Add nextflow auth command for Seqera Platform authentication by pditommaso · Pull Request #6463 · nextflow-io/nextflow

pditommaso · 2025-10-09T17:18:59Z

Summary

Adds new nextflow auth command group for simplified authentication with Seqera Platform
Implements auth login, auth logout, auth status, and auth config subcommands
Uses Auth0 device-flow authentication for secure token generation
Stores authentication credentials in ~/.nextflow/seqera-auth.config
Provides interactive CLI for workspace and compute environment configuration

Key Features

auth login: Interactive OAuth authentication flow with Auth0
auth logout: Removes stored authentication credentials
auth status: Displays current authentication status, workspace, and compute environment
auth config: Configure default workspace and primary compute environment

Implementation Details

Core command implementation in CmdAuth.groovy with delegation to AuthCommandImpl in nf-tower plugin
Uses PlatformHelper for consistent token and endpoint management
Colored CLI output with ColorUtil for better UX
Comprehensive test coverage with unit tests for both core and plugin implementations

Documentation

Updated docs/install.md with authentication instructions
Added detailed CLI reference in docs/reference/cli.md

Test plan

Unit tests for CmdAuth and ColorUtil
Comprehensive tests for AuthCommandImpl covering all auth flows
Manual testing of auth login/logout/status/config workflows
Verification of integration with existing Platform functionality

🤖 Generated with Claude Code

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Set TOWER_ACCESS_TOKEN with new PAT. Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Signed-off-by: jorgee <jorge.ejarque@seqera.io>

ewels · 2025-10-09T18:39:28Z

Should be good to go now @pditommaso

christopher-hakkaart

Suggestions added

docs/reference/cli.md

docs/reference/env-vars.md

docs/reference/cli.md

Co-authored-by: Chris Hakkaart <chris.hakkaart@seqera.io> Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

docs/reference/cli.md

Co-authored-by: Chris Hakkaart <chris.hakkaart@seqera.io> Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

… tests [ci fast] - Replace consecutive // comments with block /* */ style in CmdAuth and AuthCommandImpl - Rename TOWER_AUTH_ID to TOWER_AUTH_CLIENT_ID in code and documentation - Add comprehensive Spock tests for PlatformHelper.getAuthDomain() and getAuthClientId() - Fix environment variable handling to check env vars before switch statement - Add explanatory comments about env var precedence logic Signed-off-by: Paolo Di Tommaso <paolo.ditommaso@gmail.com>

pditommaso · 2025-10-13T19:55:36Z

@ewels regarding the colours, don't know it's a problem with the screen, but I count at least 9 different colours

Signed-off-by: Paolo Di Tommaso <paolo.ditommaso@gmail.com>

pditommaso · 2025-10-13T20:40:19Z

@ewels fixed some tests, and removed some dead code. Please have a look at cb89f35

ewels · 2025-10-13T20:53:27Z

Ah you're my hero @pditommaso, I just sat down to try to figure out these failing tests.

I definitely remember writing this to fix the tests previously:

-        def result = cmd.getConfigValue(config, 'tower.accessToken', 'TOWER_ACCESS_TOKEN', null)
+        def result = cmd.getConfigValue(config, 'tower.accessToken', 'TOWER_ACCESS_TOKEN')

But I can't find it anywhere now so no idea where that commit went 😓 But never mind, as long as it works now! Thank you for fixing!

modules/nextflow/src/main/groovy/nextflow/platform/PlatformHelper.groovy

Signed-off-by: Paolo Di Tommaso <paolo.ditommaso@gmail.com>

ewels · 2025-10-13T21:04:26Z

@ewels regarding the colours, don't know it's a problem with the screen, but I count at least 9 different colours

Legend / explainer

1: No colour
2: magenta
3: No colour + dim
4: Green
5: Blue
6: Yellow
7: Yellow + bold
8: blue + dim
9: magenta + dim

So it's 4, following roughly this scheme (which I generally apply with colours in a non-strict way):

Magenta: file paths / URLs
Blue: variables / commands
Green: Success
Yellow: Warn

Then dim for "not important" and bold for "important".

Discussion

I think it looks more extreme with your colour scheme because your default colour (green) has such strong saturation, which makes the contrast between colours more extreme. With my terminal setup everything is a lot more muted / closer in colour:

But not everyone is using my terminal setup 😀 And I agree that it's a bit much. I'll strip some of this out where it's not adding much functionality 👍🏻

New commit about to be incoming to this PR..

Signed-off-by: Paolo Di Tommaso <paolo.ditommaso@gmail.com>

pditommaso

It looks a in good shape. Left a couple of minor comments

modules/nextflow/src/main/groovy/nextflow/platform/PlatformHelper.groovy

plugins/nf-tower/src/main/io/seqera/tower/plugin/auth/AuthCommandImpl.groovy

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

ewels · 2025-10-13T21:57:00Z

Ok, I removed a lot of the colour from the code:

I personally find it a bit harder to read now, but I know we're at opposite ends of the spectrum on this 😅 Hopefully this is an ok middle ground..?

