForApproval(apiBase, codeID string) (*cliPollResponse, error) {
+	pollURL := fmt.Sprintf("%s/api/auth/cli/poll?code_id=%s", apiBase, codeID)
+	timeout := time.After(5 * time.Minute)
+	ticker := time.NewTicker(2 * time.Second)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-timeout:
+			return nil, fmt.Errorf("authentication timed out after 5 minutes")
+		case <-ticker.C:
+			resp, err := http.Get(pollURL)
+			if err != nil {
+				continue
+			}
+
+			var result cliPollResponse
+			decodeErr := json.NewDecoder(resp.Body).Decode(&result)
+			resp.Body.Close()
+			if decodeErr != nil {
+				continue
+			}
+
+			if result.Status == "approved" {
+				return &result, nil
+			}
+		}
+	}
+}
+
+func openBrowser(url string) error {
+	return exec.Command("open", url).Start()
+}