DMD-1825 feat(auth): browser login via PKCE + device authorization (programmatic auth) - #535

Merged

zajca merged 42 commits into

mainfrom

docs/programmatic-auth-login-plan

Aug 3, 2026

Commits on Aug 3, 2026

docs: implementation plan for PKCE + device authorization login (programmatic auth)
zajca
committed
docs: store session tokens plaintext in auth.json (drop keyring/encryption)
zajca
committed
docs: address PR #535 review (B-1..B-4, NB-1..NB-5)
zajca
committed
feat(auth): browser login via PKCE + device authorization (#535)
zajca
committed
test(auth): type the cross-process race fake as an AuthClient subclass
zajca
committed
feat(auth): interactive project picker after login (#535)
zajca
committed
fix(auth): classify a server-rejected refresh without relying on its prose
zajca
committed
feat(auth): arrow-key + spacebar project picker
zajca
committed
docs(auth): sync command docs for the arrow-key project picker
zajca
committed
refactor(auth): drop a duplicate TYPE_CHECKING block left by a rebase
zajca
committed
fix(auth): honour a server-sent refresh-token expiry at login, not only on refresh
zajca
committed
fix(auth): protect and surface a project's credential type
zajca
committed
fix: keep a per-project error code intact in multi-project commands
zajca
committed
fix(auth): bound the refresh call, canonicalize stack URLs, tighten probes
zajca
committed
refactor(auth): disclose the v1 scope up front and move selection out of the CLI
zajca
committed
fix(server): answer 401 for an expired session, keep a subclass error code
zajca
committed
test(auth): wire the bearer E2E suite into a target that actually runs
zajca
committed
docs(auth): add a user-facing guide and correct the v1 scope everywhere
zajca
committed
docs(auth): correct which commands disclose the session restriction list
zajca
committed
fix(permissions): gate `auth logout --remove-projects` behind the admin class
zajca
committed
refactor(auth): make the static-token guard a property of the client
zajca
committed
ci: reject an unguarded session-sentinel path mechanically
zajca
committed
fix(auth): keep orphans recorded across re-login, refuse a non-https link
zajca
committed
fix(auth): enforce the refresh ceiling, narrow the grant-rejection markers
zajca
committed
ci: catch every credential-write shape and unguarded client construction
zajca
committed
test(auth): drive auth status through the CLI, name a migration consequence
zajca
committed
chore: retarget release at 0.78.0
zajca
committed
docs(auth): state what abandoning a stalled refresh actually does
zajca
committed
fix(auth): serialise refresh with a lease instead of the file lock
zajca
committed
fix(auth): classify a 400 by subject plus verdict, not by fixed phrases
zajca
committed
ci: resolve names and base chains in the sentinel gate
zajca
committed
fix(auth): stop a no-op logout from creating an auth.json
zajca
committed
fix(auth): reject a lease from a wrong clock, veto a request-shape 400
zajca
committed
chore: retarget release at 0.81.0
zajca
committed
ci: seed the client-construction check with the base that writes the header

padak
authored and
zajca
committed
fix(auth): retry an abandoned refresh inside the server's grace window
zajca
committed
fix(auth): replay a refresh the server rolled back on a deadlock
zajca
committed
fix(auth): survive a refresh body the decoder cannot parse
zajca
committed
fix(auth): make the contention replay traceable and its give-up actionable
zajca
committed
docs(auth): state the window the abandon recovery actually reaches
zajca
committed
chore: untrack 19.6 MB of build cache and the per-PR review write-ups
padak
committed
chore: release this at 0.80.0 instead of opening a new version
zajca
committed