Repository navigation
feat(cli): make device flow the default for login - #99
Merged
Merged
Conversation
The loopback redirect to 127.0.0.1 breaks whenever the browser and CLI don't share a network path (VPNs, SSH, containers). The device flow has no redirect, so it is now the default. `--no-device` keeps the local browser flow, and IdPs without the device grant fall back to it. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
mrchtr
changed the title
Contributor
Coverage report
Click to see where and how coverage changed
This report was generated by python-coverage-comment-action |
||||||||||||||||||||||||||||||||||||
volkanarisli
approved these changes
Oct 23, 2026
…ault # Conflicts: # tests/unit/test_cli.py
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
haystack-enterprise loginredirected tohttp://127.0.0.1:<port>/callback. That breaks when the browser and the CLI aren't on the same network path (VPNs, SSH, remote dev boxes, containers).What
loginnow uses the OAuth device flow by default: it prints a link and a code you confirm in a browser on any device. Nothing has to reach back to the user's machine.--no-devicebrings back the old browser flow on the same machine.--no-browserand--api-keyare unchanged.Before release
On prod the device code expires after 60 seconds. Raise the device code validity for the
haystack-enterprise-cliprovider in Authentik (EU and US) to about 10 minutes.Testing
make tests-unit(771 passed),make typescleanhaystack-enterprise login, approve on another device, thenhaystack-enterprise whoami🤖 Generated with Claude Code
https://claude.ai/code/session_01P3nCYHqG2BQyGPLbAfzLqA