holivia 0.12.0 → 0.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 14dc959e163c982b0cb9ff68d098eb453c99c9802055de1c6086c8b61541894b
-  data.tar.gz: cb404446122ffd0f4dab4535b358ec50c6bcdda67781c569f9c6db699ca8ed3e
+  metadata.gz: 5727339aa56fea9ffe71d4f5e0c49fdcd91a2d120aa3f88f7ff33f6a7b6eb49a
+  data.tar.gz: 6860e618178ca2b72dd346ec6f02b900cb1aaf48299db21bd6b2e98b6944ad9e
 SHA512:
-  metadata.gz: fd225340d2dd039e3a40f1104b0a606db28e3b5d30b3f7bd5a19a3ddc6d4e222a1519db2db64a3429fa8040ddc2131b38b5dafca3ce61701241c939e562475ae
-  data.tar.gz: c55acec78801a2a38ffa864d95997ae1e0245baa82fa57f53a508592d53a25b77e6c4809cc9d07ff44e9d2eb444a85d22a57d283ade5d32e3ae6d37ae8ec23c8
+  metadata.gz: 573b090f0d92ee3676f920992e1c60f71b17b423627a000a4f4d118a1f394657670ce40c19d378f29bf4f56b2f54b682716d66ee70b80db1c7ccf1b088742d37
+  data.tar.gz: 26a6014d2c1351a3c2887c406ea572e7c5b73874077533c96c667ef8f11329e3a749954ae2ba141356066d51eff1ec970e758faa236d96687218db48f794d7da

data/CHANGELOG.md

@@ -1,5 +1,15 @@
 ## [Unreleased]
 
+## [0.13.0] - 2026-09-30
+
+- Replace terminal password login with browser OAuth authorization using PKCE and existing password/company SSO sign-in.
+- Require CLI upgrade and a new login; remove `--email`/`--password` and legacy `/api/v1/auth/*` endpoints.
+- Use two-hour access tokens, rotating refresh tokens without a fixed expiry, and server revocation for logout.
+- Store per-environment credentials atomically with owner-only permissions and omit credentials from debug logs.
+- Keep browser and CLI sessions independent; existing API permissions continue to apply.
+- Redirect browser authorization callbacks to the localized Holivia completion page while the CLI exchanges tokens separately.
+- Requires the matching Holivia OAuth server deployment and provisioning of the public CLI application.
+
 ## [0.12.0] - 2026-09-16
 
 - Add `holivia tag` commands for catalogue CRUD and incremental topic-link management through repeatable `--topic-tag-json` flags or stdin JSON

data/README.md

@@ -73,21 +73,23 @@ holivia env debug --false
 
 ## Authentication
 
-Log in interactively:
+Log in through your browser using your existing password or company SSO:
 
 ```bash
 holivia login
 ```
 
-Or pass credentials directly:
-
-```bash
-holivia login --email user@example.com --password secret
-```
+The CLI opens a browser and prints a URL you can open manually on the same computer. A temporary loopback listener receives the callback. Browserless login is not supported.
 
 Credentials are stored per environment in `~/.holivia/credentials.<env>.json`. Access tokens are sent as bearer tokens, and the CLI automatically refreshes credentials after a `401` response when a refresh token is available.
 
-Log out and remove stored credentials for the current environment:
+Access tokens expire after two hours. Refresh tokens have no fixed expiry and rotate when used. Credential files are replaced atomically with owner-only permissions. Pundit permissions still determine which API operations the user may perform.
+
+Existing users must upgrade the CLI and run `holivia login` again. The old `/api/v1/auth/login`, `/api/v1/auth/refresh`, and `/api/v1/auth/logout` endpoints and `--email`/`--password` flags have been removed.
+
+The database migration drops the legacy `auth_tokens` table. Rolling it back restores the table structure only; deleted or revoked credentials are not restored. Users must log in again.
+
+Logout revokes this CLI session and removes credentials for the current environment. Other CLI sessions and browser sessions remain signed in. If the server cannot be reached, credentials are retained so logout can be retried:
 
 ```bash
 holivia logout

data/SKILL.md

@@ -16,7 +16,7 @@ Use `holivia` in examples below. If working from a checkout before installation,
 
 - Never invent API URLs, credentials, IDs, enum values, or content model fields.
 - Never print, store, or commit passwords, access tokens, refresh tokens, or files under `~/.holivia/credentials.*.json`.
-- Prefer interactive `holivia login` when a human can enter credentials. Use `--password` only when the user explicitly provides it for automation.
+- Use `holivia login` and let the user authenticate in their browser. Terminal email/password flags are no longer supported.
 - Before creating or updating content, run `holivia selfcare schema` and use its returned enum values and permitted item params as the source of truth.
 - Before creating or updating intervention catalog items, run `holivia intervention schema` and use its returned enum values and locales as the source of truth.
 - Before creating or updating HR home highlights, run `holivia highlight schema` and use its returned enum values and locales as the source of truth.
@@ -90,19 +90,19 @@ Debug logging may expose request details. Do not enable it in shared logs unless
 
 Credentials are stored per environment at `~/.holivia/credentials.<env>.json`. The CLI sends the access token as a bearer token and refreshes credentials automatically after a `401` response when possible.
 
-Interactive login:
+Browser login using your existing password or company SSO:
 
