feat(auth): add --all flag to auth login command (smart-mcp-proxy#267)

Add support for batch OAuth authentication with `mcpproxy auth login --all`.

Features:
- `--all` flag to authenticate all servers requiring login
- `--force` flag to bypass confirmation prompt
- Interactive confirmation showing server list and browser tab warning
- Detailed progress tracking with [n/m] indicators
- Summary report showing successes/failures with error details
- Suppresses usage output for operational errors (only shows for flag validation)

Examples:
  mcpproxy auth login --all
  mcpproxy auth login --all --force

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: technicalpickles

cmd/mcpproxy/auth_cmd.go

@@ -30,16 +30,20 @@ var (
 	authLoginCmd = &cobra.Command{
 		Use:   "login",
 		Short: "Manually authenticate with an OAuth-enabled server",
-		Long: `Manually trigger OAuth authentication flow for a specific upstream server.
+		Long: `Manually trigger OAuth authentication flow for a specific upstream server or all servers.
 This is useful when:
 - A server requires OAuth but automatic attempts have been rate limited
 - You want to authenticate proactively before using server tools
 - OAuth tokens have expired and need refreshing
+- Multiple servers need re-authentication
 
 The command will open your default browser for OAuth authorization.
+Use --all to authenticate all servers that require OAuth (confirmation prompt unless --force is used).
 
 Examples:
   mcpproxy auth login --server=Sentry-2
+  mcpproxy auth login --all
+  mcpproxy auth login --all --force
   mcpproxy auth login --server=github-server --log-level=debug
   mcpproxy auth login --server=google-calendar --timeout=5m`,
 		RunE: runAuthLogin,
@@ -82,6 +86,7 @@ Examples:
 	authConfigPath string
 	authTimeout    time.Duration
 	authAll        bool
+	authForce      bool
 )
 
 // GetAuthCommand returns the auth command for adding to the root command
@@ -96,7 +101,9 @@ func init() {
 	authCmd.AddCommand(authLogoutCmd)
 
 	// Define flags for auth login command
-	authLoginCmd.Flags().StringVarP(&authServerName, "server", "s", "", "Server name to authenticate with (required)")
+	authLoginCmd.Flags().StringVarP(&authServerName, "server", "s", "", "Server name to authenticate with")
+	authLoginCmd.Flags().BoolVar(&authAll, "all", false, "Authenticate all servers that require OAuth")
+	authLoginCmd.Flags().BoolVar(&authForce, "force", false, "Skip confirmation prompt when using --all")
 	authLoginCmd.Flags().StringVarP(&authLogLevel, "log-level", "l", "info", "Log level (trace, debug, info, warn, error)")
 	authLoginCmd.Flags().StringVarP(&authConfigPath, "config", "c", "", "Path to MCP configuration file (default: ~/.mcpproxy/mcp_config.json)")
 	authLoginCmd.Flags().DurationVar(&authTimeout, "timeout", 5*time.Minute, "Authentication timeout")
@@ -114,12 +121,8 @@ func init() {
 	authLogoutCmd.Flags().DurationVar(&authTimeout, "timeout", 30*time.Second, "Logout timeout")
 
 	// Mark required flags
-	err := authLoginCmd.MarkFlagRequired("server")
-	if err != nil {
-		panic(fmt.Sprintf("Failed to mark server flag as required: %v", err))
-	}
-
-	err = authLogoutCmd.MarkFlagRequired("server")
+	// Note: auth login doesn't mark --server as required because --all can be used instead
+	err := authLogoutCmd.MarkFlagRequired("server")
 	if err != nil {
 		panic(fmt.Sprintf("Failed to mark server flag as required: %v", err))
 	}
@@ -128,6 +131,12 @@ func init() {
 	authLoginCmd.Example = `  # Authenticate with Sentry-2 server
   mcpproxy auth login --server=Sentry-2
 
+  # Authenticate all servers that require OAuth
+  mcpproxy auth login --all
+
+  # Authenticate all servers without confirmation prompt
+  mcpproxy auth login --all --force
+
   # Authenticate with debug logging
   mcpproxy auth login --server=github-server --log-level=debug
 
@@ -150,7 +159,18 @@ func init() {
   mcpproxy auth logout --server=github-server --log-level=debug`
 }
 
-func runAuthLogin(_ *cobra.Command, _ []string) error {
+func runAuthLogin(cmd *cobra.Command, _ []string) error {
+	// Validate flags: either --server or --all must be provided (but not both)
+	if authAll && authServerName != "" {
+		return fmt.Errorf("cannot use both --server and --all flags together")
+	}
+	if !authAll && authServerName == "" {
+		return fmt.Errorf("either --server or --all flag is required")
+	}
+
+	// After validation, silence usage for operational errors
+	cmd.SilenceUsage = true
+
 	ctx, cancel := context.WithTimeout(context.Background(), authTimeout)
 	defer cancel()
 
