use std::io::{self, Write};
use std::sync::Arc;
use std::time::Duration;
use anyhow::{anyhow, Context, Result};
use reqwest::Url;
use time::OffsetDateTime;
use crate::engine::platform::open_url;
use crate::lf::AuthCommand;
use crate::lfd::events::EventHub;
use crate::lfd::provider_auth::{AuthStatus, Provider, ProviderAuthService, ProviderAuthSnapshot};
use crate::lfd::store::{open_store, CredentialType, ProviderToken, SharedStore};
const AUTH_STATUS_POLL_TIMEOUT: Duration = Duration::from_secs(180);
const AUTH_STATUS_POLL_INTERVAL: Duration = Duration::from_secs(1);
pub fn run(cmd: &AuthCommand) -> Result<()> {
let rt = tokio::runtime::Runtime::new().context("failed to create async runtime")?;
rt.block_on(run_async(cmd))
}
async fn run_async(cmd: &AuthCommand) -> Result<()> {
match cmd {
AuthCommand::Status { provider } => status(provider.as_deref()).await,
AuthCommand::Disconnect { provider } => disconnect(provider).await,
AuthCommand::Configure { provider } => configure(provider).await,
AuthCommand::Connect { provider } => connect(provider).await,
AuthCommand::External(args) => {
let provider = args
.first()
.ok_or_else(|| anyhow!("usage: lf op auth <provider>"))?;
if args.len() > 1 {
return Err(anyhow!(
"unexpected auth arguments: {}",
args[1..].join(" ")
));
}
connect(provider).await
}
}
}
async fn status(provider: Option<&str>) -> Result<()> {
let service = local_auth_service().await?;
match provider {
Some(raw) => {
let snapshot = service.status(parse_provider(raw)?).await?;
println!("{}", format_snapshot(&snapshot));
}
None => {
for snapshot in service.list_statuses().await? {
println!("{}", format_snapshot(&snapshot));
}
}
}
Ok(())
}
async fn connect(raw_provider: &str) -> Result<()> {
let provider = parse_provider(raw_provider)?;
let service = local_auth_service().await?;
let flow = service.start_auth(provider, EventHub::new(16)).await?;
let verification_url = flow
.verification_uri_complete
.clone()
.unwrap_or_else(|| flow.verification_uri.clone());
println!(
"Opening {} auth in your browser...",
provider.display_name()
);
println!("If the browser does not open, visit:\n{verification_url}");
open_url(&verification_url);
if provider == Provider::Asana {
complete_oauth_code_paste(&service, provider).await?;
}
wait_for_active_status(&service, provider, flow.expires_in).await
}
async fn disconnect(raw_provider: &str) -> Result<()> {
let provider = parse_provider(raw_provider)?;
let service = local_auth_service().await?;
service.disconnect(provider, EventHub::new(16)).await?;
let snapshot = service.status(provider).await?;
if matches!(snapshot.status, AuthStatus::None) {
println!("Disconnected {}", provider.display_name());
} else {
println!("Updated {}", format_snapshot(&snapshot));
}
Ok(())
}
async fn configure(raw_provider: &str) -> Result<()> {
let provider = parse_provider(raw_provider)?;
if let Some(message) = provider.api_key_configure_error() {
return Err(anyhow!(message));
}
let env_name = provider
.api_key_env_name()
.ok_or_else(|| anyhow!("{} does not support API key auth", provider.display_name()))?;
let api_key = std::env::var(env_name)
.ok()
.map(|value| value.trim().to_string())
.filter(|value| !value.is_empty())
.ok_or_else(|| {
anyhow!(
"{env_name} is not set. Export it, then run `lf op auth configure {}`.",
provider.as_str()
)
})?;
let store = local_store().await?;
store
.upsert_provider_token(&ProviderToken {
provider: provider.as_str().to_string(),
access_token: api_key,
refresh_token: None,
expires_at: None,
login: None,
updated_at: OffsetDateTime::now_utc().unix_timestamp(),
credential_type: CredentialType::ApiKey,
})
.await?;
if provider.api_key_bills_per_token() {
println!("API key auth bills per token. OAuth uses your existing subscription.");
}
println!("Stored {} API key", provider.display_name());
Ok(())
}
async fn local_auth_service() -> Result<ProviderAuthService> {
Ok(ProviderAuthService::new(local_store().await?))
