fix: remove slug login's template browser dependency #297

Merged

erik merged 1 commit from fix/task-695242ef-api-only-login into main

2026-10-05 08:32:58 -05:00

erik commented

2026-10-05 07:49:00 -05:00

Owner

Summary

Make slug login portable: accept a site-issued key, verify it with GET /auth/check relative to the selected API base URL, then save the named-site configuration. Preserve configured/explicit/prompted URL selection, path prefixes, error handling, credential redaction and other profiles.
Remove automatic /cli/auth URL derivation, the unused CommandContext opener hook, and platform browser-spawn plumbing. No optional browser feature or discovery mechanism is added.
Update login/config help, CLI documentation and generated/template setup instructions. Explicit upgrade note: automatic browser opening is removed; obtain a key through the site/operator first. Existing API endpoints, keys, configuration and command syntax remain compatible.
Keep template /cli/auth as an optional manually accessed site-owned UI; no server-route or deployed-site changes. CSRF story task-b7cd625f remains separate.
Correct stale API design prose from /ping/auth.ping to existing /auth/check/auth.check and its actual response envelope. The OpenAPI document and HTTP contract are unchanged.

Verification

Six regression failures observed before implementation: implicit browser opening/URLs and stale help text.
API-only mock fixtures return 404 for non-API routes and verify login calls only the documented auth check, using bearer headers with no cookies/CSRF credentials. Cover normal HTTPS, nested/trailing-slash API paths, local HTTP, and a custom API mount. Former opener hooks are not invoked.
Existing configured/prompted URL, invalid-key and redaction cases retained; added 401/403 byte-for-byte configuration preservation and selected-site-only successful replacement.
Focused command/help tests: 335 passed. CLI build and all workspace type checks passed.
./scripts/pre-pr.sh passed CSS/format/lint/types and all 1,169 local tests (539 CLI,580 site,50 package).
npm run test:ci passed (533 CLI,501 site,50 package); git diff --check clean.
Evidence: /tmp/slugkit-api-only-login-red.log, /tmp/slugkit-api-only-login-green.log, /tmp/slugkit-api-only-login-build.log, /tmp/slugkit-api-only-login-typecheck.log, /tmp/slugkit-api-only-login-pre-pr.log and /tmp/slugkit-api-only-login-unit-ci.log.

No dependency, workflow, OpenAPI, server implementation, deployment or publication changes. New coverage uses mocked fetch and temporary local config only. NEVER browser/container/federation integration tests or runtime provisioning in CI/release workflows.

Task: #task-695242ef

Awaiting CI, independent review and explicit human merge approval.

## Summary - Make slug login portable: accept a site-issued key, verify it with GET /auth/check relative to the selected API base URL, then save the named-site configuration. Preserve configured/explicit/prompted URL selection, path prefixes, error handling, credential redaction and other profiles. - Remove automatic /cli/auth URL derivation, the unused CommandContext opener hook, and platform browser-spawn plumbing. No optional browser feature or discovery mechanism is added. - Update login/config help, CLI documentation and generated/template setup instructions. Explicit upgrade note: automatic browser opening is removed; obtain a key through the site/operator first. Existing API endpoints, keys, configuration and command syntax remain compatible. - Keep template /cli/auth as an optional manually accessed site-owned UI; no server-route or deployed-site changes. CSRF story task-b7cd625f remains separate. - Correct stale API design prose from /ping/auth.ping to existing /auth/check/auth.check and its actual response envelope. The OpenAPI document and HTTP contract are unchanged. ## Verification - Six regression failures observed before implementation: implicit browser opening/URLs and stale help text. - API-only mock fixtures return 404 for non-API routes and verify login calls only the documented auth check, using bearer headers with no cookies/CSRF credentials. Cover normal HTTPS, nested/trailing-slash API paths, local HTTP, and a custom API mount. Former opener hooks are not invoked. - Existing configured/prompted URL, invalid-key and redaction cases retained; added 401/403 byte-for-byte configuration preservation and selected-site-only successful replacement. - Focused command/help tests: 335 passed. CLI build and all workspace type checks passed. - ./scripts/pre-pr.sh passed CSS/format/lint/types and all 1,169 local tests (539 CLI,580 site,50 package). - npm run test:ci passed (533 CLI,501 site,50 package); git diff --check clean. - Evidence: /tmp/slugkit-api-only-login-red.log, /tmp/slugkit-api-only-login-green.log, /tmp/slugkit-api-only-login-build.log, /tmp/slugkit-api-only-login-typecheck.log, /tmp/slugkit-api-only-login-pre-pr.log and /tmp/slugkit-api-only-login-unit-ci.log. No dependency, workflow, OpenAPI, server implementation, deployment or publication changes. New coverage uses mocked fetch and temporary local config only. NEVER browser/container/federation integration tests or runtime provisioning in CI/release workflows. Task: #task-695242ef Awaiting CI, independent review and explicit human merge approval.

erik added 1 commit

2026-10-05 07:49:00 -05:00

fix: make slug login independent of template browser routes

CI / build-lint-test (pull_request) Successful in 57s

Details

d773be4b2b

Verify site-issued bearer credentials through the documented API only. Remove implicit /cli/auth URL generation and browser opening so any OpenAPI-compatible website works without the example template, while preserving named-site configuration and validation.