@@ -160,6 +180,12 @@ func runAuthLogin(_ *cobra.Command, _ []string) error {
 		return fmt.Errorf("failed to load configuration: %w", err)
 	}
 
+	// Handle --all flag: authenticate all servers
+	if authAll {
+		return runAuthLoginAll(ctx, cfg.DataDir)
+	}
+
+	// Handle single server authentication
 	// Check if daemon is running and use client mode
 	if shouldUseAuthDaemon(cfg.DataDir) {
 		return runAuthLoginClientMode(ctx, cfg.DataDir, authServerName)
@@ -169,6 +195,122 @@ func runAuthLogin(_ *cobra.Command, _ []string) error {
 	return runAuthLoginStandalone(ctx, authServerName)
 }
 
+// runAuthLoginAll authenticates all servers that require OAuth authentication.
+func runAuthLoginAll(ctx context.Context, dataDir string) error {
+	// Auth login --all REQUIRES daemon
+	if !shouldUseAuthDaemon(dataDir) {
+		return fmt.Errorf("auth login --all requires running daemon. Start with: mcpproxy serve")
+	}
+
+	socketPath := socket.DetectSocketPath(dataDir)
+	logger, err := logs.SetupCommandLogger(false, authLogLevel, false, "")
+	if err != nil {
+		return fmt.Errorf("failed to create logger: %w", err)
+	}
+	defer func() { _ = logger.Sync() }()
+
+	client := cliclient.NewClient(socketPath, logger.Sugar())
+
+	// Ping daemon to verify connectivity
+	pingCtx, pingCancel := context.WithTimeout(ctx, 2*time.Second)
+	defer pingCancel()
+	if err := client.Ping(pingCtx); err != nil {
+		return fmt.Errorf("failed to connect to daemon: %w", err)
+	}
+
+	// Fetch all servers to find those that need OAuth authentication
+	servers, err := client.GetServers(ctx)
+	if err != nil {
+		return fmt.Errorf("failed to get servers from daemon: %w", err)
+	}
+
+	// Filter servers that need login (health.action == "login")
+	var serversNeedingAuth []string
+	for _, srv := range servers {
+		name, _ := srv["name"].(string)
+		if health, ok := srv["health"].(map[string]interface{}); ok && health != nil {
+			if action, ok := health["action"].(string); ok && action == "login" {
+				serversNeedingAuth = append(serversNeedingAuth, name)
+			}
+		}
+	}
+
+	if len(serversNeedingAuth) == 0 {
+		fmt.Println("✅ No servers require authentication")
+		fmt.Println("   All OAuth-enabled servers are already authenticated.")
+		return nil
+	}
+
+	// Display servers that will be authenticated
+	fmt.Println("━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━")
+	fmt.Println("🔐 Batch OAuth Authentication")
+	fmt.Println("━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━")
+	fmt.Printf("\nThe following %d server(s) require authentication:\n", len(serversNeedingAuth))
+	for i, name := range serversNeedingAuth {
+		fmt.Printf("  %d. %s\n", i+1, name)
+	}
+	fmt.Println()
+
+	// Show warning about multiple browser tabs
+	if len(serversNeedingAuth) > 1 {
+		fmt.Printf("⚠️  This will open %d browser tabs for OAuth authorization.\n\n", len(serversNeedingAuth))
+	}
+
+	// Prompt for confirmation unless --force is used
+	if !authForce {
+		fmt.Print("Do you want to continue? (yes/no): ")
+		var response string
+		if _, err := fmt.Scanln(&response); err != nil {
+			return fmt.Errorf("failed to read confirmation: %w", err)
+		}
+		response = strings.TrimSpace(strings.ToLower(response))
+		if response != "yes" && response != "y" {
+			fmt.Println("\n❌ Authentication cancelled")
+			return nil
+		}
+		fmt.Println()
+	}
+
+	// Authenticate each server
+	var successful, failed int
+	failedServers := make(map[string]string) // server name -> error message
+
+	fmt.Println("Starting authentication...")
+	fmt.Println()
+
+	for i, serverName := range serversNeedingAuth {
+		fmt.Printf("[%d/%d] Authenticating %s...\n", i+1, len(serversNeedingAuth), serverName)
+
+		if err := client.TriggerOAuthLogin(ctx, serverName); err != nil {
+			fmt.Printf("  ❌ Failed: %v\n", err)
+			failed++
+			failedServers[serverName] = err.Error()
+		} else {
+			fmt.Printf("  ✅ Success\n")
+			successful++
+		}
+		fmt.Println()
+	}
+
+	// Display summary
+	fmt.Println("━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━")
+	fmt.Println("📊 Authentication Summary")
+	fmt.Println("━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━")
+	fmt.Printf("Total: %d  |  Successful: %d  |  Failed: %d\n", len(serversNeedingAuth), successful, failed)
+
+	if failed > 0 {
+		fmt.Println("\n❌ Failed servers:")
+		for serverName, errMsg := range failedServers {
+			fmt.Printf("  • %s: %s\n", serverName, errMsg)
+		}
+		fmt.Println("\nTip: Run 'mcpproxy auth login --server=<name>' to retry individual servers")
+		return fmt.Errorf("%d server(s) failed to authenticate", failed)
+	}
+
+	fmt.Println("\n✅ All servers authenticated successfully!")
+	return nil
+}
+
 func runAuthStatus(_ *cobra.Command, _ []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), authTimeout)
 	defer cancel()

