package main

import ( "context" "crypto/rand" "encoding/base64" "encoding/json" "fmt" "io" "net" "net/http" "net/url" "strings" "time" )

// config holds the helper's runtime settings. type config struct { vaultURL string // e.g. "https://vault.cosmocr.at" audience string // e.g. "gitweb" client *http.Client // HTTP client (overridable in tests) openURL func(string) // browser opener (overridable in tests) stderr io.Writer // progress messages timeout time.Duration // overall login timeout }

// login obtains a fresh SSO token, using the loopback browser flow when a // browser is available and falling back to the device-code flow otherwise. func (cfg config) login(useDevice bool) (string, error) { if useDevice { return cfg.deviceLogin() } return cfg.loopbackLogin() }

// loopbackLogin starts a localhost callback server, opens the vault authorize // page in a browser, and waits for the redirect carrying the token. func (cfg config) loopbackLogin() (string, error) { ln, err := net.Listen("tcp", "127.0.0.1:0") if err != nil { return "", err } defer ln.Close()

state := randString(16)
tokenCh := make(chan string, 1)
errCh := make(chan error, 1)

srv := &http.Server{Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	if r.URL.Path != "/cb" {
		http.NotFound(w, r)
		return
	}
	q := r.URL.Query()
	if q.Get("state") != state {
		http.Error(w, "state mismatch", http.StatusBadRequest)
		errCh <- fmt.Errorf("callback state mismatch")
		return
	}
	tok := q.Get("token")
	if tok == "" {
		http.Error(w, "no token", http.StatusBadRequest)
		errCh <- fmt.Errorf("callback missing token")
		return
	}
	w.Header().Set("Content-Type", "text/html; charset=utf-8")
	io.WriteString(w, "<!doctype html><p>Authentication complete. You can close this tab and return to your terminal.</p>")
	tokenCh <- tok
})}
go srv.Serve(ln)
defer srv.Close()

redirectURI := fmt.Sprintf("http://%s/cb", ln.Addr().String())
authURL := fmt.Sprintf("%s/authorize?%s", strings.TrimRight(cfg.vaultURL, "/"), url.Values{
	"redirect_uri": {redirectURI},
	"state":        {state},
	"aud":          {cfg.audience},
}.Encode())

fmt.Fprintf(cfg.stderr, "Opening your browser to sign in:\n  %s\n", authURL)
if cfg.openURL != nil {
	cfg.openURL(authURL)
}

select {
case tok := <-tokenCh:
	return tok, nil
case err := <-errCh:
	return "", err
case <-time.After(cfg.timeout):
	return "", fmt.Errorf("timed out waiting for browser authentication")
}

}

// deviceLogin runs the RFC 8628-style device flow: request a code, tell the // user where to approve it, then poll until approved. func (cfg config) deviceLogin() (string, error) { var codeResp struct { DeviceCode string json:"device_code" UserCode string json:"user_code" VerificationURI string json:"verification_uri" Interval int json:"interval" ExpiresIn int json:"expires_in" } if err := cfg.postJSON("/api/device/code", map[string]string{"aud": cfg.audience}, &codeResp); err != nil { return "", err }

verify := codeResp.VerificationURI
if strings.HasPrefix(verify, "/") {
	verify = strings.TrimRight(cfg.vaultURL, "/") + verify
}
fmt.Fprintf(cfg.stderr,
	"To authenticate, open this URL in a browser, sign in with your passkey, and enter the code:\n  %s\n  code: %s\n",
	verify, codeResp.UserCode)

interval := time.Duration(codeResp.Interval) * time.Second
if interval <= 0 {
	interval = 5 * time.Second
}
deadline := time.Now().Add(cfg.timeout)
for time.Now().Before(deadline) {
	time.Sleep(interval)
	var tokResp struct {
		Status string `json:"status"`
		Token  string `json:"token"`
	}
	if err := cfg.postJSON("/api/device/token", map[string]string{"device_code": codeResp.DeviceCode}, &tokResp); err != nil {
		return "", err
	}
	switch tokResp.Status {
	case "approved":
		return tokResp.Token, nil
	case "slow_down":
		interval += 2 * time.Second
	case "pending":
		// keep polling
	case "expired":
		return "", fmt.Errorf("device code expired before approval")
	}
}
return "", fmt.Errorf("timed out waiting for device approval")

}

func (cfg config) postJSON(path string, body any, out any) error { buf, err := json.Marshal(body) if err != nil { return err } ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second) defer cancel() req, err := http.NewRequestWithContext(ctx, "POST", strings.TrimRight(cfg.vaultURL, "/")+path, strings.NewReader(string(buf))) if err != nil { return err } req.Header.Set("Content-Type", "application/json") resp, err := cfg.client.Do(req) if err != nil { return err } defer resp.Body.Close() data, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20)) if resp.StatusCode != http.StatusOK { return fmt.Errorf("%s: %s", path, strings.TrimSpace(string(data))) } return json.Unmarshal(data, out) }

func randString(n int) string { b := make([]byte, n) _, _ = rand.Read(b) return base64.RawURLEncoding.EncodeToString(b) }