auth: manual/no-browser paste mode for Fjord-Account OIDC login (--manual) + branded loopback callback page #224

New issue

Closed

opened 2026-07-21 16:15:41 +00:00 by stephen · 0 comments

stephen commented

2026-07-21 16:15:41 +00:00

Owner

Summary

Add a manual / no-browser paste mode to the Fjord-Account OIDC login (fj auth login --fjord --manual, alias --no-browser) so a user whose browser is on a different device than fj (e.g. iPad Safari while fj runs on a Mac/server) can complete sign-in. Loopback capture is same-device only; this is the interim until device-flow lands (separate brief).

Behavior

Keep the whole authcode+PKCE flow except the loopback capture: print the authorize URL, user signs in on any device, copies the full redirected …/callback?code=…&state=… URL (or bare code) from the address bar even though the page fails to load, and pastes it back. Validate returned state matches (CSRF guard), then exchange code+code_verifier+redirect_uri at the token endpoint and store the bearer exactly as the loopback path does. redirect_uri stays a registered http://127.0.0.1:47017/callback.

Zero OP/paragon changes: the fj-cli OIDC client is already registered on prod paragon.

Also (same PR)

Brand the loopback callback success/failure page (src/fjord/oidc.rs::write_response) to the Fjord premium bar: self-contained inline CSS, embedded logo data: URI, light/dark aware, success + failure + state-mismatch variants. Polish the terminal-side manual-flow copy.

Interim; device-flow is the durable replacement.

## Summary Add a manual / no-browser paste mode to the Fjord-Account OIDC login (`fj auth login --fjord --manual`, alias `--no-browser`) so a user whose browser is on a **different device** than fj (e.g. iPad Safari while fj runs on a Mac/server) can complete sign-in. Loopback capture is same-device only; this is the interim until device-flow lands (separate brief). ## Behavior Keep the whole authcode+PKCE flow except the loopback capture: print the authorize URL, user signs in on any device, copies the full redirected `…/callback?code=…&state=…` URL (or bare code) from the address bar even though the page fails to load, and pastes it back. Validate returned `state` matches (CSRF guard), then exchange `code`+`code_verifier`+`redirect_uri` at the token endpoint and store the bearer exactly as the loopback path does. `redirect_uri` stays a registered `http://127.0.0.1:47017/callback`. Zero OP/paragon changes: the `fj-cli` OIDC client is already registered on prod paragon. ## Also (same PR) Brand the loopback callback success/failure page (`src/fjord/oidc.rs::write_response`) to the Fjord premium bar: self-contained inline CSS, embedded logo `data:` URI, light/dark aware, success + failure + state-mismatch variants. Polish the terminal-side manual-flow copy. Interim; device-flow is the durable replacement.

stephen added the

backlog

labels

2026-07-21 16:15:41 +00:00

stephen referenced this issue from a commit

2026-07-21 16:30:44 +00:00

auth: manual/no-browser paste mode for Fjord OIDC login + branded callback page (#224)

stephen referenced this issue from a pull request that will close it,

2026-07-21 16:31:21 +00:00

auth: manual/no-browser paste mode for Fjord OIDC login (--manual) + branded callback page #225

stephen closed this issue

2026-07-21 19:39:49 +00:00