default auth url, api url to ~/.config/stacker/config.yml, device authorization

Author: robotizeit

install.sh

@@ -105,6 +105,38 @@ download_and_install() {
     fi
 
     ok "Installed stacker v${version} to ${INSTALL_DIR}/${BINARY_NAME}"
+
+    write_user_config
+}
+
+# ── Write user config ────────────────────────────────
+
+write_user_config() {
+    local config_dir config_file
+
+    config_dir="${XDG_CONFIG_HOME:-${HOME}/.config}/stacker"
+    config_file="${config_dir}/config.yml"
+
+    mkdir -p "$config_dir"
+
+    if [ -f "$config_file" ]; then
+        info "User config already exists at ${config_file} — skipping"
+        return
+    fi
+
+    cat > "$config_file" <<'EOF'
+# Stacker CLI user configuration
+# Priority: CLI flag > environment variable > this file > built-in default
+
+auth_url: https://try.direct/server/user
+server_url: https://try.direct/stacker
+
+login:
+  browser: true
+  provider: gc   # gc = Google, gh = GitHub
+EOF
+
+    ok "Wrote default config to ${config_file}"
 }
 
 # ── Verify install ───────────────────────────────────

src/bin/stacker.rs

@@ -67,6 +67,15 @@ enum StackerCommands {
         /// Stacker API base URL (or set STACKER_URL)
         #[arg(long = "server-url", visible_alias = "api-url")]
         server_url: Option<String>,
+        /// Authenticate via browser OAuth2 flow (opens a sign-in URL)
+        #[arg(long)]
+        browser: bool,
+        /// OAuth provider code for browser login: gc (Google), gh (GitHub), … (default: gc)
+        #[arg(long, value_name = "PROVIDER")]
+        provider: Option<String>,
+        /// Log in with username/password instead of browser OAuth (skips browser flow)
+        #[arg(short = 'u', long, value_name = "EMAIL")]
+        user: Option<String>,
     },
     /// Show the saved login and current project's recorded deploy identity
     Whoami {},
@@ -1704,8 +1713,11 @@ fn get_command(
             domain,
             auth_url,
             server_url,
+            browser,
+            provider,
+            user,
         } => Box::new(stacker::console::commands::cli::login::LoginCommand::new(
-            org, domain, auth_url, server_url,
+            org, domain, auth_url, server_url, browser, provider, user,
         )),
         StackerCommands::Whoami {} => {
             Box::new(stacker::console::commands::cli::whoami::WhoamiCommand::new())

src/cli/credentials.rs

@@ -264,6 +264,7 @@ fn resolve_auth_url(request: &LoginRequest) -> Result<String, CliError> {
         .clone()
         .or_else(|| std::env::var("STACKER_AUTH_URL").ok())
         .or_else(|| std::env::var("STACKER_API_URL").ok())
+        .or_else(|| crate::cli::user_config::UserConfig::load().auth_url)
         .ok_or_else(|| {
             CliError::ConfigValidation(
                 "Missing auth URL. Pass `stacker login --auth-url <user-service-url> --server-url <stacker-api-url>` or set STACKER_AUTH_URL (or STACKER_API_URL) and STACKER_URL.".to_string(),
@@ -276,6 +277,7 @@ fn resolve_server_url(request: &LoginRequest) -> Result<String, CliError> {
         .server_url
         .clone()
         .or_else(|| std::env::var("STACKER_URL").ok())
+        .or_else(|| crate::cli::user_config::UserConfig::load().server_url)
         .map(|value| crate::cli::install_runner::normalize_stacker_server_url(&value))
         .ok_or_else(|| {
             CliError::ConfigValidation(
@@ -404,6 +406,257 @@ impl fmt::Display for StoredCredentials {
     }
 }
 
+// ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+// RFC 8628 Device Authorization Grant helpers
+// ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+/// Strip a trailing `/auth/login` suffix so we always work from the user-service
+/// base URL (e.g. `https://try.direct/server/user`).
+fn oauth_base_url(auth_url: &str) -> String {
+    let url = auth_url.trim_end_matches('/');
+    for suffix in &["/auth/login", "/server/user/auth/login"] {
+        if let Some(base) = url.strip_suffix(suffix) {
+            return base.to_string();
+        }
+    }
+    url.to_string()
+}
+
+/// Response from `POST /oauth_client/device_authorization`.
+struct DeviceAuthResponse {
+    device_code: String,
+    user_code: String,
+    verification_uri: String,
+    verification_uri_complete: String,
+    expires_in: u64,
+    interval: u64,
+}
+
+/// RFC 8628 §3.1 — Device Authorization Request.
+///
+/// POSTs `{"client_id": "stacker-cli", "provider": "<gc|gh|...>"}` and returns
+/// the server-generated codes the CLI needs to display and poll with.
+fn request_device_authorization(
+    base_url: &str,
+    provider: &str,
+) -> Result<DeviceAuthResponse, CliError> {
+    let endpoint = format!("{base_url}/oauth_client/device_authorization");
+
+    let client = reqwest::blocking::Client::builder()
+        .timeout(std::time::Duration::from_secs(30))
+        .build()
+        .map_err(|e| CliError::AuthFailed(format!("HTTP client error: {e}")))?;
+
+    let body = serde_json::json!({ "client_id": "stacker-cli", "provider": provider });
+    let resp = client
+        .post(&endpoint)
+        .json(&body)
+        .send()
+        .map_err(|e| CliError::AuthFailed(format!("Network error: {e}")))?;
+
+    if !resp.status().is_success() {
+        let status = resp.status();
+        let preview: String = resp.text().unwrap_or_default().chars().take(200).collect();
+        return Err(CliError::AuthFailed(format!(
+            "Device authorization failed ({status}): {preview}"
+        )));
+    }
+
+    let data: serde_json::Value = resp
+        .json()
+        .map_err(|e| CliError::AuthFailed(format!("Invalid response: {e}")))?;
+    let inner = data.get("data").unwrap_or(&data);
+
+    let field = |key: &str| -> Result<String, CliError> {
+        inner
+            .get(key)
+            .and_then(|v| v.as_str())
+            .map(|s| s.to_string())
+            .ok_or_else(|| CliError::AuthFailed(format!("Response missing `{key}`: {data}")))
+    };
+
+    Ok(DeviceAuthResponse {
+        device_code:               field("device_code")?,
+        user_code:                 field("user_code")?,
+        verification_uri:          field("verification_uri")?,
+        verification_uri_complete: field("verification_uri_complete")?,
+        expires_in: inner.get("expires_in").and_then(|v| v.as_u64()).unwrap_or(300),
+        interval:   inner.get("interval").and_then(|v| v.as_u64()).unwrap_or(5),
+    })
+}
+
+/// RFC 8628 §3.4 — Device Access Token Request (polling).
+///
+/// Polls `POST /oauth_client/device_token` every `interval` seconds.
+/// Handles `authorization_pending` (keep waiting), `slow_down` (+5 s),
+/// `access_denied`, and `expired_token` per the spec.
+fn poll_device_token(
+    base_url: &str,
+    device_code: &str,
+    interval_secs: u64,
+    expires_in: u64,
+) -> Result<(String, Option<String>, Option<u64>), CliError> {
+    let endpoint = format!("{base_url}/oauth_client/device_token");
+
+    let client = reqwest::blocking::Client::builder()
+        .timeout(std::time::Duration::from_secs(15))
+        .build()
+        .map_err(|e| CliError::AuthFailed(format!("HTTP client error: {e}")))?;
+
+    let body = serde_json::json!({
+        "grant_type": "urn:ietf:params:oauth:grant-type:device_code",
+        "device_code": device_code,
+        "client_id": "stacker-cli",
+    });
+
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(expires_in);
+    let mut interval = std::time::Duration::from_secs(interval_secs);
+
+    loop {
+        std::thread::sleep(interval);
+
+        if std::time::Instant::now() >= deadline {
+            return Err(CliError::AuthFailed(
+                "Authentication timed out. Please try again.".to_string(),
+            ));
+        }
+
+        let resp = match client.post(&endpoint).json(&body).send() {
+            Ok(r) => r,
+            Err(_) => continue, // transient network error — keep polling
+        };
+
+        let status = resp.status();
+        let data: serde_json::Value = resp.json().unwrap_or(serde_json::Value::Null);
+
+        if status.is_success() {
+            let access_token = data
+                .get("access_token")
+                .and_then(|v| v.as_str())
+                .ok_or_else(|| {
+                    CliError::AuthFailed("Token response missing access_token".to_string())
