refactor(auth): improve authentication flow for oauth 2.0 with local webserver #325
Conversation
…webserver Signed-off-by: Gennady Lipenkov <xgen@yandex-team.ru>
GennadySpb
force-pushed
the
local-web-server
branch
from
0687cef to
6c76ecf
Compare
|
Hey @dbyron-sf ! Could your check out PR? |
I suspect @kskewes-sf is in a better position to review this. |
|
Sure, I remember the interactive cli driven flow and this looks interesting. |
| codeCh = make(chan string) | ||
|
|
||
| go http.Serve(listener, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { | ||
| // TODO: add handle of `error` |
There was a problem hiding this comment.
This is commented but new in this PR. Can you give an example of what error is here?
Could be something for a follow up PR.
|
|
||
| const localWebServer = "localhost:8085" | ||
|
|
||
| func startWebServer() (codeCh chan string, err error) { |
There was a problem hiding this comment.
Can you add a test for this please? - see: https://pkg.go.dev/net/http/httptest
We can validate:
codeFormValue is supplied in test and plumbed through to codeCh- http response recorder has correct output
- listener closed
errorFormValue (per next comment - if part of this PR).
| // openURL opens a browser window to the specified location. | ||
| // This code originally appeared at: | ||
| // http://stackoverflow.com/questions/10377243/how-can-i-launch-a-process-that-is-not-a-file-in-go | ||
| func openURL(url string) error { |
There was a problem hiding this comment.
Using a local web server or prompt is optional in the linked code and this seems quite robust. If local web server doesn't work then use the prompt. https://github.com/youtube/api-samples/blob/master/go/oauth2.go
I'm not sure what the failure modes are for the various openURL() commands, like exec hanging with no feedback. I've managed to misconfigure Linux for xdg-open more than once 😅
If an error is returned we bail out at L48 with log.Fatalf and there is no way for a user to progress unless they fix the exec issue.
I wonder if we might want to do something like:
a) fall back to prompt for code?
b) make localWebServer selectable via spin config (default enabled?) similer to https://github.com/youtube/api-samples/blob/07263305b59a7c3275bc7e925f9ce6cabf774022/go/oauth2.go#L44
WDYT?
Hello there!
PR is designed to minimize the use of interactive mode for OAuth 2.0 authentication.
The base for the extension is inspired by https://github.com/youtube/api-samples/blob/master/go/oauth2.go