Added support for OAuth2 and improved error handling by stevenbarash · Pull Request #37 · descope-sample-apps/cli-authentication

stevenbarash · 2025-09-17T21:33:22Z

Added

OAuth2 (PKCE) login via browser with local HTTP callback.
- New command: login-oauth (opens browser, handles local callback, exchanges code → tokens).
- Options:
  - -p, --projectId <projectId> (required)
  - -b, --baseUrl <url> (default https://api.descope.com)
  - -c, --callbackPort <port> (default 8088)
  - -o, --output <session|refresh|json> (default session)
New CLI commands (not present on upstream main):
- validate — validate session token; prints { ok, sub, exp }.
- validate-and-refresh — validate session; if invalid, refresh with provided refresh token.
Test suite (Vitest) covering OAuth flow and CLI commands.
Linting and formatting stack (ESLint + @typescript-eslint + Prettier) with scripts to run them.

Changed

Existing commands retained and enhanced:
- login (existed): streamlined to signUpOrIn.email then verify.email; clearer prompts and errors.
- me (existed upstream or feature-equivalent): standardized to print JSON to stdout and exit with non‑zero on failure.
- refresh (existed upstream or feature-equivalent): standardized to print the new session JWT to stdout and exit with non‑zero on failure.
CLI program refactored for modularity (buildProgram, run) and clearer stdout-focused outputs.
README expanded with full command docs (OTP and OAuth), token handling, and examples.
Scripts/tooling modernized:
- test: build then run tests; test:watch.
- lint: run ESLint (with Prettier integration).
- start.sh: builds before running the CLI.
TypeScript config updated to explicitly include src/**/*.

Removed

Legacy helper module replaced by the new modular CLI structure (unifying OTP and OAuth flows).

Security and hardening

OAuth flow uses PKCE S256 and state validation to mitigate CSRF/code interception.
Scopes limited to openid profile email.
Local callback server ensures best-effort cleanup of connections.
No token cache on disk; tokens are emitted to stdout only when a command requests them.

Dependency updates

Runtime:
- @descope/node-sdk → 1.7.15
- commander → 14.0.1
- node-fetch → 3.3.2
- rimraf → 6.0.1
- @types/node → 24.5.1
Tooling:
- typescript → 5.9.2
- eslint → 9.35.0, @typescript-eslint/* → 8.44.0
- prettier → 3.6.2, eslint-plugin-prettier → 5.5.4
- vitest → 1.6.0

Usage (npm)

Install: npm install
Build: npm run build
OTP login: node build/index.js login -p <PROJECT_ID> -e <EMAIL>
OAuth login (session): node build/index.js login-oauth -p <PROJECT_ID> -o session
OAuth login (refresh): node build/index.js login-oauth -p <PROJECT_ID> -o refresh
OAuth login (json): node build/index.js login-oauth -p <PROJECT_ID> -o json
Me: node build/index.js me -p <PROJECT_ID> -r <REFRESH_TOKEN>
Validate: node build/index.js validate -p <PROJECT_ID> -s <SESSION_JWT>
Refresh: node build/index.js refresh -p <PROJECT_ID> -r <REFRESH_TOKEN>
Validate and refresh: node build/index.js validate-and-refresh -p <PROJECT_ID> -s <SESSION_JWT> -r <REFRESH_TOKEN>

Notes

Upstream main focused on OTP-based CLI and included refresh/me functionality conceptually; this branch adds OAuth PKCE and introduces validate/validate-and-refresh, while standardizing outputs and error handling for existing commands.

CLI Authentication sample app

small fixes

use enchanted link

* Add renovate.json * Update renovate.json --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Omer Cohen <omer@descope.com>

* fixes * readme

* break into different command parameters * set specific versions

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

…ed clarity on authentication methods, including OTP and OAuth2. Refactor auth logic to remove JWT caching and streamline output options for session and refresh tokens. Improve error handling and user feedback in CLI commands.

…d the CLI structure by consolidating command definitions into a single `buildProgram` function. Added `test:watch` script for improved testing workflow and included new dependencies for coverage support.

…s dependencies in package.json to their latest versions for improved performance and security. Removed obsolete coverage files and scripts to streamline the project structure.

…tion for OAuth2 login command in README. Improved code documentation in `auth.ts` and `index.ts`, including detailed descriptions for functions and parameters. Streamlined the OAuth2 PKCE flow and ensured proper error handling and resource cleanup during authentication.

src/auth.ts

Copilot

Pull Request Overview

This PR adds OAuth2 authentication with PKCE support and improves error handling for a CLI authentication tool. The changes modernize the codebase with TypeScript, testing infrastructure, and standardized command outputs.

