fix(auth): harden Windows OAuth callback handling, preserve PKCE login flow on Windows

Author: digitallysavvy

internal/cli/app_test.go

@@ -6,6 +6,7 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"os"
 	"path/filepath"
 	"regexp"
@@ -561,6 +562,36 @@ func TestWaitForOAuthCallbackMismatchAndTimeout(t *testing.T) {
 	}
 }
 
+func TestWaitForOAuthCallbackAcceptsIPv4WhenRedirectUsesLocalhost(t *testing.T) {
+	server, err := waitForOAuthCallback("expected-state", time.Second)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer server.Close()
+	if !strings.HasPrefix(server.RedirectURI, "http://localhost:") {
+		t.Fatalf("expected localhost redirect URI for OAuth compatibility, got %s", server.RedirectURI)
+	}
+	if len(server.listeners) == 0 {
+		t.Fatal("expected at least one loopback listener")
+	}
+	parsed, err := url.Parse(server.RedirectURI)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp, err := http.Get("http://127.0.0.1:" + parsed.Port() + "/oauth/callback?code=test-code&state=expected-state")
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+	payload, err := server.Wait()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if payload.Code != "test-code" || payload.State != "expected-state" {
+		t.Fatalf("unexpected callback payload: %+v", payload)
+	}
+}
+
 func TestExchangeAuthorizationCodeFailureAndScopeArray(t *testing.T) {
 	failServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusBadRequest)

internal/cli/auth.go

@@ -180,7 +180,7 @@ type callbackServer struct {
 	wait        chan callbackPayload
 	errs        chan error
 	server      *http.Server
-	listener    net.Listener
+	listeners   []net.Listener
 }
 
 type callbackPayload struct {
@@ -195,19 +195,24 @@ func waitForOAuthCallback(expectedState string, timeout time.Duration) (*callbac
 	srv := &http.Server{
 		Handler: mux,
 		// Set ReadHeaderTimeout to mitigate Slowloris attacks (gosec G112).
-		// Even though this listens only on 127.0.0.1, we still bound it.
+		// Even though this listens only on loopback interfaces, we still bound it.
 		ReadHeaderTimeout: 10 * time.Second,
 	}
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	ln4, err := net.Listen("tcp4", "127.0.0.1:0")
 	if err != nil {
 		return nil, err
 	}
+	port := ln4.Addr().(*net.TCPAddr).Port
+	listeners := []net.Listener{ln4}
+	if ln6, err := net.Listen("tcp6", fmt.Sprintf("[::1]:%d", port)); err == nil {
+		listeners = append(listeners, ln6)
+	}
 	cs := &callbackServer{
-		RedirectURI: fmt.Sprintf("http://localhost:%d/oauth/callback", ln.Addr().(*net.TCPAddr).Port),
+		RedirectURI: fmt.Sprintf("http://localhost:%d/oauth/callback", port),
 		wait:        wait,
 		errs:        errs,
 		server:      srv,
-		listener:    ln,
+		listeners:   listeners,
 	}
 	mux.HandleFunc("/oauth/callback", func(w http.ResponseWriter, r *http.Request) {
 		code := r.URL.Query().Get("code")
@@ -228,9 +233,11 @@ func waitForOAuthCallback(expectedState string, timeout time.Duration) (*callbac
 			wait <- callbackPayload{Code: code, State: state}
 		}
 	})
-	go func() {
-		_ = srv.Serve(ln)
-	}()
+	for _, listener := range listeners {
+		go func(ln net.Listener) {
+			_ = srv.Serve(ln)
+		}(listener)
+	}
 	go func() {
 		<-time.After(timeout)
 		errs <- errors.New("Timed out waiting for the OAuth callback. Re-run with --no-browser to copy the URL manually, or check that your browser completed the login flow.")
@@ -248,7 +255,16 @@ func (c *callbackServer) Wait() (callbackPayload, error) {
 }
 
 func (c *callbackServer) Close() error {
-	return c.server.Close()
+	var firstErr error
+	if err := c.server.Close(); err != nil {
+		firstErr = err
+	}
+	for _, listener := range c.listeners {
+		if err := listener.Close(); err != nil && !errors.Is(err, net.ErrClosed) && firstErr == nil {
+			firstErr = err
+		}
+	}
+	return firstErr
 }
 
 type tokenResponse struct {