 ```bash
 holivia login
 ```
 
-Non-interactive login:
+A browser on the same computer is required. If it does not open automatically, open the printed URL manually. Do not ask for terminal credentials; browserless login is not supported.
 
-```bash
-holivia login --email user@example.com --password secret
-```
+Access tokens expire after two hours. Refresh tokens have no fixed expiry and rotate when used. Credential files are replaced atomically with owner-only permissions. Pundit permissions still determine which API operations the user may perform.
+
+Existing users must upgrade the CLI and run `holivia login` again. The old `/api/v1/auth/login`, `/api/v1/auth/refresh`, and `/api/v1/auth/logout` endpoints and `--email`/`--password` flags have been removed.
 
-Logout for the current environment:
+Logout revokes this CLI session and removes credentials for the current environment. Other CLI sessions and browser sessions remain signed in. If the server cannot be reached, credentials are retained so logout can be retried:
 
 ```bash
 holivia logout

data/exe/holivia

@@ -9,7 +9,10 @@ rescue Holivia::ApiError => e
   warn "Error (#{e.status}): #{e.message}"
   warn JSON.pretty_generate(e.details) if e.details.is_a?(Hash)
   exit 1
-rescue Holivia::ConfigError => e
+rescue Holivia::ConfigError, Holivia::BrowserLogin::Error, OptionParser::ParseError, Faraday::Error => e
   warn "Error: #{e.message}"
   exit 1
+rescue Interrupt
+  warn "Cancelled."
+  exit 130
 end

data/lib/holivia/auth.rb

@@ -2,15 +2,20 @@
 
 require "json"
 require "fileutils"
+require "tempfile"
 
 module Holivia
   class Auth
-    def initialize(client: Client.new(auth: nil))
-      @client = client
+    def initialize(client: nil, configuration: Holivia.configuration)
+      @client = client || Client.new(base_url: configuration.base_url, auth: nil)
+      @credentials_path = configuration.credentials_path.dup.freeze
     end
 
-    def login(email:, password:)
-      response = client.post("/api/v1/auth/login", body: { email: email, password: password })
+    def login(code:, code_verifier:, redirect_uri:)
+      response = client.post_form("/oauth/token", body: {
+                                    grant_type: "authorization_code", client_id: BrowserLogin::CLIENT_ID,
+                                    code: code, code_verifier: code_verifier, redirect_uri: redirect_uri
+                                  })
       store_tokens(response)
       response
     end
@@ -18,15 +23,25 @@ module Holivia
     def refresh
       raise ApiError.new("No refresh token. Run `holivia login`.", status: 401) unless refresh_token
 
-      response = client.post("/api/v1/auth/refresh", headers: { "Authorization" => "Bearer #{refresh_token}" })
+      response = client.post_form("/oauth/token", body: {
+                                    grant_type: "refresh_token", client_id: BrowserLogin::CLIENT_ID,
+                                    refresh_token: refresh_token
+                                  })
       store_tokens(response)
       response
+    rescue ApiError => e
+      raise unless e.details.is_a?(Hash) && e.details["error"] == "invalid_grant"
+
+      raise ApiError.new("Session expired or revoked. Run `holivia login`.", status: 401)
     end
 
     def logout
-      raise ApiError.new("Already logged out.", status: 401) unless access_token
+      raise ApiError.new("Already logged out.", status: 401) unless refresh_token
 
-      response = client.delete("/api/v1/auth/logout", headers: { "Authorization" => "Bearer #{access_token}" })
+      response = client.post_form("/oauth/revoke", body: {
+                                    client_id: BrowserLogin::CLIENT_ID, token: refresh_token,
+                                    token_type_hint: "refresh_token"
+                                  })
       FileUtils.rm_f(credentials_path)
       response
     end
@@ -41,7 +56,7 @@ module Holivia
 
     private
 
-    attr_reader :client
+    attr_reader :client, :credentials_path
 
     def credentials
       return nil unless File.exist?(credentials_path)
@@ -50,17 +65,14 @@ module Holivia
     end
 