cmd/mcpproxy/auth_cmd_test.go

@@ -1,13 +1,16 @@
 package main
 
 import (
+	"context"
 	"runtime"
 	"strings"
 	"testing"
 
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/socket"
 
+	"github.com/spf13/cobra"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestShouldUseAuthDaemon(t *testing.T) {
@@ -47,3 +50,134 @@ func TestDetectSocketPath_Auth(t *testing.T) {
 			"Unix socket should have unix:// prefix")
 	}
 }
+
+func TestAuthLogin_FlagValidation(t *testing.T) {
+	tests := []struct {
+		name        string
+		serverName  string
+		allFlag     bool
+		wantErr     bool
+		errContains string
+	}{
+		{
+			name:        "both server and all flags",
+			serverName:  "test-server",
+			allFlag:     true,
+			wantErr:     true,
+			errContains: "cannot use both --server and --all",
+		},
+		{
+			name:        "neither server nor all flags",
+			serverName:  "",
+			allFlag:     false,
+			wantErr:     true,
+			errContains: "either --server or --all flag is required",
+		},
+		{
+			name:       "only server flag - valid",
+			serverName: "test-server",
+			allFlag:    false,
+			wantErr:    false, // validation passes, but will fail later due to no daemon
+		},
+		{
+			name:       "only all flag - valid",
+			serverName: "",
+			allFlag:    true,
+			wantErr:    false, // validation passes, but will fail later due to no daemon
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Set up test flags
+			authServerName = tt.serverName
+			authAll = tt.allFlag
+			authConfigPath = "" // Use default
+			authTimeout = 0     // Will use command default
+
+			// Create a mock command
+			cmd := &cobra.Command{
+				Use: "login",
+			}
+
+			// Run the validation logic (first part of runAuthLogin)
+			err := runAuthLogin(cmd, []string{})
+
+			if tt.wantErr {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.errContains)
+			} else {
+				// For these cases, we expect failure due to no daemon/config,
+				// but NOT due to flag validation
+				if err != nil {
+					assert.NotContains(t, err.Error(), "cannot use both")
+					assert.NotContains(t, err.Error(), "either --server or --all")
+				}
+			}
+
+			// Reset flags
+			authServerName = ""
+			authAll = false
+		})
+	}
+}
+
+func TestAuthLogin_SilenceUsageAfterValidation(t *testing.T) {
+	// Set up valid flags
+	authServerName = "test-server"
+	authAll = false
+	authConfigPath = "" // Use default, will fail to load but that's after validation
+	defer func() {
+		authServerName = ""
+		authAll = false
+	}()
+
+	cmd := &cobra.Command{
+		Use: "login",
+	}
+
+	// SilenceUsage should be false initially
+	assert.False(t, cmd.SilenceUsage, "SilenceUsage should be false initially")
+
+	// Run the command (it will fail due to no config, but we just check the flag)
+	_ = runAuthLogin(cmd, []string{})
+
+	// SilenceUsage should be true after flag validation
+	assert.True(t, cmd.SilenceUsage, "SilenceUsage should be true after flag validation")
+}
+
+func TestRunAuthLoginAll_NoDaemon(t *testing.T) {
+	ctx := context.Background()
+	tmpDir := t.TempDir()
+
+	err := runAuthLoginAll(ctx, tmpDir)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "requires running daemon")
+}
+
+func TestAuthLogin_ForceFlagWithoutAll(t *testing.T) {
+	// The --force flag should only be meaningful with --all
+	// but it's not an error to use it with --server (it just has no effect)
+	authServerName = "test-server"
+	authAll = false
+	authForce = true
+	authConfigPath = ""
+	defer func() {
+		authServerName = ""
+		authAll = false
+		authForce = false
+	}()
+
+	cmd := &cobra.Command{
+		Use: "login",
+	}
+
+	// This should not fail validation
+	err := runAuthLogin(cmd, []string{})
+
+	// It will fail for other reasons (no daemon/config), but not validation
+	if err != nil {
+		assert.NotContains(t, err.Error(), "cannot use both")
+		assert.NotContains(t, err.Error(), "either --server or --all")
+	}
+}