Task: #task-695242ef

erik commented

2026-10-05 07:53:58 -05:00

Author

Owner

Independent PR review

PR: #297 (d773be4b2b56370205368638507eda00170c6d60), open
Task: task-695242ef
Result: approved

Summary

This PR removes the required example-template /cli/auth assumption from slug login. The CLI now prompts for a site-issued key, verifies it with the documented bearer-authenticated GET /auth/check under the selected API base URL, and saves the named-site config only after verification. The browser opener/platform spawn path is removed, documentation is updated, and the template /cli/auth page remains only an optional manually accessed site convenience.

Acceptance criteria

✅ Login succeeds against API-only implementations: mocked tests return 404 for non-API routes including /cli/auth; login makes one exact GET <api-base-url>/auth/check and does not invoke the legacy opener.
✅ Valid supplied credentials are verified and saved for the selected site; invalid 401/403 credentials fail with AuthenticationError and preserve existing config byte-for-byte.
✅ Default login has no example-site session, CSRF, cookie, or undocumented endpoint dependency; requests use bearer auth only.
✅ No CLI browser-auth feature is retained. The template /cli/auth page remains documented as optional/manual and outside the portable API contract.
✅ Tests cover API-only sites, normal/nested/trailing-slash/local/custom API bases, named-site replacement, invalid credentials, configured/prompted URL behavior, and legacy opener non-use.
✅ CLI, template, foundation spec, and API design docs consistently state that any Slugkit OpenAPI-compatible implementation works with site-issued credentials via /auth/check.

Quality and security

Scope matches the task and the user-approved minimal API-only plan.
No dependency, workflow, OpenAPI source, server route, deployment, publication, CSRF-task, or live API behavior changes are evident in the diff.
Verification evidence reviewed: focused command/help tests, CLI build, workspace typecheck, ./scripts/pre-pr.sh, npm run test:ci, red regression log, and CI run #506 at the reviewed head reported green.

Blocking issues

None.

Warnings

None.

Verdict

Approved. Await explicit human merge approval.

### Independent PR review - PR: #297 (`d773be4b2b56370205368638507eda00170c6d60`), open - Task: `task-695242ef` - Result: approved #### Summary This PR removes the required example-template `/cli/auth` assumption from `slug login`. The CLI now prompts for a site-issued key, verifies it with the documented bearer-authenticated `GET /auth/check` under the selected API base URL, and saves the named-site config only after verification. The browser opener/platform spawn path is removed, documentation is updated, and the template `/cli/auth` page remains only an optional manually accessed site convenience. #### Acceptance criteria 1. ✅ Login succeeds against API-only implementations: mocked tests return 404 for non-API routes including `/cli/auth`; login makes one exact `GET <api-base-url>/auth/check` and does not invoke the legacy opener. 2. ✅ Valid supplied credentials are verified and saved for the selected site; invalid 401/403 credentials fail with `AuthenticationError` and preserve existing config byte-for-byte. 3. ✅ Default login has no example-site session, CSRF, cookie, or undocumented endpoint dependency; requests use bearer auth only. 4. ✅ No CLI browser-auth feature is retained. The template `/cli/auth` page remains documented as optional/manual and outside the portable API contract. 5. ✅ Tests cover API-only sites, normal/nested/trailing-slash/local/custom API bases, named-site replacement, invalid credentials, configured/prompted URL behavior, and legacy opener non-use. 6. ✅ CLI, template, foundation spec, and API design docs consistently state that any Slugkit OpenAPI-compatible implementation works with site-issued credentials via `/auth/check`. #### Quality and security - Scope matches the task and the user-approved minimal API-only plan. - No dependency, workflow, OpenAPI source, server route, deployment, publication, CSRF-task, or live API behavior changes are evident in the diff. - Verification evidence reviewed: focused command/help tests, CLI build, workspace typecheck, `./scripts/pre-pr.sh`, `npm run test:ci`, red regression log, and CI run #506 at the reviewed head reported green. #### Blocking issues - None. #### Warnings - None. #### Verdict Approved. Await explicit human merge approval.

erik merged commit 30005a34ff into main

2026-10-05 08:32:58 -05:00

erik deleted branch fix/task-695242ef-api-only-login

2026-10-05 08:32:58 -05:00

erik referenced this pull request from a commit

2026-10-05 08:32:58 -05:00

Merge pull request 'fix: remove slug login's template browser dependency' (#297) from fix/task-695242ef-api-only-login into main

erik referenced this pull request

2026-10-05 11:11:01 -05:00

fix: protect browser mutations from CSRF and retire cli auth #298