Implement new GitHub device authentication flow (#937)

Co-authored-by: Fredrik Ekre <[email protected]>
Co-authored-by: Mosè Giordano <[email protected]>
Co-authored-by: Mosè Giordano <[email protected]>
Co-authored-by: Elliot Saba <[email protected]>

Author: 4 people

src/wizard/github.jl

@@ -27,77 +27,85 @@ function github_auth(;allow_anonymous::Bool=true)
     return _github_auth[]
 end
 
-function obtain_token(; ins=stdin, outs=stdout, github_api=GitHub.DEFAULT_API)
+function obtain_token(; outs=stdout, github_api=GitHub.DEFAULT_API)
     println(outs)
-    printstyled(outs, "Creating a github access token\n", bold=true)
+    printstyled(outs, "Authenticating with GitHub\n", bold=true)
+
+
+    @label retry
+
+    headers = Dict{String, String}("User-Agent"=>"BinaryBuilder-jl",
+        "Accept"=>"application/json")
+
+    # Request device authentication flow for BinaryBuilder OAauth APP
+    resp = HTTP.post("https://github.com/login/device/code", headers,
+        "client_id=2a955f9ca1a7c5b720f3&scope=public_repo")
+    if resp.status != 200
+        GitHub.handle_response_error(resp)
+    end
+    reply = JSON.parse(HTTP.payload(resp, String))
+
     println(outs, """
-    To continue, we need to create a GitHub access token, so that we can do
-    things like fork Yggdrasil and create pull requests against it.  To create
-    an access token, you will be asked to enter your GitHub credentials:
-    """)
+    To continue, we need to authenticate you with GitHub. Please navigate to
+    the following page in your browser and enter the code below:
 
-    params = Dict(
-        # The only thing we really need to do is write to public repos
-        "scopes" => [
-            "public_repo",
-        ],
-        "note" => "BinaryBuilder.jl generated token at $(now())",
-        "note_url" => "https://github.com/JuliaPackaging/BinaryBuilder.jl",
-        "fingerprint" => randstring(40)
-    )
+         $(HTTP.URIs.unescapeuri(reply["verification_uri"]))
+
+         #############
+         # $(reply["user_code"]) #
+         #############
+    """)
 
+    interval = reply["interval"]
+    device_code = reply["device_code"]
     while true
-        if !isopen(ins) || (!Sys.iswindows() && !isopen(stdin))
-            # We have to check also `stdin` because `_getpass` ignores `ins` and
-            # always uses `stdin` on Unices.
-            error("Cannot read from input stream")
-        end
+        # Poll for completion
+        sleep(interval)
+        resp = HTTP.post("https://github.com/login/oauth/access_token", headers,
+            "client_id=2a955f9ca1a7c5b720f3&grant_type=urn:ietf:params:oauth:grant-type:device_code&device_code=$device_code")
 
-        user = nonempty_line_prompt("Username", "GitHub username:", ins=ins, outs=outs)
-        password = nonempty_line_prompt("Password", "GitHub password:"; ins=ins, outs=outs, echo=false)
-
-        # Shuffle this junk off to the GH API
-        headers = Dict{String, String}("User-Agent"=>"BinaryBuilder-jl")
-        auth = GitHub.UsernamePassAuth(user, password)
-        resp = GitHub.gh_post(
-            github_api,
-            "/authorizations";
-            headers=headers,
-            params=params,
-            handle_error=false,
-            auth=auth,
-        )
-        if resp.status == 401 && startswith(strip(HTTP.getkv(resp.headers, "X-GitHub-OTP", "")), "required")
-            otp_code = nonempty_line_prompt("Authorization code", "Two-factor authentication in use, enter auth code:")
-            resp = GitHub.gh_post(
-                github_api,
-                "/authorizations";
-                headers=merge(headers, Dict("X-GitHub-OTP" => otp_code)),
-                params=params,
-                handle_error=false,
-                auth = auth,
-            )
-        end
-        if resp.status == 401
-            printstyled(outs, "Invalid credentials!", color=:red)
-            println(outs)
-            continue
-        end
         if resp.status != 200
             GitHub.handle_response_error(resp)
         end
-        token = JSON.parse(HTTP.payload(resp, String))["token"]
+
+
+        token_reply = JSON.parse(HTTP.payload(resp, String))
+        if haskey(token_reply, "error")
+            error_kind = token_reply["error"]
+            if error_kind == "authorization_pending"
+                continue
+            elseif error_kind == "slow_down"
+                @warn "GitHub Auth rate limit exceeded. Waiting 10s. (This shouldn't happen)"
+                sleep(10)
+            elseif error_kind == "expired_token"
+                @error "Token request expired. Starting over!"
+                @goto retry
+            elseif error_kind == "access_denied"
+                @error "Authentication request canceled by user. Starting over!"
+                @goto retry
+            elseif error_kind in ("unsupported_grant_type",
+                "incorrect_client_credentials", "incorrect_device_code")
+                error("Received error kind $(error_kind). Please file an issue.")
+            else
+                error("Unexpected GitHub login error $(error_kind)")
+            end
+        end
+
+        token = token_reply["access_token"]
 
         print(outs, strip("""
         Successfully obtained GitHub authorization token!
-        This token will be used for the rest of this BB session, however if you
-        wish to use this token permanently, you may set it in your environment
-        as via the following line in your """))
+        This token will be used for the rest of this BB session.
+        You will have to re-authenticate for any future session.
+        However, if you wish to bypass this step, you may create a
+        personal access token at """))
+        printstyled("https://github.com/settings/tokens"; bold=true)
+        println("\n and add the token to the")
         printstyled(outs, "~/.julia/config/startup.jl"; bold=true)
-        println(outs, "file:")
+        println(outs, " file as:")
         println(outs)
 
-        printstyled(outs, "    ENV[\"GITHUB_TOKEN\"] = \"$(token)\""; bold=true)
+        printstyled(outs, "    ENV[\"GITHUB_TOKEN\"] = <token>"; bold=true)
         println(outs)
 
         println(outs, "This token is sensitive, so only do this in a computing environment you trust.")

test/wizard.jl

@@ -417,8 +417,5 @@ end
 @testset "GitHub - authentication" begin
     withenv("GITHUB_TOKEN" => "") do
         @test Wizard.github_auth(allow_anonymous=true) isa GitHub.AnonymousAuth
-        input_stream = IOBuffer()
-        close(input_stream)
-        @test_throws ErrorException Wizard.obtain_token(ins=input_stream)
     end
 end