Skip to content

Adding error tracking and response for logins over CLI #96

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
davidpcls wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Adding error tracking and response for logins over CLI #96

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions src/bluesky_httpserver/authentication.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -878,6 +878,9 @@ async def _complete_device_code_authorization(
# Authenticate with the OIDC provider using the authorization code
user_session_state = await authenticator.authenticate(request)
if not user_session_state:
pending_session.error = "access_denied"
db.add(pending_session)
db.commit()
error_html = """
<!DOCTYPE html>
<html>
Expand Down Expand Up @@ -907,6 +910,9 @@ async def _complete_device_code_authorization(
username = user_session_state.user_name
session_state = user_session_state.state or {}
if not api_access_manager.is_user_known(username):
pending_session.error = "unauthorized_user"
db.add(pending_session)
db.commit()
error_html = f"""
<!DOCTYPE html>
<html>
Expand Down Expand Up @@ -1125,6 +1131,8 @@ async def device_code_token(
detail="No such device_code. The pending request may have expired.",
)
if pending_session.session_id is None:
if pending_session.error:
raise HTTPException(status_code=400, detail={"error": pending_session.error})
raise HTTPException(status_code=400, detail={"error": "authorization_pending"})

session = pending_session.session
Expand Down
34 changes: 34 additions & 0 deletions ...sky_httpserver/database/migrations/versions/b7c8d9e0f1a2_add_error_to_pending_sessions.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
"""Add error column to pending_sessions table.

Revision ID: b7c8d9e0f1a2
Revises: a1b2c3d4e5f6
Create Date: 2026-08-24 12:00:00.000000

Adds a nullable `error` column to pending_sessions so that browser-side
authentication failures can be signalled to the polling CLI client
immediately, rather than waiting for the pending session to expire.

Possible values:
NULL - still pending
"access_denied" - OIDC provider denied / user cancelled
"unauthorized_user" - user authenticated but not permitted on this server
"""

import sqlalchemy as sa
from alembic import op

# revision identifiers, used by Alembic.
revision = "b7c8d9e0f1a2"
down_revision = "a1b2c3d4e5f6"
branch_labels = None
depends_on = None


def upgrade():
with op.batch_alter_table("pending_sessions") as batch_op:
batch_op.add_column(sa.Column("error", sa.Unicode(64), nullable=True))


def downgrade():
with op.batch_alter_table("pending_sessions") as batch_op:
batch_op.drop_column("error")
2 changes: 2 additions & 0 deletions src/bluesky_httpserver/database/orm.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -204,3 +204,5 @@ class PendingSession(Timestamped, Base):
expiration_time = Column(DateTime(timezone=False), nullable=False)
session_id = Column(Integer, ForeignKey("sessions.id"), nullable=True)
session: Mapped[Session] = relationship(lazy="joined")
# None = still pending; "access_denied" = OIDC/consent failed; "unauthorized_user" = not permitted
error = Column(Unicode(64), nullable=True)
Loading
Loading