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

ewels · 2025-10-14T06:51:42Z

Ok I think I managed to replicate your colour theme @pditommaso. This is how the colours should now look for you:

Reminder that NO_COLOR strips all colours, if that's better 😅

pditommaso · 2025-10-14T07:47:20Z

Much better the colours now!

pditommaso · 2025-10-14T08:37:03Z

Approved ✅

ewels

I approve this code!

ewels and others added 30 commits September 29, 2025 13:40

WIP: First attempt at auth0 flow for 'nextflow auth login'

0f9904e

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Handle Enterprise installs without auth0

b599fe1

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Add auth0 client ID

5fa52fc

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Hardcode 'platform' as audience as shouldn't ever need to edit this

f031622

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Add additional allowed API URLs for auth0 flow

a0d800a

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Use auth0 to generate a Platform PAT, add to bashrc

ec86e14

Set TOWER_ACCESS_TOKEN with new PAT. Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

WIP: Started work on 'nextflow auth logout'

356e8f5

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Rewrite: Save to ~/.nextflow/config instead of using env vars

b6b6127

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Always set tower.enabled true when logging in

ec03361

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

nextflow auth config

cf344f9

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Add code comment next to workspace ID saying what the org / ws is

f6f3694

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

New nextflow auth status command

ba279b1

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Don't prompt for API URL, just have it as a CLI option

0b01234

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Add warnings to login and logout if TOWER_ACCESS_TOKEN is set

1909da0

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Bugfix: change how workspace name and fullName are used

0b3ffab

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Tell the user we're using their env var token in 'auth config'

b31b1c7

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Add colour

b9547ff

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Refactor colour helpers to take string argument

fa056b5

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Minor tweak

320bee4

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Switch from PKCE to device-flow auth, with code confirmation

39d3c64

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Add support for Platform auth on stage and prod

261e1e6

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Tweak formatting

8a2b847

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Auth flow with code, appended to URL

a340b66

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Prompt to open browser, don't do it without warning

4c7cf83

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Rename AuthColorUtil to ColorUtil, expect to use it elsewhere

564890b

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Improve styling and flow for status / auth

4015186

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

lots of testing and tweaking CLI

95908ff

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Code cleanup

3a67b90

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Add some tests

248fedc

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

move authcommand implementation to nf-tower

5c7a192

Signed-off-by: jorgee <jorge.ejarque@seqera.io>

christopher-hakkaart reviewed Oct 9, 2025

View reviewed changes

pditommaso force-pushed the master branch from b7b4221 to c1114bc Compare October 9, 2025 20:41

ewels reviewed Oct 13, 2025

View reviewed changes

docs/reference/cli.md Outdated Show resolved Hide resolved

Apply docs suggested changes

567de11

Co-authored-by: Chris Hakkaart <chris.hakkaart@seqera.io> Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

ewels reviewed Oct 13, 2025

View reviewed changes

docs/reference/cli.md Outdated Show resolved Hide resolved

ewels and others added 3 commits October 13, 2025 16:25

Update docs/reference/cli.md

4cece61

Co-authored-by: Chris Hakkaart <chris.hakkaart@seqera.io> Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Merge branch 'master' into nextflow-auth [ci fast]

cd74cc8

Cleanup and fix tests

cb89f35

Signed-off-by: Paolo Di Tommaso <paolo.ditommaso@gmail.com>

ewels reviewed Oct 13, 2025

View reviewed changes

modules/nextflow/src/main/groovy/nextflow/platform/PlatformHelper.groovy Show resolved Hide resolved

Cleanup and docs [ci fast]

19c6260

Signed-off-by: Paolo Di Tommaso <paolo.ditommaso@gmail.com>

Minor changes [ci fast]

35b99ef

Signed-off-by: Paolo Di Tommaso <paolo.ditommaso@gmail.com>

pditommaso commented Oct 13, 2025

View reviewed changes

modules/nextflow/src/main/groovy/nextflow/platform/PlatformHelper.groovy Show resolved Hide resolved

plugins/nf-tower/src/main/io/seqera/tower/plugin/auth/AuthCommandImpl.groovy Outdated Show resolved Hide resolved

ewels added 3 commits October 13, 2025 23:47

Strip out a load of colour

9c34db8

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Fix bug in fetching primary compute CE for personal workspace

1f57a78

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

Remove more colours, tiny bit of cleanup

d15ea81

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

ewels force-pushed the nextflow-auth branch from d9986fa to d15ea81 Compare October 13, 2025 21:48

Update tests

d3f2fa2

Signed-off-by: Phil Ewels <phil.ewels@seqera.io>

ewels approved these changes Oct 14, 2025

View reviewed changes

pditommaso merged commit bedf02a into master Oct 14, 2025
29 checks passed

pditommaso deleted the nextflow-auth branch October 14, 2025 12:10

Conversation

pditommaso commented Oct 9, 2025

Summary

Key Features

Implementation Details

Documentation

Test plan

Uh oh!

ewels commented Oct 9, 2025

Uh oh!

christopher-hakkaart left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pditommaso commented Oct 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pditommaso commented Oct 13, 2025

Uh oh!

ewels commented Oct 13, 2025

Uh oh!

Uh oh!

ewels commented Oct 13, 2025

Legend / explainer

Discussion

Uh oh!

pditommaso left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ewels commented Oct 13, 2025

Uh oh!

ewels commented Oct 14, 2025

Uh oh!

pditommaso commented Oct 14, 2025

Uh oh!

pditommaso commented Oct 14, 2025

Uh oh!

ewels left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

pditommaso commented Oct 13, 2025 •

edited

Loading