feat(auth): automatically fetch Columnar license on login #223

zeroshade · 2025-12-08T18:46:57Z

When using dbc auth login to login to the Columnar private registry, we'll check the token and see if it contains the trial_start claim, downloading the license if it exists.

There's some more work that needs to happen here so I'm leaving this marked as WIP, such as:

Picking a domain for the cloudflare workers
making the worker domain configurable via env var
unit tests
verifying this workflow makes sense

ianmcook · 2025-12-12T02:34:38Z

Nice! Let's also please make it so that if the user runs dbc install or dbc sync to install a private driver, dbc checks to see whether:

the user is authenticated
the user has an active trial license
the user has not yet downloaded columnar.lic and put it in the required location.

If all three of those things are true, dbc should download columnar.lic and put it in the required location for the user.

zeroshade · 2025-12-12T21:25:23Z

@ianmcook updated per your suggestion

zeroshade · 2025-12-12T21:25:46Z

Added @lidavidm so he can see where dbc is putting the license

ianmcook · 2025-12-12T21:57:29Z

@ianmcook updated per your suggestion

Nice! I tested it successfully.

lidavidm

If you log in and your trial is expired, you don't get any feedback:

$ dlv debug --headless ./cmd/dbc -- auth login
API server listening at: 127.0.0.1:39367
Opening https://auth.columnar.tech/activate?user_code=QVLR-GDCV in your default web browser...
Gtk-Message: 13:10:44.101: Not loading module "atk-bridge": The functionality is provided by GTK natively. Please try to not load it.
Authentication successful!

In dlv, I can see that I got a 403:

> github.com/columnar-tech/dbc/auth.FetchColumnarLicense() ./auth/credentials.go:318 (PC: 0x978c8a)
   313:		if err != nil {
   314:			return err
   315:		}
   316:		defer resp.Body.Close()
   317:	
=> 318:		if resp.StatusCode != http.StatusOK {
   319:			return fmt.Errorf("failed to fetch license: %s", resp.Status)
   320:		}
   321:	
   322:		licenseFile, err := os.OpenFile(licensePath, os.O_CREATE|os.O_TRUNC|os.O_RDWR, 0o600)
   323:		if err != nil {
(dlv) p resp.StatusCode
403

But this is not reported in the UI.

amoeba · 2025-12-24T01:08:29Z

I'm not sure if this is the same error as @lidavidm got but here's what I did:

Ran go run ./cmd/dbc auth login
In my browser, saw the user code, clicked Confirm
Logged in to Columnar with Google
Got to my account details page (https://cloud.columnar.tech/account)

Back in my terminal, the CLI is stuck on

Authentication successful!
⠙ Waiting for confirmation...

I note that my trial is expired. Also I notice that the text says

Expires: Thu, 25 Dec 2025 23:16:09 GMT

but it should probably tell me that my license is expired.

cmd/dbc/auth.go

zeroshade · 2026-01-05T16:50:11Z

@amoeba can you try again? It looks good to me (and I'll update the website to be more explicit when the trial is expired)

…ave it

Co-authored-by: Bryce Mecum <[email protected]>

amoeba · 2026-01-11T21:45:30Z

Thanks @zeroshade. I can't reproduce anymore as I don't have an expired license but dbc auth login works fine now.

auth/credentials.go

amoeba · 2026-01-12T21:10:34Z

cmd/dbc/main.go

+		var cmd tea.Cmd
+		switch {
+		case errors.Is(msg, auth.ErrTrialExpired):
+			cmd = tea.Println(errStyle.Render("Could not download license, trial has expired"))


set non-zero status? I'm not totally sure if we should or not.