+                })?
+                .to_string();
+            let refresh_token = data
+                .get("refresh_token")
+                .and_then(|v| v.as_str())
+                .map(|s| s.to_string());
+            let token_expires_in = data.get("expires_in").and_then(|v| v.as_u64());
+            return Ok((access_token, refresh_token, token_expires_in));
+        }
+
+        // RFC 8628 §3.5 error codes
+        match data.get("error").and_then(|v| v.as_str()) {
+            Some("authorization_pending") => {} // normal — keep polling
+            Some("slow_down") => interval += std::time::Duration::from_secs(5),
+            Some("access_denied") => {
+                return Err(CliError::AuthFailed("Access denied by user.".to_string()))
+            }
+            Some("expired_token") => {
+                return Err(CliError::AuthFailed(
+                    "Session expired. Please run `stacker login` again.".to_string(),
+                ))
+            }
+            Some(other) => {
+                return Err(CliError::AuthFailed(format!("Auth error: {other}")))
+            }
+            None => {} // unexpected non-200 without error field — keep polling
+        }
+    }
+}
+
+/// Retrieve the authenticated user's email from the user service.
+pub fn fetch_user_email(auth_url: &str, access_token: &str) -> Result<Option<String>, CliError> {
+    let base = oauth_base_url(auth_url);
+    let endpoint = format!("{base}/oauth_server/api/me");
+
+    let client = reqwest::blocking::Client::builder()
+        .timeout(std::time::Duration::from_secs(15))
+        .build()
+        .map_err(|e| CliError::AuthFailed(format!("HTTP client error: {e}")))?;
+
+    let resp = client
+        .get(&endpoint)
+        .bearer_auth(access_token)
+        .send()
+        .map_err(|e| CliError::AuthFailed(format!("Network error fetching user profile: {e}")))?;
+
+    if !resp.status().is_success() {
+        return Ok(None);
+    }
+
+    let data: serde_json::Value = resp.json().unwrap_or(serde_json::Value::Null);
+    // /oauth_server/api/me returns {"user": {"email": ...}}
+    let email = data.get("email")
+        .or_else(|| data.get("user").and_then(|u| u.get("email")))
+        .and_then(|v| v.as_str())
+        .map(|s| s.to_string());
+    Ok(email)
+}
+
+/// RFC 8628 Device Authorization Grant login flow.
+///
+/// 1. Requests device + user codes from the server.
+/// 2. Shows the user_code and opens the browser to the OAuth URL.
+/// 3. Polls until the user authenticates or the session expires.
+/// 4. Saves and returns the credentials.
+pub fn browser_login<S: CredentialStore>(
+    store: &CredentialsManager<S>,
+    auth_url: &str,
+    server_url: &str,
+    provider: &str,
+    org: Option<&str>,
+    domain: Option<&str>,
+) -> Result<StoredCredentials, CliError> {
+    let base = oauth_base_url(auth_url);
+    let device_auth = request_device_authorization(&base, provider)?;
+
+    eprintln!("\nTo sign in, open this URL in your browser:");
+    eprintln!("  {}", device_auth.verification_uri_complete);
+    eprintln!();
+
+    let opened = {
+        #[cfg(target_os = "macos")]
+        { std::process::Command::new("open").arg(&device_auth.verification_uri_complete).status().is_ok() }
+        #[cfg(target_os = "linux")]
+        { std::process::Command::new("xdg-open").arg(&device_auth.verification_uri_complete).status().is_ok() }
+        #[cfg(not(any(target_os = "macos", target_os = "linux")))]
+        { false }
+    };
+    if opened {
+        eprintln!("  (Browser opened automatically)");
+    }
+
+    eprintln!("Waiting for authentication...");
+
+    let (access_token, refresh_token, token_expires_in) = poll_device_token(
+        &base,
+        &device_auth.device_code,
+        device_auth.interval,
+        device_auth.expires_in,
+    )?;
+
+    let email = fetch_user_email(auth_url, &access_token)?;
+
+    let min_ttl = session_ttl_secs();
+    let ttl = token_expires_in.unwrap_or(min_ttl).max(min_ttl);
+    let expires_at = chrono::Utc::now() + chrono::Duration::seconds(ttl as i64);
+
+    let creds = StoredCredentials {
+        access_token,
+        refresh_token,
+        token_type: "Bearer".to_string(),
+        expires_at,
+        email,
+        server_url: Some(crate::cli::install_runner::normalize_stacker_server_url(server_url)),
+        org: org.map(|s| s.to_string()),
+        domain: domain.map(|s| s.to_string()),
+    };
+
+    store.save(&creds)?;
+    Ok(creds)
+}
+
 // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 // Tests
 // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

src/cli/mod.rs

@@ -32,3 +32,4 @@ pub mod runtime;
 pub mod service_catalog;
 pub mod service_import;
 pub mod stacker_client;
+pub mod user_config;