Add Docker-compatible device authentication

[SiebeBaree]

Summary by CodeRabbit

• New Features
  • Updated terminal login to use an OAuth device verification flow (open browser on host, CLI completes authentication elsewhere).
  • Enhanced secure credential storage with OS keyring support and a protected file-based fallback.
  • Added ENKRYPTIFY_STORE_PATH support to control where credentials are persisted.
• Documentation
  • Added Docker/dev-container login instructions, verification troubleshooting, and credential persistence guidance.
• Bug Fixes
  • Improved handling of denied/expired/device-flow failures and more accurate unauthenticated detection (401/403).
• Tests
  • Reworked login-flow integration tests to cover device-flow success, reauth, denial, timeouts, and credential-store edge cases.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 210b4a82-003d-4c90-ab05-d74017d54c9e

📥 Commits

Reviewing files that changed from the base of the PR and between b928869 and 8625049.

📒 Files selected for processing (4)

• src/api/auth.ts
• src/lib/keyring.ts
• tests/integration/file-keyring.test.ts
• tests/integration/login-flow.test.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• tests/integration/login-flow.test.ts
• src/api/auth.ts

---

Walkthrough

The CLI replaces OAuth PKCE callback authentication with OAuth device-code authentication, including browser verification, polling, cancellation, expiry, and token persistence. Credential storage now uses the OS keyring when available and falls back to a protected JSON file with configurable paths and atomic writes. Integration tests cover authentication outcomes and filesystem behavior. The README documents containerized login and credential persistence.

Estimated code review effort: 4 (Complex) | ~60 minutes

Possibly related PRs

• Enkryptify/cli#38: Directly connects to the new file/OS keyring fallback behavior.
• Enkryptify/cli#59: Directly connects to the changed keytar loading implementation.
• Enkryptify/cli#76: Directly connects to the authentication browser-flow changes.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: switching login to a Docker-compatible device authentication flow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/docker-device-auth

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/api/auth.ts`:
- Around line 53-63: Update the access-token validation in the authentication
flow around getUserInfo so transient errors are not converted to null and do not
trigger secureStore.clearAll(). Only clear stored credentials when getUserInfo
definitively returns null for an invalid or unauthorized token; preserve the
existing already-authenticated and force-authentication behavior.

In `@src/lib/keyring.ts`:
- Around line 43-72: Update the catch handling in Keyring.read so ENOENT and
corrupted JSON continue returning an empty record, but unexpected filesystem
errors are rethrown after logging or otherwise propagated. Preserve set’s use of
read while preventing write from replacing an existing store when read fails for
an unrecognized FS error.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c339abc3-560b-4eb2-a1cb-ff14f19bc6ac

📥 Commits

Reviewing files that changed from the base of the PR and between d163c95 and b928869.

📒 Files selected for processing (5)

• README.md
• src/api/auth.ts
• src/lib/keyring.ts
• tests/integration/file-keyring.test.ts
• tests/integration/login-flow.test.ts