feat(auth): the device authorization grant, client side - #1805
Conversation
sileht
had a problem deploying
to
func-tests-live
September 4, 2026 23:20 — with 
GitHub Actions
Failure
GitHub Actions
Failure
This was referenced Sep 4, 2026
Member
Author
|
This pull request is part of a Mergify stack:
|
This was referenced Sep 4, 2026
Contributor
Merge Protections🔴 3 of 7 protections blocking · waiting on 👀 reviews and ⛓️ dependency
🔴 ⛓️ Depends-On RequirementsWaiting for
This rule is failing.Requirement based on the presence of
🔴 👀 Review RequirementsWaiting for
This rule is failing.
🔴 🔎 ReviewsWaiting for
This rule is failing.
Show 4 satisfied protections🟢 🤖 Continuous Integration
🟢 Enforce conventional commitMake sure that we follow https://www.conventionalcommits.org/en/v1.0.0/
🟢 📕 PR description
🟢 🚦 Auto-queueWhen all merge protections are satisfied, this pull request will be queued automatically. |
A new `mergify-auth` crate holding the RFC 8628 client: open a grant, poll until its owner approves in a browser, revoke the result. A device grant rather than a browser redirect because the CLI runs where there is no browser to redirect to and no port to listen on -- over SSH, in a container, on a build machine. The user reads a code off the terminal and approves it wherever they already have a Mergify session. Three things the implementation takes from the server rather than assuming: - The verification URL. A self-hosted deployment answers with its own dashboard, so a client that hardcoded `dashboard.mergify.com` would send those users to a page that knows nothing about their grant. - The refusal text. The `access_denied` you get at the 20-token cap names the cap and the fix; printing the error code instead would drop the only part the user can act on. - The cadence -- within limits. `interval` and `expires_in` come from whatever host `--api-url` names, so both are clamped: a server answering `interval: 86400` would otherwise hang `auth login` for a day and look like a bug here. Ours sends 5 and 600. `slow_down` adds five seconds per RFC 8628 §3.5, and the poll loop keeps its own deadline as a backstop against a deployment that answers `authorization_pending` forever -- the server's own expiry is the `expired_token` branch and comes first in practice. The client carries no bearer token: the three endpoints are unauthenticated, and `revoke` already puts the secret in the form body. A test pins that, since sending it twice would be easy to do by accident. `refresh_token` is declared on the token response so the field cannot break deserialization the day it appears, and nothing reads it: the Mergify API issues none, and using one would need a refresh grant that does not exist server-side either. Not wired to the CLI yet. Fixes MRGFY-8703 Change-Id: Ic7a625b9e8f54a692af48d9b95907334eac3d5e5
sileht
force-pushed
the
devs/sileht/mrgfy-8703-cli-auth-commands/let-caller-read-endpoint-s-rejection-body--9339bdfb
branch
from
September 4, 2026 23:40
3c5d1dd to
9ca0419
Compare
sileht
force-pushed
the
devs/sileht/mrgfy-8703-cli-auth-commands/device-authz-grant-client-side--c7a625b9
branch
from
September 4, 2026 23:40
bc88a36 to
048166f
Compare
sileht
had a problem deploying
to
func-tests-live
September 4, 2026 23:40 — with
GitHub Actions
Error
GitHub Actions
Error
sileht
had a problem deploying
to
func-tests-live
September 4, 2026 23:40 — with
GitHub Actions
Failure
GitHub Actions
Failure
Member
Author
Revision history
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A new
mergify-authcrate holding the RFC 8628 client: open a grant,poll until its owner approves in a browser, revoke the result.
A device grant rather than a browser redirect because the CLI runs where
there is no browser to redirect to and no port to listen on -- over SSH,
in a container, on a build machine. The user reads a code off the
terminal and approves it wherever they already have a Mergify session.
Three things the implementation takes from the server rather than
assuming:
dashboard, so a client that hardcoded
dashboard.mergify.comwouldsend those users to a page that knows nothing about their grant.
access_deniedyou get at the 20-token capnames the cap and the fix; printing the error code instead would drop
the only part the user can act on.
intervalandexpires_income fromwhatever host
--api-urlnames, so both are clamped: a serveranswering
interval: 86400would otherwise hangauth loginfor aday and look like a bug here. Ours sends 5 and 600.
slow_downadds five seconds per RFC 8628 §3.5, and the poll loop keepsits own deadline as a backstop against a deployment that answers
authorization_pendingforever -- the server's own expiry is theexpired_tokenbranch and comes first in practice.The client carries no bearer token: the three endpoints are
unauthenticated, and
revokealready puts the secret in the form body.A test pins that, since sending it twice would be easy to do by
accident.
refresh_tokenis declared on the token response so the field cannotbreak deserialization the day it appears, and nothing reads it: the
Mergify API issues none, and using one would need a refresh grant that
does not exist server-side either.
Not wired to the CLI yet.
Fixes MRGFY-8703
Depends-On: #1804