}
async fn local_store() -> Result<SharedStore> {
let cfg = crate::lfd::storage_config_from_env()
.context("failed to resolve local lfd credential store")?;
let store = open_store(&cfg)
.await
.map_err(|err| anyhow!("failed to open local lfd credential store: {err}"))?;
Ok(Arc::new(store))
}
async fn complete_oauth_code_paste(
service: &ProviderAuthService,
provider: Provider,
) -> Result<()> {
println!("Paste the full redirect URL or just the authorization code.");
print!("Authorization code: ");
let _ = io::stdout().flush();
let mut input = String::new();
io::stdin()
.read_line(&mut input)
.context("failed to read authorization code")?;
let code = extract_authorization_code(input.trim());
if code.is_empty() {
return Err(anyhow!(
"could not find an authorization code in the pasted value"
));
}
service.complete_auth(provider, &code).await?;
Ok(())
}
async fn wait_for_active_status(
service: &ProviderAuthService,
provider: Provider,
expires_in: Option<u64>,
) -> Result<()> {
let timeout = expires_in
.map(Duration::from_secs)
.unwrap_or(AUTH_STATUS_POLL_TIMEOUT);
let deadline = std::time::Instant::now() + timeout;
loop {
let snapshot = service.status(provider).await?;
match snapshot.status {
AuthStatus::Active { login } => {
if provider == Provider::GitHub {
if let Some(login) = login {
println!("Authenticated as @{login}");
} else {
println!("Authenticated");
}
} else {
println!("Authenticated");
}
return Ok(());
}
AuthStatus::Expired => {
println!(
"Authentication expired. Run `lf op auth {}` again.",
provider.as_str()
);
return Ok(());
}
AuthStatus::Pending | AuthStatus::None => {
if std::time::Instant::now() >= deadline {
println!(
"Authentication still pending. Finish the browser flow, then run `lf op auth status {}`.",
provider.as_str()
);
return Ok(());
}
tokio::time::sleep(AUTH_STATUS_POLL_INTERVAL).await;
}
}
}
}
fn parse_provider(raw: &str) -> Result<Provider> {
raw.parse::<Provider>()
.map_err(|_| anyhow!("unknown provider: {raw}"))
}
fn format_snapshot(snapshot: &ProviderAuthSnapshot) -> String {
let provider = format!("{:<12}", snapshot.provider.display_name());
let credential_type = snapshot.credential_type.unwrap_or(CredentialType::OAuth);
match snapshot.status.clone() {
AuthStatus::Active { login } => {
let status = if credential_type == CredentialType::ApiKey {
"apikey"
} else {
"oauth"
};
let mut details = Vec::new();
if let Some(login) = login {
if snapshot.provider == Provider::GitHub {
details.push(format!("@{login}"));
} else {
details.push(login);
}
} else {
details.push("authenticated".to_string());
}
let now = OffsetDateTime::now_utc().unix_timestamp();
if let Some(expires_at) = snapshot.expires_at {
let delta = expires_at - now;
if delta <= 0 {
details.push("expired".to_string());
} else {
details.push(format!("expires {}", format_relative_delta(delta)));
}
}
if let Some(next_refresh_at) = snapshot.next_refresh_at {
let delta = next_refresh_at - now;
if delta <= 0 {
details.push("refreshing soon".to_string());
} else {
details.push(format!("refresh in {}", format_relative_delta(delta)));
}
}
if credential_type == CredentialType::ApiKey
&& snapshot.provider.api_key_bills_per_token()
{
details.push("pay-per-token".to_string());
}
format!("{provider} {status:<8} {}", details.join(" ยท "))
}
AuthStatus::Pending => {
format!(
"{provider} {:<8} waiting for browser confirmation",
"pending"
)
}
AuthStatus::Expired => format!("{provider} {:<8} expired", "expired"),
AuthStatus::None => format!("{provider} {:<8} not connected", "none"),
}
}
fn format_relative_delta(seconds: i64) -> String {
let total_seconds = seconds.max(0);
if total_seconds < 60 {
return format!("{total_seconds}s");
}
if total_seconds < 3600 {
return format!("{}m", total_seconds / 60);
}
if total_seconds < 86_400 {
return format!("{}h", total_seconds / 3600);
}
format!("{}d", total_seconds / 86_400)
}
fn extract_authorization_code(value: &str) -> String {
if let Ok(url) = Url::parse(value) {
if let Some(code) = url
.query_pairs()
.find_map(|(key, value)| (key == "code").then(|| value.into_owned()))
{
return code;
}
if let Some(fragment) = url.fragment() {
for pair in fragment.split('&') {
let mut parts = pair.splitn(2, '=');
if let (Some("code"), Some(code)) = (parts.next(), parts.next()) {
return code.to_string();
}
}
}
}
value.trim().to_string()
}
#[cfg(test)]
mod tests {
use super::{extract_authorization_code, format_relative_delta};
#[test]
fn extract_authorization_code_accepts_raw_code() {
assert_eq!(extract_authorization_code("abc123"), "abc123");
}
#[test]
fn extract_authorization_code_reads_query_parameter() {
assert_eq!(
extract_authorization_code("urn:ietf:wg:oauth:2.0:oob?code=abc123&state=xyz"),
"abc123"
);
}
#[test]
fn format_relative_delta_uses_human_units() {
assert_eq!(format_relative_delta(42), "42s");
assert_eq!(format_relative_delta(180), "3m");
assert_eq!(format_relative_delta(7_200), "2h");
assert_eq!(format_relative_delta(172_800), "2d");
}
}