My personal opinion is that we don't need a non-zero status for the trial handling because I don't want dbc to always fail if they login but haven't started the trial yet etc.

okay, after discussing with @ianmcook we decided that this will give a non-zero status, but it won't error/give a non-zero status during dbc auth login. It'll only error during install/sync

I've updated this accordingly

cmd/dbc/main.go

amoeba · 2026-01-12T23:59:59Z

I ran into an issue while testing driver list support for this,

$ go run ./cmd/dbc info red-o
Driver: red-o
Version: 0.3.0
Title: Columnar ADBC Driver red-o
License: LicenseRef-PBL
Description: An ADBC driver for Oracle Database developed by Columnar
Available Packages:
   - linux_amd64
   - linux_arm64
   - macos_arm64
   - windows_amd64
   
~/src/columnar-tech/dbc auth-fetch-license
$ go run ./cmd/dbc init

~/src/columnar-tech/dbc auth-fetch-license
$ go run ./cmd/dbc add red-o
added red-o to driver list
use `dbc sync` to install the drivers in the list

~/src/columnar-tech/dbc auth-fetch-license
$ go run ./cmd/dbc sync
Error: failed to download driver: failed to download driver https://dbc-cdn-private.columnar.tech/red-o/v0.3.0/red-o_macos_arm64_v0.3.0.tar.gz: 401 Unauthorized
exit status 1

This was go running from 7a4e818e9e20269d133df301dbfa9cf63d2c1de7.

amoeba · 2026-01-13T00:27:20Z

I ran dbc auth login and it worked after I did that. I can't remember how I got the token that 401's but, looking at it decoded, the biggest difference is that,

The token that 401s had "permissions":[]
The token that worked fine had "permissions":["access:index","access:red-o"]

Otherwise things looked structurally similar.

zeroshade · 2026-01-13T00:39:10Z

sigh yea, looks like I might have to do part of what I was discussing with Ian. I was trying to reduce calls and latency but I guess there's no way around it. I'll do some stuff tomorrow to make this more robust and handle things better instead of relying on the (potentially stale) login token

zeroshade · 2026-01-14T17:13:16Z

@amoeba Okay, I've updated the lambda func to fallback and make a call to heimdall.columnar.tech for the latest token when the token came from Auth0 and doesn't contain the appropriate permissions. This will cover the scenario you had where you had to re-login.

amoeba · 2026-01-17T00:58:19Z

Nice! Let me test that out in a sec and I'll report back.

amoeba · 2026-01-17T01:12:30Z

I wasn't able to get this to work how I expected. I deleted my account in auth0, signed up with a fresh account, logged in but did not start my trial, ran dbc auth login, started my trial, and ran dbc install oracle. It hung for a good 5-10 seconds and then error'd with,

$ go run ./cmd/dbc install oracle
Error: failed to download driver https://dbc-cdn-private.columnar.tech/oracle/v0.4.0/oracle_macos_arm64_v0.4.0.tar.gz: 401 Unauthorized
exit status 1

amoeba · 2026-01-17T01:15:46Z

I had mitmproxy running dbc made two requests (amongst others) to install the driver. The first 401 had a JWT with "permissions":[] as expected. The second 401 had "permissions":["access:index","access:red-o"]}

amoeba · 2026-01-17T01:20:26Z

Maybe something else is going on. I went back to the preview Cloud site and the UI didn't show I had a trial. I then tried to restart my trial and it kept failing after I hit Accept with a 400 "Trial already started" in the console. I'll file a bug since the registry site needs to handle that.

zeroshade requested review from amoeba, esadek and ianmcook December 8, 2025 18:46

zeroshade temporarily deployed to snapshot December 8, 2025 18:47 — with GitHub Actions Inactive

zeroshade force-pushed the auth-fetch-license branch from e424e54 to 052c212 Compare December 12, 2025 20:04

zeroshade temporarily deployed to snapshot December 12, 2025 20:04 — with GitHub Actions Inactive

zeroshade changed the title ~~WIP: feat(auth): automatically fetch Columnar license on login~~ feat(auth): automatically fetch Columnar license on login Dec 12, 2025

zeroshade force-pushed the auth-fetch-license branch from 052c212 to f59154c Compare December 12, 2025 21:24

zeroshade temporarily deployed to snapshot December 12, 2025 21:24 — with GitHub Actions Inactive

zeroshade requested a review from lidavidm December 12, 2025 21:25

zeroshade temporarily deployed to snapshot December 12, 2025 21:38 — with GitHub Actions Inactive

