auth: session-cookie storage for the cookie-gated Actions log/rerun routes (fj#103 slice 1)

stephen commented

2026-07-03 01:29:11 +00:00

Owner

WIP, slice 1 of 3. Starts the fix for the fj#103 read tax (tracked in rasterstate/fleet#178): fj can drive the Forgejo Actions log and rerun web-frontend routes, but those reject a PAT and authenticate by browser session cookie only, so fj run view --log on a private repo dead-ends at "open the browser."

This slice adds the storage half, no route behavior change yet:

Session-cookie storage in src/auth/mod.rs under a disjoint session:<host> keychain key (mirrors the fjord-account: key convention), with an FJ_SESSION env override and the 0600 file fallback, plus store/load/delete helpers.
fj auth session subcommand: import the i_like_gitea cookie via --cookie/--with-cookie (stdin, kept out of shell history) or --clear to forget it. Never echoes the value.
fj auth status now reports a "Web session" line per host so you can see whether log/rerun routes are enabled.

Existing PAT/bearer auth is untouched.

Testing

cargo build clean; cargo test auth:: green (11 tests, +2 new: session_key_is_namespaced_and_disjoint, env_session_trims_and_rejects_empty).
fj auth session --help shows the wired subcommand.

Next slices (same issue)

Client attaches the session cookie + _csrf on the web log reads (src/api/workflow_view.rs), preferring the session when present and falling back to the token; update the fj#103 error text to point at fj auth session.
fj run rerun <run> over the same session path.

WIP, slice 1 of 3. Starts the fix for the fj#103 read tax (tracked in rasterstate/fleet#178): fj can drive the Forgejo Actions log and rerun web-frontend routes, but those reject a PAT and authenticate by browser session cookie only, so `fj run view --log` on a private repo dead-ends at "open the browser." This slice adds the storage half, no route behavior change yet: - Session-cookie storage in `src/auth/mod.rs` under a disjoint `session:<host>` keychain key (mirrors the `fjord-account:` key convention), with an `FJ_SESSION` env override and the 0600 file fallback, plus store/load/delete helpers. - `fj auth session` subcommand: import the `i_like_gitea` cookie via `--cookie`/`--with-cookie` (stdin, kept out of shell history) or `--clear` to forget it. Never echoes the value. - `fj auth status` now reports a "Web session" line per host so you can see whether log/rerun routes are enabled. Existing PAT/bearer auth is untouched. ## Testing - `cargo build` clean; `cargo test auth::` green (11 tests, +2 new: `session_key_is_namespaced_and_disjoint`, `env_session_trims_and_rejects_empty`). - `fj auth session --help` shows the wired subcommand. ## Next slices (same issue) 2. `Client` attaches the session cookie + `_csrf` on the web log reads (`src/api/workflow_view.rs`), preferring the session when present and falling back to the token; update the fj#103 error text to point at `fj auth session`. 3. `fj run rerun <run>` over the same session path.

stephen added 1 commit

2026-07-03 01:29:11 +00:00

auth: store a Forgejo web session cookie for the cookie-gated log/rerun routes

ci / check (pull_request) Failing after 57s

Details

ci / coverage (pull_request) Has been skipped

Details

ci / live-e2e (pull_request) Has been skipped

Details

83e844a6de

Slice 1 of fj#103 / fleet#178. fj drives the Actions log and rerun web
frontend routes, which reject a PAT and need a browser session cookie. Add
session-cookie storage under a disjoint `session:<host>` keychain key (env
override FJ_SESSION, 0600 file fallback), an `fj auth session` import/clear
subcommand, and a Web session line in `fj auth status`.

No route wiring yet: slices 2 (Client cookie + CSRF on the web reads) and 3
(`fj run rerun`) ride on this storage. Existing token auth is unchanged.

stephen added 1 commit

2026-07-03 01:32:42 +00:00

auth: wrap long println to satisfy rustfmt

ci / check (pull_request) Successful in 10m29s

Details

ci / coverage (pull_request) Successful in 2m2s

Details

ci / live-e2e (pull_request) Successful in 2m3s

Details

b03bd53bf6