Repository navigation
readm3 login: OAuth 2.1 via @profullstack/auth-system, works over SSH (v0.14.0) - #33
Merged
Merged
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
ralyodio
force-pushed
the
worktree-cli-oauth21-login
branch
from
October 19, 2026 13:08
8aeb082 to
e93161d
Compare
… (v0.14.0) readm3 login --coinpay sent the browser to http://127.0.0.1:PORT/callback, which is a dead end when the CLI runs on another machine (SSH). readm3 is now its own OAuth 2.1 authorization server (@profullstack/auth-system/oauth2 on a SQLite store): code + PKCE S256, rotating refresh tokens with reuse revocation, RFC 8414 metadata. readm3 login uses auth-system/cli: loopback when a browser can open locally, otherwise /oauth/cli shows a code to paste back. Tokens refresh on every command; logout revokes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ralyodio
force-pushed
the
worktree-cli-oauth21-login
branch
from
October 19, 2026 13:32
e93161d to
7d7fb26
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
readm3 login --coinpayredirected the browser tohttp://127.0.0.1:PORT/callback, a dead end when the CLI runs over SSH on another box.@profullstack/auth-system/oauth2(SQLite store, clientreadm3-cli):/.well-known/oauth-authorization-server,/oauth/authorize(consent; signed-out →/account?next=),/oauth/token,/oauth/revoke,/oauth/cli(paste-the-code page).readm3 loginuses@profullstack/auth-system/cli: loopback when a local browser can open, otherwise prints the link and takes the pasted code.--no-browserforces it;--coinpayis the same sign-in.r3_at_bearers; tokens refresh on each command (single-flight);logoutrevokes server-side.coinpay/oauth/cli-exchangekept for pre-0.14 CLIs.Tests: new
server/test/oauth.test.tsdrives the real CLI over the SSH path (consent, CSRF origin check, paste, whoami, refresh rotation, reuse revocation, logout, bad redirect_uri) under Bun and Node. 65/65 server, 178/178 CLI, typecheck clean.🤖 Generated with Claude Code