Repository navigation
Conversation
added 5 commits
October 16, 2026 19:29
… command Split OIDC SDK provider login out of 'dws auth login --provider' into a dedicated 'dws auth provider-login <provider>' command: - internal/auth: shared OIDC transaction/authorize/exchange/persist flow (OIDCLoginProvider + OIDCAuthorizer composition) with strict authorization-request validation, error classification, and zero-retry requests; Ant SDK authorizer with loopback endpoint guards - internal/app: provider-login command with paired credential flags, --mcp-url declaration/persistence, --login-timeout, dry-run support, and invocation-flag cleanup hooks wired into root preRun/output boundaries - auth login rolled back to its original surface (no provider flag branch or conflicting flag rejections); shared human-readable result printer - schema exclusions: register exact path 'auth provider-login'
Register edition-provided OIDC authorizers and expose exchange-prepare and token-exchange commands. Preserve application bindings and custom credentials for refresh, sanitize authentication failures, and make stdin reads cancellable with macOS terminal regressions.
Use explicit OIDC provider metadata for session routing and keep refresh bound to the original application and Portal. Surface safe backend error codes and trace IDs, and remove the Ant mock implementation and its dependent tests.
Isolate command test state, correct platform cleanup assertions, and cover OIDC cancellation and persistence boundaries without relaxing coverage policy. Co-authored-by: multica-agent <github@multica.ai>
auto-merge was automatically disabled
October 23, 2026 02:36
Head branch was pushed to by a user without write access
GNU objdump on Ubuntu 26 reports architecture UNKNOWN for Windows arm64 DLLs; fall back to llvm-objdump and file(1) instead of failing. Return the Stat error for closed Windows stdin handles instead of treating them as redirected input. Co-authored-by: multica-agent <github@multica.ai>
auto-merge was automatically disabled
October 23, 2026 06:16
Head branch was pushed to by a user without write access
auto-merge was automatically disabled
October 23, 2026 08:34
Head branch was pushed to by a user without write access
added 2 commits
October 23, 2026 19:04
The Windows architecture probe failed on the Ubuntu 26 runner: GNU objdump 2.46 cannot parse ARM64 PE images at all, and file(1) 5.46 renamed COFF machine 0xaa64 from "Aarch64" to "ARM64", so the arm64 file(1) pattern stopped matching and the fail-token branch reported "invalid Windows arm64 library architecture". Tool magic databases vary across distro releases; the COFF machine field is byte-level ground truth. Read it directly with od(1) and make it the authoritative check; objdump/llvm-objdump/file(1) remain only as positive advisory probes and can no longer fail the check on their own.
The Windows coverage gate reported 98.4%: newOIDCFileInput's console branch never executed on CI because runners have no attached console, and the guarded cleanup() call never ran on Windows where cleanup is always nil. Seam GetConsoleMode/CancelIoEx through package vars so the console branch is testable, default cleanup to a no-op func so the deferred call executes on every platform, and cover the cancellation loop outcomes with a TestCrossPlatformCoverage* test on Windows.
auto-merge was automatically disabled
October 23, 2026 11:05
Head branch was pushed to by a user without write access
The Linux full-suite coverage gate reported 94.2602% (784 statements) on changed code. The uncovered blocks split into three groups: - auth_oidc_stdin_unix.go kept the macOS select-based terminal input and the oidcTerminalInput reader in a !windows file whose runtime.GOOS guard never executes on Linux, so those statements could not be covered there. Split the file by platform: the cancelreader helper stays in the !windows file, the macOS terminal input moves to a darwin-only file, and the plain non-Windows/non-macOS entry point becomes its own file. - internal/auth tests never exercised credential validation failures, a nil authorizer, SDK deadline/canceled/generic failures, or invalid/mismatched authorization results. - internal/output tests never rendered TraceID or UpstreamCode failure diagnostics. Add the missing branch tests and a cross-platform cancelreader-failure test.
auto-merge was automatically disabled
October 23, 2026 12:16
Head branch was pushed to by a user without write access
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
auth provider-loginsubcommand for OIDC provider login (splitting it out ofauth loginflag branches per auth command convention)Risk tier
platform, auth/keychain, installer, packaging, release, transport, recovery,
or another fail-closed infrastructure change
Verification
N/A):.changes/auth-oidc-provider-hooks.md,.changes/auth-oidc-split-exchange.md,.changes/auth-oidc-diagnostics.mdN/A):./scripts/policy/check-changelog-pr.sh --content-only "$(git merge-base HEAD upstream/main)" HEAD→ exit 0make build→ okDWS_PACKAGE_VERSION=0.0.0-test go test ./internal/auth/... ./internal/i18n/... ./internal/cli/...→ all ok./scripts/policy/check-command-surface.sh --strict→ oknew tests in
internal/auth/oidc_provider_test.go,oidc_exchange_test.go,oidc_errors_test.go,oidc_refresh_policy_test.goN/A):N/Atiers; record command/result or
N/A)./scripts/policy/check-generated-drift.sh(when generator inputs or generated artifacts may change):
N/A./scripts/policy/check-command-surface.sh --strict(if command surface changed) → ok./scripts/release/verify-package-managers.sh(after
make package, if packaging or installer surfaces changed):N/ANotes
upstream/mainat time of creation (not behind).