     def store_tokens(data)
-      FileUtils.mkdir_p(File.dirname(credentials_path))
-
-      File.write(credentials_path, JSON.pretty_generate(
-                                     "access_token" => data["access_token"],
-                                     "refresh_token" => data["refresh_token"]
-                                   ))
-      File.chmod(0o600, credentials_path)
-    end
-
-    def credentials_path
-      Holivia.configuration.credentials_path
+      directory = File.dirname(credentials_path)
+      FileUtils.mkdir_p(directory, mode: 0o700)
+      Tempfile.create(["credentials", ".json"], directory) do |file|
+        file.write(JSON.pretty_generate(data.slice("access_token", "refresh_token")))
+        file.flush
+        file.fsync
+        File.rename(file.path, credentials_path)
+      end
     end
   end
 end

data/lib/holivia/browser_login.rb

@@ -0,0 +1,125 @@
+# frozen_string_literal: true
+
+require "digest"
+require "securerandom"
+require "socket"
+require "timeout"
+require "uri"
+
+module Holivia
+  class BrowserLogin
+    class Error < StandardError; end
+
+    CLIENT_ID = "holivia-cli"
+
+    def initialize(base_url: Holivia.configuration.base_url, output: $stderr, timeout: 180, browser_launcher: nil)
+      @base_url = base_url.dup.freeze
+      @output = output
+      @timeout = timeout
+      @browser_launcher = browser_launcher || method(:launch_browser)
+    end
+
+    def call
+      verifier = SecureRandom.urlsafe_base64(32)
+      state = SecureRandom.urlsafe_base64(32)
+      server = TCPServer.new("127.0.0.1", 0)
+      redirect_uri = "http://127.0.0.1:#{server.addr[1]}/callback"
+
+      Timeout.timeout(@timeout, Error, "Browser login timed out. Run holivia login to try again.") do
+        open_browser(authorization_url(verifier, state, redirect_uri))
+        code = receive_code(server, state)
+        { code: code, code_verifier: verifier, redirect_uri: redirect_uri }
+      end
+    ensure
+      server&.close
+    end
+
+    private
+
+    def authorization_url(verifier, state, redirect_uri)
+      url = URI.join(@base_url, "/oauth/authorize")
+      url.query = URI.encode_www_form(
+        client_id: CLIENT_ID, response_type: "code", redirect_uri: redirect_uri,
+        code_challenge: [Digest::SHA256.digest(verifier)].pack("m0").tr("+/", "-_").delete("="),
+        code_challenge_method: "S256", state: state
+      )
+      url.to_s
+    end
+
+    def open_browser(url)
+      @output.puts "Open this URL in a browser on this computer to log in:\n#{url}"
+      @browser_launcher.call(url)
+    end
+
+    def launch_browser(url)
+      command = RUBY_PLATFORM.include?("darwin") ? "open" : "xdg-open"
+      system(command, url, out: File::NULL, err: File::NULL)
+    end
+
+    def receive_code(server, state)
+      loop do
+        code = handle_callback(server.accept, state)
+        return code if code
+      end
+    end
+
+    def handle_callback(socket, state)
+      params = callback_params(socket.gets("\r\n\r\n", 8192))
+      unless valid_callback?(params, state)
+        respond(socket, "400 Bad Request", "Invalid login callback.")
+        return nil
+      end
+
+      complete_callback(socket, params)
+    rescue SystemCallError, IOError
+      nil # A disconnected browser must not prevent a later valid callback.
+    ensure
+      socket.close
+    end
+
+    def callback_params(request)
+      return {} unless request&.end_with?("\r\n\r\n")
+
+      match = request.lines.first.match(%r{\AGET /callback\?([^\s]+) HTTP/1\.[01]\r\n\z})
+      return {} unless match
+
+      pairs = URI.decode_www_form(match[1])
+      return {} unless pairs.map(&:first).uniq.length == pairs.length
+
+      pairs.to_h
+    rescue ArgumentError
+      {}
+    end
+
+    def valid_callback?(params, state)
+      return false unless params["state"] == state
+
+      code = params["code"]
+      error = params["error"]
+      (code && !code.empty? && error.nil?) || (error && !error.empty? && code.nil?)
+    end
+
+    def complete_callback(socket, params)
+      if params["error"]
+        respond(socket, "200 OK", "Authorization was not granted. Return to the terminal.")
+        raise Error, "Authorization was not granted. Run holivia login to try again."
+      end
+
+      redirect_to_completion(socket)
+      params.fetch("code")
+    end
+
+    def redirect_to_completion(socket)
+      url = URI.join(@base_url, "/oauth/complete")
+      socket.write "HTTP/1.1 303 See Other\r\nLocation: #{url}\r\n" \
+                   "Referrer-Policy: no-referrer\r\nCache-Control: no-store\r\n" \
+                   "Content-Length: 0\r\nConnection: close\r\n\r\n"
+    end
+
+    def respond(socket, status, message)
+      socket.write "HTTP/1.1 #{status}\r\nContent-Type: text/plain; charset=utf-8\r\n" \
+                   "Content-Length: #{message.bytesize}\r\nCache-Control: no-store\r\n" \
+                   "Connection: close\r\n\r\n#{message}"
+    end
+  end
+end

data/lib/holivia/cli/help.rb

@@ -17,7 +17,7 @@ module Holivia
           Config stored at ~/.holivia/config.yml. Defaults to staging if no config exists.
 
