feat(auth): add OAuth 2.0 login flow for Bitbucket Cloud#152
Merged
avivsinai merged 1 commit intoavivsinai:masterfrom Apr 12, 2026
Merged
feat(auth): add OAuth 2.0 login flow for Bitbucket Cloud#152avivsinai merged 1 commit intoavivsinai:masterfrom
avivsinai merged 1 commit intoavivsinai:masterfrom
Conversation
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
| orig := cloudClientSecret | ||
| defer func() { cloudClientSecret = orig }() | ||
|
|
||
| cloudClientSecret = "build-secret" // gitleaks:allow |
2b7750f to
e5aee7d
Compare
- pkg/oauth/flow.go: full authorization code flow with localhost callback, state validation, code exchange, and /2.0/user verification - pkg/cmd/auth: --web runs OAuth for Cloud, --web-token opens token page; auth status shows OAuth expiry; mutual exclusion enforced - pkg/cmdutil: wire TokenRefresher for OAuth hosts, detect JSON blob in keyring, apply BKT_USERNAME/BKT_AUTH_METHOD on env token override - pkg/oauth/cloud.go: client creds via ldflags with runtime env var fallback for go install builds - Build/CI: Makefile, goreleaser, release workflow inject and validate OAuth secrets Closes avivsinai#136.
e5aee7d to
33de012
Compare
Owner
|
I reviewed the auth flow more closely and compared it against a few mature CLIs. The important bit: I am not comfortable claiming that Bitbucket Cloud can be supported as a true secretless/public-client flow today. What I found:
So as I see it, the choices are:
I would not merge a change that assumes PKCE means we can drop the secret unless we verify that against a real Bitbucket OAuth consumer first. @ekrako what do you prefer here:
|
Contributor
Author
|
Let's merge the current flow as-is — it's working end-to-end and matches |
Owner
|
Sounds good. Merging and releasing…
— aviv
…On Sun, 12 Apr 2026 at 11:52 Eran Krakovsky ***@***.***> wrote:
*ekrako* left a comment (avivsinai/bitbucket-cli#152)
<#152 (comment)>
Let's merge the current flow as-is — it's working end-to-end and matches
gh's approach. I'll open a follow-up PR to add PKCE on top.
—
Reply to this email directly, view it on GitHub
<#152 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAAD6VPNLY3TIT4XJJVWR734VNKMFAVCNFSM6AAAAACXVFJ5ASVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DEMZRGE2TEMJQHA>
.
You are receiving this because you commented.Message ID:
***@***.***>
|
avivsinai
approved these changes
Apr 12, 2026
Owner
avivsinai
left a comment
There was a problem hiding this comment.
Reviewed. Merging the current secret-backed OAuth flow now; PKCE can follow as a hardening pass in a separate PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds browser-based OAuth 2.0 login for Bitbucket Cloud via
bkt auth login --web.Short-lived access tokens are stored as JSON blobs in the keyring and transparently
refreshed on 401. The existing API-token flow is preserved under
--web-token.Closes #136 (Phase 2).
Changes
OAuth flow (
pkg/oauth/flow.go)/2.0/userverificationRefreshToken()for transparent 401-triggered refreshio.Writer(not stdout) for testabilityusername>account_id, never storesdisplay_nameas the API usernameAuth command (
pkg/cmd/auth/auth.go)--webon Cloud runs OAuth flow;--webon DC errors with guidance to use--web-token--web-tokenreplaces old--webbehavior (opens token management page)--weband--web-tokenare mutually exclusiveauth statusshows OAuth token expiry (hidden whenBKT_TOKENoverrides)--webfails fast if OAuth client credentials are missing from the buildToken refresh wiring (
pkg/cmdutil/client.go)NewCloudClientwiresTokenRefresherfor OAuth hosts using keyring tokensBKT_TOKENoverrides default to basicToken detection (
pkg/cmdutil/context.go)loadHostTokendetects JSON blob in keyring → extractsaccess_token, setsauth_method=oauthBKT_TOKENpath now appliesBKT_USERNAMEandBKT_AUTH_METHODoverrides (fixes OAuth host + env token)BKT_USERNAMEwhen overriding an OAuth Cloud host (prevents silent 401 from wrong username)Credentials injection (
pkg/oauth/cloud.go,Makefile,.goreleaser.yaml,release.yml)client_id/client_secretinjected at build time via-ldflags -XBKT_OAUTH_CLIENT_ID/BKT_OAUTH_CLIENT_SECRETenv vars forgo installbuildsCloud client (
pkg/bbcloud/client.go)AuthMethodandTokenRefreshertoOptionsSkill docs
SKILL.md,auth.md(regenerated),headless.mdwith OAuth env vars and examplesTesting
go test ./...— 1013 tests passbkt auth login --web→ browser consent → token stored →auth statusshows expiry--webwithout build creds → clear error;--webon DC → error with--web-tokenguidancepkg/oauth/flow_test.go: authorize URL, code exchange, refresh, state mismatch, full flow, error paths, randomStateRisks
BKT_OAUTH_CLIENT_ID/BKT_OAUTH_CLIENT_SECRETGitHub secrets must be added by repo admin before the next release (comment posted on feat(auth): OAuth 2.0 login for Cloud and Data Center #136)