[client] add flag to force device code auth by andreasgerner · Pull Request #6885 · netbirdio/netbird

andreasgerner · 2026-07-24T13:10:45Z

Describe your changes

Add a flag to cli up & login commands to force client to use device code flow.

Checklist

Is it a bug fix
Is a typo/documentation fix
Is a feature enhancement
It is a refactor
Created tests that fail without the change (if possible)
This change does not modify the public API, gRPC protocols, functionality behavior, CLI / service flags, or introduce a new feature — OR I have discussed it with the NetBird team beforehand (link the issue / Slack thread in the description). See CONTRIBUTING.md.

By submitting this pull request, you confirm that you have read and agree to the terms of the Contributor License Agreement.

Documentation

Select exactly one:

I added/updated documentation for this change
Documentation is not needed for this change (explain why)

Docs PR URL (required if "docs added" is checked)

Paste the PR link from https://github.com/netbirdio/docs here:

netbirdio/docs#883

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

New Features
- Added support for device-based authentication during login.
- Introduced a --use-device-auth flag when starting the service.
- Login and SSO authentication flows now respect the selected authentication method, including cached flow handling.
Tests
- Added coverage for device-flow selection in different authentication scenarios.

CLAassistant · 2026-07-24T13:10:53Z

All committers have signed the CLA.

coderabbitai · 2026-07-24T13:11:04Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 74f34a12-e3bb-4011-b4cf-ab72a3ad86a2

📥 Commits

Reviewing files that changed from the base of the PR and between e3d6c3d and d1346bb.

⛔ Files ignored due to path filters (2)

client/proto/daemon.pb.go is excluded by !**/*.pb.go
client/proto/daemon_grpc.pb.go is excluded by !**/*.pb.go

📒 Files selected for processing (5)

client/cmd/login.go
client/cmd/up.go
client/internal/auth/oauth_test.go
client/proto/daemon.proto
client/server/server.go

🚧 Files skipped from review as they are similar to previous changes (5)

client/cmd/up.go
client/proto/daemon.proto
client/cmd/login.go
client/internal/auth/oauth_test.go
client/server/server.go

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

Walkthrough

Adds --use-device-auth support to the login and up commands. The setting travels through LoginRequest and controls OAuth flow creation and cached-flow reuse. Tests cover forced device-flow selection and desktop behavior.

Changes

Device authentication login

Layer / File(s)	Summary
Login request contract and CLI wiring `client/proto/daemon.proto`, `client/cmd/login.go`, `client/cmd/up.go`	Adds the optional `useDeviceAuth` request field. Wires explicit CLI flags into login request construction.
OAuth flow selection `client/server/server.go`, `client/cmd/login.go`	Passes the requested device-auth setting to OAuth flow creation. Reuses cached flows only when their authentication mode matches.
Device-flow selection tests `client/internal/auth/oauth_test.go`	Tests forced device flow and desktop behavior when forcing is disabled.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to d1346

This change adds an optional device-code authentication flag to the CLI, and no actionable merge-blocking risk remains beyond normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant LoginCommand
  participant LoginRequest
  participant ServerLogin
  participant OAuthFlow
  LoginCommand->>LoginRequest: Set UseDeviceAuth from CLI flag
  LoginRequest->>ServerLogin: Send login request
  ServerLogin->>OAuthFlow: Create or reuse matching auth mode
  OAuthFlow-->>ServerLogin: Select device or browser authentication

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the feature, identifies tests, and provides a documentation PR link. It does not include the required issue ticket or approved discussion link, and it omits the required Stack…	Add the required issue ticket or approved discussion link. Add the Stack section from the repository template. Confirm the checklist wording and selections match the current template.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 4 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: adding a client flag that forces device code authentication.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the feature, identifies tests, and provides a documentation PR link. It does not include the required issue ticket or approved discussion link, and it omits the required Stack section.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 4 files. (1 skipped: 1 unsupported.)

Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Warning

Some tools did not complete. Review the errors below.

🔧 Buf (1.72.0)

client/proto/daemon.proto

fatal: unable to access 'https://github.com/netbirdio/netbird.git/': Failed to connect to github.com port 443 via 127.0.0.1 after 0 ms: Could not connect to server
fatal: could not fetch 3953f9c15ef4200c5ccdf63f6f6bf14d6b7ea3f6 from promisor remote

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

andreasgerner · 2026-07-24T13:12:16Z

Got no feedback on #6475 after an entire month even tho I even asked some of my colleagues (that also depend on this feature) to upvote it.
Will open this PR to finally get attention to it.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@client/server/server.go`:
- Line 587: Update the OAuth flow reuse logic near auth.NewOAuthFlow to include
msg.GetUseDeviceAuth() in the cached-flow identity, so browser and device-auth
flows with the same client ID are not reused interchangeably. Preserve reuse
only when both the client ID and authentication mode match, or invalidate the
cached flow when the mode changes.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 19532a32-4194-44f8-be8c-a15d9fdbd837

📥 Commits

Reviewing files that changed from the base of the PR and between b65ec8b and 64804ae.

