feat(rest-api): Support configurable OAuth client credentials - #4792
feat(rest-api): Support configurable OAuth client credentials#4792kfelternv wants to merge 4 commits into
Conversation
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
Summary by CodeRabbit
WalkthroughThe CLI adds configurable OIDC client-credentials scopes, token parameters, and client authentication methods. It also reports malformed responses, validates numeric input, and improves terminal and REPL cleanup behavior. ChangesCLI authentication and validation
Estimated code review effort: 3 (Moderate) | ~25 minutes Mergeability Score: ⚪ Minimal · up to The PR adds configurable OAuth client-credential options while preserving existing defaults, and no actionable merge-blocking risk remains after normal checks and review. Sequence Diagram(s)sequenceDiagram
participant CLI
participant ConfigOIDC
participant TokenEndpoint
CLI->>ConfigOIDC: Load scopes and token parameters
CLI->>TokenEndpoint: Send form or Basic-auth token request
TokenEndpoint-->>CLI: Return token response
CLI->>CLI: Persist access token
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
thossain-nv
added
the
rest-api
ChatGPT Codex Connector
|
Verification outdated and removed; see updated verification. |
🔐 TruffleHog Secret Scan✅ No secrets or credentials found! Your code has been scanned for 700+ types of secrets and credentials. All clear! 🎉 🕐 Last updated: 2026-08-13 03:27:03 UTC | Commit: fec5b5e |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@rest-api/cli/pkg/auth.go`:
- Around line 419-421: Update loginWithOIDCCmd’s client-credentials grant
configuration to preserve Scopes, TokenParameters, and ClientAuthMethod from
cfg.Auth.OIDC, while still overriding TokenURL, ClientID, and ClientSecret with
the CLI-provided values before calling clientCredentialsGrant.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 74fbed22-49ab-4579-b978-3888cc925ed6
📒 Files selected for processing (5)
rest-api/cli/README.mdrest-api/cli/pkg/auth.gorest-api/cli/pkg/auth_test.gorest-api/cli/pkg/config.gorest-api/cli/pkg/config_test.go
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 63ff0f5a98
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Verification outdated and removed; see updated verification. |
What changedThis PR lets Scenario and setupI tested commit VerificationStep 1: Custom scopes, token parameter, and HTTP Basic authenticationWhy this step exists: This tests the new configuration through the real Runnable command: CONFIG_FILE=oauth-basic.yaml
NICO_CONFIG="$CONFIG_FILE" go run ./rest-api/cli/cmd/cli loginThe configuration used Observed result: Why this proves the behavior: The CLI sent the configured scopes and audience, moved the client credentials to HTTP Basic authentication, and saved the response. Step 2: Default client-credentials requestWhy this step exists: This verifies that configurations without the new fields keep the existing request contract. Runnable command: CONFIG_FILE=oauth-default.yaml
NICO_CONFIG="$CONFIG_FILE" go run ./rest-api/cli/cmd/cli loginObserved result: Why this proves the behavior: The CLI preserved the Step 3: Reserved token parameter rejectionWhy this step exists: This verifies that extra parameters cannot replace OAuth credential or grant fields. Runnable command: CONFIG_FILE=oauth-reserved.yaml
NICO_CONFIG="$CONFIG_FILE" go run ./rest-api/cli/cmd/cli loginThe configuration used Observed result: Why this proves the behavior: The CLI rejected the reserved override before contacting the token endpoint. Step 4: Unsupported client authentication method rejectionWhy this step exists: This verifies that the configuration accepts only the documented authentication methods. Runnable command: CONFIG_FILE=oauth-unsupported.yaml
NICO_CONFIG="$CONFIG_FILE" go run ./rest-api/cli/cmd/cli loginThe configuration used Observed result: Why this proves the behavior: The CLI rejected an unsupported authentication method before contacting the token endpoint. Step 5: Explicit client ID override with configured optionsWhy this step exists: This verifies that an explicit CLI client ID overrides the configured ID without dropping configured scopes, token parameters, or authentication mode. Runnable command: NICO_CONFIG=oauth-basic.yaml ./nicocli login --client-id 'override:id'The configuration used Observed result: Why this proves the behavior: The CLI applied the explicit client ID, preserved the configured request options, encoded HTTP Basic credentials per OAuth requirements, and saved the token. Step 6: Strict CLI static analysisWhy this step exists: The repository lint wrapper reports analyzer findings with a zero issues exit code, so its success alone does not prove that changed packages are clean. Runnable command: go tool golangci-lint run ./cli/... --issues-exit-code 1 --output.text.path=stdoutObserved result: Why this proves the behavior: |
2 participants
nicocliclient-credentials login uses a fixed OAuth request, which prevents environments from supplying required scopes, endpoint parameters, or HTTP Basic client authentication. This adds those configuration fields while preserving the existingopenidscope and form-posted credentials by default.Related issues
Resolves #4686
Type of Change
Breaking Changes
Testing
Additional Notes
The supported client authentication methods are
client_secret_postandclient_secret_basic. Reserved OAuth fields and credential parameters cannot be set throughtoken_parameters.