feat(core): add Cloud OIDC + SM auth library#1036
Open
KrumTy wants to merge 2 commits into
Open
Conversation
Introduces `redisctl_core::auth`, the credential-bootstrapper backend for
`cloud auth login` (persistence and CLI wiring land in later units):
- `device_flow` — OAuth device authorization grant (RFC 8628), for headless
and agent contexts.
- `auth_code_loopback` — authorization code + PKCE (S256) over a loopback
redirect, for interactive browser login.
- `sm_api` — exchanges Okta tokens with the SM API (manual JSESSIONID + CSRF,
no cookie-store dependency) to enable CAPI and mint a user API key.
- `authenticator` — orchestrates login -> SM exchange -> `MintedCredentials`.
- shared OIDC plumbing + a redacting `TokenSet` (secrets never hit `{:?}`).
Pure library, self-contained (no config/cloud coupling), wiremock-tested
(34 tests). Additive: no existing command, flag, or behaviour changes. Adds
`reqwest`, `serde_urlencoded`, `url`, `base64`, `sha2`, `getrandom` to core.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Every other module in redisctl-core keeps a thin facade mod.rs (config, cloud, enterprise are all mod/use only); auth/mod.rs was the outlier, carrying TokenSet, AuthError, and the shared token-endpoint helpers. Move those into a private `oidc` submodule and re-export them, so auth/mod.rs is a facade like its siblings. Pure move: the flow/client files are unchanged (they still reference the helpers via `super::`), no behaviour change, tests untouched. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
KrumTy
force-pushed
the
feat/RED-210012/1/cloud-auth-core
branch
from
July 24, 2026 12:57
000dda9 to
ae45692
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
redisctl_core::auth, the credential-bootstrapper backend that will powerredisctl cloud auth login: run a standard OIDC sign-in, exchange the resultingtokens for a Redis Cloud API key, and hand it back to be persisted as a normal
cloud profile — so a first-time user no longer has to mint an API key by hand.
This is the first PR in a chained series for agent-native Cloud onboarding.
It is a pure, self-contained library with no user-facing surface yet — the
CLI commands, config persistence, and provisioning workflow land in follow-up
PRs. Splitting it out keeps each piece independently reviewable; this one is the
protocol/plumbing layer.
Fully additive: no existing command, flag, exit code, or behaviour changes.
What's in the module
device_flow— OAuth Device Authorization Grant (RFC 8628), for headless / agent contexts.auth_code_loopback— Authorization Code + PKCE (S256) over a loopback redirect, for interactive browser login.sm_api— exchanges the OIDC tokens for a Cloud API key (manual session cookie + CSRF handling; no cookie-store dependency).authenticator— orchestrates login → exchange →MintedCredentials.oidc— shared token-endpoint plumbing and aTokenSetwhoseDebugredacts token material.Scope
crates/redisctl-core/src/auth/*(new module),src/lib.rs(re-exports),Cargo.toml+ workspaceCargo.toml(new deps).CloudAuthenticator,SmApiClient,DeviceFlowClient,LoopbackFlowClient,TokenSet,AuthError,MintedCredentials, …). No existing APIs changed.reqwest,serde_urlencoded,url,base64,sha2,getrandom.wiremock-based unit tests (success and error paths for each flow, plus the SM exchange).Testing
cargo test -p redisctl-core # 34 auth tests bind localhost portscargo clippy --workspace --all-targets --all-features -- -D warningsChecklist