         Authentication:
-          holivia login [--email EMAIL --password PASSWORD]  Log in (flags or interactive prompt)
+          holivia login                                    Log in through your browser (password or company SSO)
           holivia logout                         Log out and clear stored credentials
           Tokens are stored at ~/.holivia/credentials.<env>.json and refreshed automatically on 401.
 

data/lib/holivia/client.rb

@@ -2,6 +2,7 @@
 
 require "faraday"
 require "faraday/multipart"
+require "uri"
 
 module Holivia
   class Client
@@ -15,6 +16,16 @@ module Holivia
       request(:post, path, body:, headers:)
     end
 
+    def post_form(path, body: {})
+      response = connection.post(path) do |req|
+        req.headers["Accept"] = "application/json"
+        req.headers["Content-Type"] = "application/x-www-form-urlencoded"
+        req.body = URI.encode_www_form(body)
+      end
+
+      handle_response(response)
+    end
+
     def get(path, params: {}, headers: {})
       request(:get, path, params:, headers:)
     end
@@ -59,7 +70,7 @@ module Holivia
       @connection ||= http.new(url: base_url) do |f|
         f.request :multipart
         f.request :json
-        f.response :logger if Holivia.configuration.debug?
+        f.response :logger, nil, headers: false, bodies: false if Holivia.configuration.debug?
         f.response :json
         f.adapter Faraday.default_adapter
       end
@@ -77,6 +88,8 @@ module Holivia
       return "Request failed" unless body.is_a?(Hash)
 
       error = body["error"]
+      return [error, body["error_description"]].compact.join(": ") if error.is_a?(String)
+
       error.is_a?(Hash) ? (error["message"] || "Request failed") : (error || "Request failed")
     end
 

data/lib/holivia/commands/auth.rb

@@ -1,23 +1,19 @@
 # frozen_string_literal: true
 
-require "io/console"
 require "optparse"
 
 module Holivia
   module Commands
     class Auth
       def login(args = [])
-        options = {}
         OptionParser.new do |opts|
-          opts.banner = "Usage: holivia login [--email EMAIL --password PASSWORD]"
-          opts.on("--email EMAIL") { |v| options[:email] = v }
-          opts.on("--password PASSWORD") { |v| options[:password] = v }
+          opts.banner = "Usage: holivia login"
         end.parse!(args)
+        raise OptionParser::InvalidArgument, args.join(" ") unless args.empty?
 
-        email = options[:email] || prompt("Email: ")
-        password = options[:password] || prompt_secret("Password: ")
-
-        Holivia::Auth.new.login(email: email, password: password)
+        auth = Holivia::Auth.new
+        exchange = BrowserLogin.new.call
+        auth.login(**exchange)
         puts "Logged in successfully."
       end
 
@@ -25,20 +21,6 @@ module Holivia
         Holivia::Auth.new.logout
         puts "Logged out successfully."
       end
-
-      private
-
-      def prompt(label)
-        print label
-        $stdin.gets.chomp
-      end
-
-      def prompt_secret(label)
-        print label
-        result = $stdin.noecho(&:gets).chomp
-        puts
-        result
-      end
     end
   end
 end

data/lib/holivia/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Holivia
-  VERSION = "0.12.0"
+  VERSION = "0.13.0"
 end

data/lib/holivia.rb

@@ -7,6 +7,7 @@ require_relative "holivia/api_error"
 require_relative "holivia/config_error"
 require_relative "holivia/client"
 require_relative "holivia/auth"
+require_relative "holivia/browser_login"
 
 module Holivia
   class << self

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: holivia
 version: !ruby/object:Gem::Version
-  version: 0.12.0
+  version: 0.13.0
 platform: ruby
 authors:
 - Holivia
@@ -57,6 +57,7 @@ files:
 - lib/holivia.rb
 - lib/holivia/api_error.rb
 - lib/holivia/auth.rb
+- lib/holivia/browser_login.rb
 - lib/holivia/cli.rb
 - lib/holivia/cli/help.rb
 - lib/holivia/client.rb