Expand description
Signing in through Yandex OAuth, so nobody has to paste a token.
The device-code flow: ask for a short code, show it, and poll until the
person has confirmed it in a browser — on this machine or any other, which is
what makes it work over SSH and inside an agent’s sandbox too. The grant comes
with a refresh token, which is what auth refresh spends.
Exchanging a code for a token needs an application’s id and secret. The
shared ytcli application’s pair is compiled in from the environment of the
build, so it never lives in the tree; the same variables at run time win, for
anyone who would rather sign in through an application of their own. Why a
secret shipped inside a binary is acceptable: docs/adr/0008-device-sign-in.md.
Structs§
- App
- An OAuth application to sign in through.
- Device
Code - A code waiting to be confirmed.
- Grant
- A token, and what renews it.
Enums§
Constants§
- DEFAULT_
OAUTH_ URL - Where Yandex OAuth lives. Overridable so tests can point at a stub.
- READ_
ONLY_ SCOPE - What
--read-onlyasks for instead of everything the application may grant: reading Tracker and reading the Wiki, and nothing that writes to either.