enhance(cli): add --user/--pass flags to logseq login for non-interactive auth - #12910
Open
SSamDav wants to merge 5 commits into
Open
enhance(cli): add --user/--pass flags to logseq login for non-interactive auth#12910SSamDav wants to merge 5 commits into
SSamDav wants to merge 5 commits into
Conversation
…tive auth Add USER_PASSWORD_AUTH support to `logseq login` so it can authenticate without opening a browser. When --user and --pass are both provided the CLI calls the Cognito InitiateAuth API directly and writes auth.json exactly as the browser PKCE flow does. When neither flag is given the existing browser flow runs unchanged. - deps/common/cognito_config.cljs: expose COGNITO-IDP-ENDPOINT - cli/auth.cljs: add cognito-initiate-auth!, login-with-password!, branch in login! - cli/command/auth.cljs: add --user/-u and --pass/-p spec; validate pair; thread into action - cli/commands.cljs: pass options to auth-command/build-action - tests: unit tests for password path, routing, flag validation, credential threading Closes logseq/db-test#1017
|
|
tiensonqin
requested review from
RCmerci and
Copilot
and removed request for
RCmerci
July 15, 2026 11:12
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds a non-interactive authentication path to the Logseq CLI by introducing --user/-u and --pass/-p flags for logseq login, allowing headless environments to authenticate via Cognito InitiateAuth (USER_PASSWORD_AUTH) without opening a browser.
Changes:
- Add
--user/--passoptions to thelogincommand, validate they are provided as a pair, and thread credentials intologin!. - Implement a password-based login flow in CLI auth that exchanges username/password for Cognito tokens and persists them to
auth.json. - Add unit tests for command-layer validation/routing and auth-layer password flow behavior.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| deps/common/src/logseq/common/cognito_config.cljs | Exposes a shared Cognito IDP endpoint constant for CLI usage. |
| src/main/logseq/cli/auth.cljs | Adds Cognito InitiateAuth password login flow and routes login! based on provided credentials. |
| src/main/logseq/cli/command/auth.cljs | Adds --user/-u and --pass/-p, validates the pair, and passes credentials into cli-auth/login!. |
| src/main/logseq/cli/commands.cljs | Threads parsed options into auth command action building. |
| src/test/logseq/cli/auth_test.cljs | Adds auth-layer tests for password flow persistence, rejection, and routing. |
| src/test/logseq/cli/command/auth_test.cljs | Adds command-layer tests for flag validation and credential threading into login!. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
transport/request already throws on non-2xx responses, so the if (= 200 status) branch and the error-case throw were never reached. Simplify to extract AuthenticationResult directly from the successful response body. Also remove the cognito-idp-endpoint private wrapper that only forwarded to the config constant.
Parse the error :body from the failed InitiateAuth response and use its message/Message field for the rejection, so users see the actual Cognito reason (e.g. "Incorrect username or password.") instead of the raw HTTP body. Add a test covering message extraction from the error body.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add
--userand--passflags tologseq loginso the CLI can authenticate non-interactively without opening a browser.Closes logseq/db-test#1017
Motivation
In headless environments (CI, servers, scripts)
logseq logincurrently always opens a browser window to complete the OAuth PKCE flow. This blocks any automated workflow. The Cognito app client already hasUSER_PASSWORD_AUTHenabled (it is used by the frontend'slogin-with-username-password-e2ehelper), so we can use the sameInitiateAuthAPI to skip the browser entirely.Usage
Both flags must be supplied together; providing only one is a validation error.
Changes
deps/common/src/logseq/common/cognito_config.cljsCOGNITO-IDP-ENDPOINTconstantsrc/main/logseq/cli/auth.cljscognito-initiate-auth!,login-with-password!; branch inlogin!src/main/logseq/cli/command/auth.cljs--user/-uand--pass/-pto the login spec; validate the pair; thread credentials into the action mapsrc/main/logseq/cli/commands.cljsoptionstoauth-command/build-actionsrc/test/logseq/cli/auth_test.cljssrc/test/logseq/cli/command/auth_test.cljslogin!Notes
id-token,access-token,refresh-token,expires-at,sub,emailwritten toauth.jsonare identical to what the browser flow produces — no downstream changes needed.SECRET_HASHis required.ALLOW_USER_PASSWORD_AUTHis already enabled on the Cognito app client (confirmed by the existing frontend usage).