fj auth login --fjord: support Fjord Account sign-in under SSO/OIDC (device-code/PKCE), not just credentials #218

New issue

Closed

opened 2026-07-21 00:04:21 +00:00 by stephen · 0 comments

stephen commented

2026-07-21 00:04:21 +00:00

Owner

Problem

fj auth login --fjord cannot sign in to a Fjord Account when the deployment uses SSO/OIDC (the prod strategy — GET /api/auth/status returns {"strategy":"oidc"}). It bails at src/cli/auth_login.rs:335:

error: this Fjord deployment signs in with single sign-on, which fj can't drive yet.
Sign in to your Forgejo directly with a personal access token instead:
  fj auth login --host <your-forgejo-host> --token <token>

Consequence: all Fjord-Account commands are unusable under SSO — e.g. fj instances (src/cli/instances.rs:66/74), and anything routed through src/fjord/mod.rs. A Forgejo PAT is the only working path, and it only covers direct Forgejo ops, not Fjord-Account management. Since the fj CLI is a featured client on the fjord.sh Clients section, the Fjord-Account CLI story is currently half-broken for real (SSO) deployments.

Ask

Implement an SSO/OIDC sign-in flow for fj auth login --fjord so Fjord-Account commands work on OIDC deployments.

Drive off GET /api/auth/status for the actual sign-in shape (the error text already points clients there).
Preferred mechanism for a CLI against OIDC: OAuth 2.0 Device Authorization Grant (device code — user opens a URL, enters a code; no loopback server needed), or a loopback + PKCE authorization-code flow if the provider supports it. Check what paragon's OIDC provider exposes (device authorization endpoint? /oauth/device_authorization, /oauth/token, discovery doc?) and implement the supported one.
Store the resulting Fjord-Account session in the keychain exactly like the existing credentials flow, and make refresh work (currently "re-run fj auth login --fjord"; a refresh token from the OIDC grant should enable silent refresh — see src/cli/auth.rs:176).
Keep the PAT path unchanged as a fallback; keep the current clear error only for providers that genuinely expose no CLI-drivable grant.

Files

src/cli/auth_login.rs (the --fjord flow + the SSO bail at ~L335), src/cli/auth.rs (session storage/refresh), src/fjord/mod.rs (Fjord-Account API client / 401 handling), src/cli/instances.rs (a consumer to smoke-test against).

Acceptance

fj auth login --fjord completes against the prod (OIDC) deployment and a subsequent fj instances succeeds. Tests for the new flow (mock the device/token endpoints). fmt + clippy -D + tests green. Not launch-blocking (PAT fallback works), but completes the CLI client story.

## Problem `fj auth login --fjord` cannot sign in to a Fjord Account when the deployment uses SSO/OIDC (the prod strategy — `GET /api/auth/status` returns `{"strategy":"oidc"}`). It bails at `src/cli/auth_login.rs:335`: ``` error: this Fjord deployment signs in with single sign-on, which fj can't drive yet. Sign in to your Forgejo directly with a personal access token instead: fj auth login --host <your-forgejo-host> --token <token> ``` Consequence: **all Fjord-Account commands are unusable under SSO** — e.g. `fj instances` (`src/cli/instances.rs:66/74`), and anything routed through `src/fjord/mod.rs`. A Forgejo PAT is the only working path, and it only covers direct Forgejo ops, not Fjord-Account management. Since the `fj` CLI is a **featured client** on the fjord.sh Clients section, the Fjord-Account CLI story is currently half-broken for real (SSO) deployments. ## Ask Implement an SSO/OIDC sign-in flow for `fj auth login --fjord` so Fjord-Account commands work on OIDC deployments. - Drive off `GET /api/auth/status` for the actual sign-in shape (the error text already points clients there). - Preferred mechanism for a CLI against OIDC: **OAuth 2.0 Device Authorization Grant** (device code — user opens a URL, enters a code; no loopback server needed), or a **loopback + PKCE authorization-code** flow if the provider supports it. Check what paragon's OIDC provider exposes (device authorization endpoint? `/oauth/device_authorization`, `/oauth/token`, discovery doc?) and implement the supported one. - Store the resulting Fjord-Account session in the keychain exactly like the existing credentials flow, and make refresh work (currently "re-run `fj auth login --fjord`"; a refresh token from the OIDC grant should enable silent refresh — see `src/cli/auth.rs:176`). - Keep the PAT path unchanged as a fallback; keep the current clear error only for providers that genuinely expose no CLI-drivable grant. ## Files `src/cli/auth_login.rs` (the `--fjord` flow + the SSO bail at ~L335), `src/cli/auth.rs` (session storage/refresh), `src/fjord/mod.rs` (Fjord-Account API client / 401 handling), `src/cli/instances.rs` (a consumer to smoke-test against). ## Acceptance `fj auth login --fjord` completes against the prod (OIDC) deployment and a subsequent `fj instances` succeeds. Tests for the new flow (mock the device/token endpoints). fmt + clippy -D + tests green. Not launch-blocking (PAT fallback works), but completes the CLI client story.

stephen referenced this issue from a pull request that will close it,

2026-07-21 00:27:13 +00:00

auth: sign in to a Fjord Account under SSO/OIDC (#218) #219

stephen closed this issue

2026-07-21 06:09:50 +00:00

stephen referenced this issue from a commit

2026-07-21 06:09:50 +00:00

auth: sign in to a Fjord Account under SSO/OIDC (#218) (#219)

stephen referenced this issue

2026-07-22 15:18:23 +00:00

Release v0.4.0 #227

stephen referenced this issue from a commit