lidavidm reviewed Dec 23, 2025

View reviewed changes

zeroshade force-pushed the auth-fetch-license branch from e5e59dc to c627606 Compare December 23, 2025 17:52

zeroshade temporarily deployed to snapshot December 23, 2025 17:52 — with GitHub Actions Inactive

zeroshade temporarily deployed to snapshot December 23, 2025 17:59 — with GitHub Actions Inactive

zeroshade had a problem deploying to snapshot December 23, 2025 18:04 — with GitHub Actions Failure

zeroshade temporarily deployed to snapshot December 23, 2025 18:06 — with GitHub Actions Inactive

zeroshade temporarily deployed to snapshot December 23, 2025 18:16 — with GitHub Actions Inactive

zeroshade temporarily deployed to snapshot December 23, 2025 18:53 — with GitHub Actions Inactive

amoeba reviewed Dec 24, 2025

View reviewed changes

cmd/dbc/auth.go Outdated Show resolved Hide resolved

zeroshade force-pushed the auth-fetch-license branch from 74fdb80 to f814d75 Compare January 5, 2026 16:44

zeroshade temporarily deployed to snapshot January 5, 2026 16:44 — with GitHub Actions Inactive

zeroshade temporarily deployed to snapshot January 6, 2026 20:50 — with GitHub Actions Inactive

WIP: feat(auth): auto-download license

980c9b0

zeroshade and others added 11 commits January 7, 2026 12:44

only download license for trial_started accounts

f254f5c

download the license when installing a driver if they don't already h…

32b4873

…ave it

add message if trial is not started

d6e78a5

add message for trial expired

3d0ad89

update comment and deps

adfff3e

go mod tidy

ec54ba9

regenerate go.sum

cf85d78

fix deps and go.sum

af3c570

handle race condition

e0efabc

Update cmd/dbc/auth.go

7425b8f

Co-authored-by: Bryce Mecum <[email protected]>

fix hang

56f6a51

amoeba reviewed Jan 12, 2026

View reviewed changes

fix from comments

f857861

zeroshade force-pushed the auth-fetch-license branch from 8ccf3c3 to f857861 Compare January 12, 2026 21:42

zeroshade temporarily deployed to snapshot January 12, 2026 21:42 — with GitHub Actions Inactive

Merge branch 'main' into auth-fetch-license

838bb5f

zeroshade temporarily deployed to snapshot January 12, 2026 21:43 — with GitHub Actions Inactive

non-zero status

7a4e818

zeroshade deployed to snapshot January 12, 2026 23:13 — with GitHub Actions Active

zeroshade merged commit 656e7da into main Jan 17, 2026
13 of 14 checks passed

zeroshade deleted the auth-fetch-license branch January 17, 2026 18:17

feat(auth): automatically fetch Columnar license on login #223

feat(auth): automatically fetch Columnar license on login #223

Conversation

zeroshade commented Dec 8, 2025

Uh oh!

ianmcook commented Dec 12, 2025

Uh oh!

zeroshade commented Dec 12, 2025

Uh oh!

zeroshade commented Dec 12, 2025

Uh oh!

ianmcook commented Dec 12, 2025

Uh oh!

lidavidm left a comment

Choose a reason for hiding this comment

Uh oh!

amoeba commented Dec 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

zeroshade commented Jan 5, 2026

Uh oh!

amoeba commented Jan 11, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

amoeba Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

zeroshade Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

zeroshade Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

amoeba commented Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

amoeba commented Jan 13, 2026

Uh oh!

zeroshade commented Jan 13, 2026

Uh oh!

zeroshade commented Jan 14, 2026

Uh oh!

amoeba commented Jan 17, 2026

Uh oh!

amoeba commented Jan 17, 2026

Uh oh!

amoeba commented Jan 17, 2026

Uh oh!

amoeba commented Jan 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

amoeba commented Dec 24, 2025 •

edited

Loading

zeroshade Jan 12, 2026 •

edited

Loading

amoeba commented Jan 12, 2026 •

edited

Loading