⛔ Files ignored due to path filters (2)

client/proto/daemon.pb.go is excluded by !**/*.pb.go
client/proto/daemon_grpc.pb.go is excluded by !**/*.pb.go

📒 Files selected for processing (5)

client/cmd/login.go
client/cmd/up.go
client/internal/auth/oauth_test.go
client/proto/daemon.proto
client/server/server.go

sonarqubecloud · 2026-07-28T10:18:23Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

coderabbitai

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

client/server/server.go (1)
626-643: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Cancel the previous pending flow before replacing it.

When the requested auth mode differs from the cached flow, the reuse condition is false and execution proceeds to create a new flow, but s.oauthAuthFlow.waitCancel is not invoked. The old waiter can continue running while s.oauthAuthFlow has already been overwritten with the new flow. Cancel any active previous flow whenever replacing it, including on auth-mode changes.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@client/server/server.go` around lines 626 - 643, Ensure any active previous
OAuth flow is canceled before creating or assigning a replacement, including
when the requested auth mode differs. Update the flow replacement logic around
s.oauthAuthFlow.waitCancel so cancellation occurs whenever the existing flow
will not be reused, while preserving the current reuse behavior.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@client/server/server.go`:
- Around line 626-643: Ensure any active previous OAuth flow is canceled before
creating or assigning a replacement, including when the requested auth mode
differs. Update the flow replacement logic around s.oauthAuthFlow.waitCancel so
cancellation occurs whenever the existing flow will not be reused, while
preserving the current reuse behavior.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 7c2b7b72-072e-4385-bc55-840a31e28e23

📥 Commits

Reviewing files that changed from the base of the PR and between 4ae04a8 and 6ee1dbb.

📒 Files selected for processing (1)

client/server/server.go

…th-merge-main # Conflicts: # client/cmd/login.go # client/proto/daemon.pb.go # client/proto/daemon.proto # client/server/server.go

coderabbitai · 2026-09-01T20:33:13Z

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

sonarqubecloud · 2026-09-01T20:33:37Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[client] add flag to force device code auth

64804ae

Merge branch 'main' into feat/device-code-auth

4ae04a8

coderabbitai Bot reviewed Jul 24, 2026

View reviewed changes

Comment thread client/server/server.go Outdated

[client] reuse cached OAuth flow only when auth mode matches flag

6ee1dbb

coderabbitai Bot reviewed Jul 28, 2026

View reviewed changes

This was referenced Aug 12, 2026

[client] Fix session extension and SSH auth always using the device code flow on Linux #7187

Merged

[client] Fall back to an available OAuth flow instead of hard-coding device code #7188

Open

Merge remote-tracking branch 'upstream/main' into feat/device-code-au…

d1346bb

…th-merge-main # Conflicts: # client/cmd/login.go # client/proto/daemon.pb.go # client/proto/daemon.proto # client/server/server.go

Navigation Menu

Uh oh!

Uh oh!

[client] add flag to force device code auth - #6885

[client] add flag to force device code auth#6885
andreasgerner wants to merge 4 commits into
netbirdio:mainfrom
andreasgerner:feat/device-code-auth

andreasgerner commented Jul 24, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

CLAassistant commented Jul 24, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 24, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (2 warnings)

Uh oh!

andreasgerner commented Jul 24, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

sonarqubecloud Bot commented Jul 28, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot commented Sep 1, 2026

Uh oh!

sonarqubecloud Bot commented Sep 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

andreasgerner commented Jul 24, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Describe your changes

Checklist

Documentation

Docs PR URL (required if "docs added" is checked)

Summary by CodeRabbit

Uh oh!

CLAassistant commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (2 warnings)

Uh oh!

andreasgerner commented Jul 24, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sonarqubecloud Bot commented Jul 28, 2026

Quality Gate passed

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Sep 1, 2026

Uh oh!

sonarqubecloud Bot commented Sep 1, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

andreasgerner commented Jul 24, 2026 •

edited by coderabbitai Bot

Loading

CLAassistant commented Jul 24, 2026 •

edited

Loading

coderabbitai Bot commented Jul 24, 2026 •

edited

Loading