OAuth2 PKCE login via browser with local HTTP callback server
New CLI commands for token validation, refresh, and user info retrieval
Comprehensive test suite and linting/formatting stack

Reviewed Changes

Copilot reviewed 10 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/index.ts	Complete rewrite of CLI program with modular structure and new OAuth2/validation commands
src/auth.ts	New OAuth2 PKCE implementation with browser integration and local callback server
src/descopeCli.ts	Legacy helper module removed
test/cli.test.ts	New test suite covering CLI commands with mocked dependencies
test/auth.test.ts	New test suite for OAuth2 flow with HTTP server mocking
package.json	Updated dependencies and added test/lint scripts
README.md	Comprehensive documentation with command examples and usage instructions
.eslintrc.json	ESLint configuration for TypeScript
renovate.json	Renovate configuration for dependency updates
start.sh	Build step added before running CLI

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-09-17T21:37:16Z

src/index.ts

+			if (!res.ok) {
+				console.log(`Error ${res.error?.errorCode}: ${res.error?.errorDescription}`);


This error check uses the wrong response object. It should check jwt instead of res since jwt is the response from the verify operation, not res which is from the signUpOrIn operation.

Suggested change

if (!res.ok) {

console.log(`Error ${res.error?.errorCode}: ${res.error?.errorDescription}`);

if (!jwt.ok) {

console.log(`Error ${jwt.error?.errorCode}: ${jwt.error?.errorDescription}`);

Copilot · 2025-09-17T21:37:17Z

test/cli.test.ts

+import * as os from "os";
+import * as path from "path";
+
+const LIVE = false; // remove live-mode test functionality


This unused constant should be removed since it's not referenced anywhere in the code and the comment suggests it's meant to be removed.

Suggested change

const LIVE = false; // remove live-mode test functionality

gaokevin1

Overall looks good, just a few minor comments.

README.md

gaokevin1 · 2025-09-25T06:44:59Z

src/auth.ts

+	exec(`xdg-open "${url}"`);
+};
+
+export const descopeOAuthLogin = async (


Wondering why we don't use a library here, instead of doing all of this manually?

Is there a particular reason we wouldn't use a common OIDC client (based on Node), other than that we should have one ourselves so it's better to show it this way?

Good idea - agreed that a standard library would be better

README.md

Co-authored-by: Kevin J Gao <32936811+gaokevin1@users.noreply.github.com>

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

rishibhargava and others added 20 commits December 2, 2022 20:59

Merge pull request #1 from descope-sample-apps/init

9840423

CLI Authentication sample app

small fixes

4905b74

fixes

c998729

fixes

e46f388

Merge pull request #2 from descope-sample-apps/small-fixes

448b81b

small fixes

use enchanted link

6b516a5

Merge pull request #3 from descope-sample-apps/enchanted-link

c4b89a9

use enchanted link

Configure Renovate (#4)

5452541

* Add renovate.json * Update renovate.json --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Omer Cohen <omer@descope.com>

Code fixes (#7)

c77f6f7

* fixes * readme

break into different command parameters (#9)

5061291

* break into different command parameters * set specific versions

Update devDependencies to v7 (#10)

1dfd477

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(git): ignore oauth-implemented-version and untrack from repo

045743d

feat(auth): add OAuth2 login command to CLI

be442ce

added oauth 2 support

3231224

add oauth

934990e

Refactor CLI authentication commands and update test scripts: Enhance…

e6292da

…d the CLI structure by consolidating command definitions into a single `buildProgram` function. Added `test:watch` script for improved testing workflow and included new dependencies for coverage support.

Update package dependencies and remove coverage files: Updated variou…

68d5efa

…s dependencies in package.json to their latest versions for improved performance and security. Removed obsolete coverage files and scripts to streamline the project structure.

revert to last compatible chalk version

e2e646c

github-advanced-security bot found potential problems Sep 17, 2025

View reviewed changes

src/auth.ts Fixed Show fixed Hide fixed

stevenbarash self-assigned this Sep 17, 2025

stevenbarash requested review from anvibanga, Copilot, gaokevin1 and mrunankpawar September 17, 2025 21:36

Copilot AI reviewed Sep 17, 2025

View reviewed changes

gaokevin1 reviewed Sep 25, 2025

View reviewed changes

stevenbarash and others added 2 commits September 25, 2025 12:03

Update README.md

c3a54bd

Co-authored-by: Kevin J Gao <32936811+gaokevin1@users.noreply.github.com>

Update README.md

a1deea9

Co-authored-by: Kevin J Gao <32936811+gaokevin1@users.noreply.github.com>

Potential fix for code scanning alert no. 5: Log injection

c513820

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added support for OAuth2 and improved error handling#37

Added support for OAuth2 and improved error handling#37
stevenbarash wants to merge 23 commits intomainfrom
feat/oauth-implemented-version-setup-20250917-134909

stevenbarash commented Sep 17, 2025

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Sep 17, 2025

Uh oh!

Copilot AI Sep 17, 2025

Uh oh!

gaokevin1 left a comment

Uh oh!

Uh oh!

gaokevin1 Sep 25, 2025

Uh oh!

stevenbarash Sep 25, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		if (!res.ok) {
		console.log(`Error ${res.error?.errorCode}: ${res.error?.errorDescription}`);

Conversation

stevenbarash commented Sep 17, 2025

Added

Changed

Removed

Security and hardening

Dependency updates

Usage (npm)

Notes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

gaokevin1 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gaokevin1 Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

stevenbarash Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants