auth: align OAuth client-id storage with the forge-wide credential model (ADR 0025 follow-up) #40

New issue

Closed

opened 2026-07-13 18:42:37 +00:00 by hexajon · 0 comments

hexajon commented

2026-07-13 18:42:37 +00:00

(Migrated from codeberg.org)

Follow-up from the ADR 0025 review (epic #30; out of scope for that pass):

persistOAuthClientID(id, setupGlobal) (internal/cmd/setup/web.go:126) still keys its storage scope off the --global flag, which ADR 0025 deprecated for login (a login is forge-wide). Two facts to respect from the review:

MarkDeprecated does not disable the flag — a user passing --global still sets setupGlobal=true (with a notice), so the old scope opt-in technically still works.
The stored key is the bare madtea.oauth-client-id (web.go:31), NOT host-suffixed — blindly forcing it global would collide across forges under the one-account-per-forge model.

Decide and implement the ADR-0025-consistent shape: likely a per-host key (madtea.oauth-client-id-<sanitized-host>, matching the madtea.token-enc-<sanitized-host> convention) written forge-wide, with a legacy read of the bare key. Include the migration story for existing bare-key installs.

Acceptance:

OAuth client-id storage no longer depends on the deprecated login --global scope.
Two forges can hold distinct client-ids without collision.
Legacy bare-key installs keep working (read fallback or migrate-on-first-use).
ADR 0013 locks stay green.

Follow-up from the ADR 0025 review (epic #30; out of scope for that pass): `persistOAuthClientID(id, setupGlobal)` (internal/cmd/setup/web.go:126) still keys its storage scope off the `--global` flag, which ADR 0025 deprecated for login (a login is forge-wide). Two facts to respect from the review: - `MarkDeprecated` does not disable the flag — a user passing `--global` still sets `setupGlobal=true` (with a notice), so the old scope opt-in technically still works. - The stored key is the bare `madtea.oauth-client-id` (web.go:31), NOT host-suffixed — blindly forcing it global would collide across forges under the one-account-per-forge model. Decide and implement the ADR-0025-consistent shape: likely a per-host key (`madtea.oauth-client-id-<sanitized-host>`, matching the `madtea.token-enc-<sanitized-host>` convention) written forge-wide, with a legacy read of the bare key. Include the migration story for existing bare-key installs. Acceptance: - OAuth client-id storage no longer depends on the deprecated login `--global` scope. - Two forges can hold distinct client-ids without collision. - Legacy bare-key installs keep working (read fallback or migrate-on-first-use). - ADR 0013 locks stay green.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea#40

No description provided.

Rows
Columns