@toloka-platform/sdk 0.2.0 → 0.3.0

package/src/cli/auth.ts

@@ -1,6 +1,29 @@
 import { createClient } from "../client";
+import type { ClientConfig } from "../client";
 import { PotatoApiError } from "../errors";
-import { PRODUCTION_BASE_URL, consoleUrlFor, resolveInternalBaseUrl } from "./config";
+import { loginWithBrowser } from "./browser-login";
+import type { BrowserLoginFlow } from "./browser-login";
+import {
+  BrowserLoginExpiredError,
+  browserSessionFromTokens,
+  createBrowserSessionAuth,
+  findBrowserLogin,
+  isRefreshTokenExpired,
+  readBrowserSession,
+  removeBrowserSession,
+  unixSeconds,
+  writeBrowserSession,
+} from "./browser-session";
+import type { BrowserLogin, BrowserSession } from "./browser-session";
+import { PLAIN_STYLE } from "./style";
+import type { Style } from "./style";
+import {
+  PRODUCTION_BASE_URL,
+  consoleUrlFor,
+  registrationUrlFor,
+  resolveBaseUrl,
+  resolveInternalBaseUrl,
+} from "./config";
 import {
   clearStoredCredentials,
   credentialsPath,
@@ -8,6 +31,7 @@ import {
   inspectCredentialsFile,
   maskApiKey,
   normalizeBaseUrl,
+  storedCredentialsPaths,
   writeStoredCredentials,
 } from "./credentials";
 import type {
@@ -16,6 +40,12 @@ import type {
   FoundCredentials,
   StoredCredentials,
 } from "./credentials";
+import {
+  browserLoginProviderFor,
+  endKeycloakSession,
+  KNOWN_BROWSER_LOGIN_PROVIDERS,
+} from "./keycloak";
+import type { BrowserLoginProvider } from "./keycloak";
 import type { ProjectContext } from "./project-context";
 import { formatProjectContextLine } from "./project-context";
 import { assertCli, TolokaCliError } from "./cli-error";
@@ -26,6 +56,7 @@ type ProbeFailure = { readonly kind: ProbeFailureKind; readonly reason: string }
 
 const classifyProbeFailure = (error: unknown): ProbeFailure => {
   const reason = error instanceof Error ? error.message : String(error);
+  if (error instanceof BrowserLoginExpiredError) return { kind: "rejected", reason };
   if (!(error instanceof PotatoApiError) || error.status === undefined)
     return { kind: "unreachable", reason };
   return {
@@ -40,18 +71,26 @@ const PROBE_FAILURE_HEADLINE: Record<ProbeFailureKind, string> = {
   platform: "Platform error",
 };
 
-const LOGIN_FAILURE_ADVICE: Record<ProbeFailureKind, (baseUrl: string) => string> = {
+const API_KEY_LOGIN_FAILURE_ADVICE: Record<ProbeFailureKind, (baseUrl: string) => string> = {
   rejected: () => "Check that the key was copied whole and has not been revoked.",
   unreachable: (baseUrl) =>
     `${baseUrl} did not answer, so the key was not evaluated. Check network access, VPN, or proxy settings and retry.`,
   platform: () => "The platform failed before confirming the key. Retry later.",
 };
 
+const BROWSER_LOGIN_FAILURE_ADVICE: Record<ProbeFailureKind, (baseUrl: string) => string> = {
+  rejected: (baseUrl) =>
+    `${baseUrl} did not accept the account you signed in with. Check that it belongs to a Toloka team, or sign in with another account.`,
+  unreachable: (baseUrl) =>
+    `${baseUrl} did not answer, so the login was not evaluated. Check network access, VPN, or proxy settings and retry.`,
+  platform: () => "The platform failed before confirming the login. Retry later.",
+};
+
 const STATUS_FAILURE_ADVICE: Record<ProbeFailureKind, (baseUrl: string) => string> = {
-  rejected: () => "Run toloka login to store a working key.",
+  rejected: () => "Run toloka login to sign in again.",
   unreachable: (baseUrl) =>
-    `Check network access to ${baseUrl}; the stored key was not evaluated.`,
-  platform: () => "The platform failed before confirming the key. Retry later.",
+    `Check network access to ${baseUrl}; the stored login was not evaluated.`,
+  platform: () => "The platform failed before confirming the login. Retry later.",
 };
 
 export const apiKeyInstructions = (baseUrl: string): string => {
@@ -83,6 +122,15 @@ export type AuthPrompt = (
   options?: { readonly mask?: boolean },
 ) => Promise<string>;
 
+export type AuthChoose = (
+  message: string,
+  choices: readonly {
+    readonly name: string;
+    readonly value: string;
+    readonly description?: string;
+  }[],
+) => Promise<string>;
+
 export type AuthProbe = {
   readonly projects: {
     readonly listPage: (params: { readonly limit: number }) => Promise<{
@@ -90,6 +138,7 @@ export type AuthProbe = {
     }>;
   };
   readonly me?: () => Promise<{
+    readonly email?: string | null;
     readonly internal: boolean;
     readonly teams?: ReadonlyArray<{
       readonly id: string;
@@ -99,107 +148,287 @@ export type AuthProbe = {
   }>;
 };
 
+export type LoginMethod = "browser" | "apiKey";
+
 export type LoginOptions = {
   readonly apiKey?: string;
   readonly baseUrl?: string;
+  readonly browser?: boolean;
   readonly prompt?: AuthPrompt;
+  readonly choose?: AuthChoose;
   readonly environment?: CliEnvironment;
-  readonly probe?: (credentials: StoredCredentials) => AuthProbe;
+  readonly probe?: (config: ClientConfig) => AuthProbe;
+  readonly browserLogin?: BrowserLoginFlow;
+  readonly fetch?: typeof globalThis.fetch;
+  readonly now?: () => number;
+  readonly style?: Style;
   readonly write?: (text: string) => void;
 };
 
 export type LoginResult = {
   readonly credentialsFile: string;
   readonly baseUrl: string;
+  readonly method: LoginMethod;
   readonly output: string;
 };
 
-export async function login(options: LoginOptions = {}): Promise<LoginResult> {
-  const environment = options.environment ?? process.env;
-  const write = options.write ?? (() => undefined);
-  const baseUrl = normalizeBaseUrl(
-    options.baseUrl ??
-      environment.TOLOKA_BASE_URL ??
-      resolveInternalBaseUrl(environment) ??
-      PRODUCTION_BASE_URL,
-  );
-
-  let apiKey = options.apiKey ?? environment.TOLOKA_API_KEY;
-  if (apiKey === undefined) {
-    assertCli(
-      options.prompt,
-      "Missing API key. Without a terminal, pipe the key to toloka login --api-key-stdin, pass --api-key, or set TOLOKA_API_KEY.",
-      { hint: { disabled: true } },
-    );
-    write(`\n${apiKeyInstructions(baseUrl)}\n`);
-    apiKey = (await options.prompt("API key: ", { mask: true })).trim();
-  }
-  assertCli(
-    apiKey.length > 0,
-    "No API key entered.",
-    { hint: { description: "Re-run toloka login and paste the key at the prompt, or pass --api-key." } },
-  );
-  const credentials: StoredCredentials = { baseUrl, apiKey };
-  const probe: AuthProbe = options.probe?.(credentials) ?? createClient(credentials);
-
-  let reachable: string;
+const verifyAccess = async (
+  probe: AuthProbe,
+  baseUrl: string,
+  advice: Record<ProbeFailureKind, (baseUrl: string) => string>,
+): Promise<number> => {
   try {
     const page = await probe.projects.listPage({ limit: 1 });
-    reachable = `Authenticated against ${baseUrl}: ${page.pagination.total} project(s) visible.`;
+    return page.pagination.total;
   } catch (error) {
     const failure = classifyProbeFailure(error);
     throw new TolokaCliError(
       [
         `Could not authenticate against ${baseUrl}: ${failure.reason}`,
         "",
-        `Nothing was saved. ${LOGIN_FAILURE_ADVICE[failure.kind](baseUrl)}`,
+        `Nothing was saved. ${advice[failure.kind](baseUrl)}`,
       ].join("\n"),
       { cause: error, hint: { disabled: true } },
     );
   }
+};
+
+const registryFor = async (
+  environment: CliEnvironment,
+  baseUrl: string,
+): Promise<Pick<StoredCredentials, "current" | "projects">> => {
+  const existing = await inspectCredentialsFile(credentialsPath(environment));
+  if (typeof existing !== "object") return {};
+  if (normalizeBaseUrl(existing.credentials.baseUrl) !== normalizeBaseUrl(baseUrl)) return {};
+  return {
+    ...(existing.credentials.current === undefined ? {} : { current: existing.credentials.current }),
+    ...(existing.credentials.projects === undefined
+      ? {}
+      : { projects: existing.credentials.projects }),
+  };
+};
+
+const accountEmail = async (probe: AuthProbe): Promise<string | undefined> => {
+  if (probe.me === undefined) return undefined;
+  try {
+    const email = (await probe.me()).email;
+    return typeof email === "string" && email.length > 0 ? email : undefined;
+  } catch {
+    return undefined;
+  }
+};
+
+const formatDate = (unixTime: number): string =>
+  new Date(unixTime * 1000).toISOString().replace(/\.\d{3}Z$/u, "Z");
+
+const projectsVisible = (total: number): string =>
+  `${total} ${total === 1 ? "project" : "projects"} visible`;
 
-  const existingPath = credentialsPath(environment);
-  const existing = await inspectCredentialsFile(existingPath);
-  const merged: StoredCredentials =
-    typeof existing === "object" &&
-    normalizeBaseUrl(existing.credentials.baseUrl) === normalizeBaseUrl(baseUrl)
-      ? {
-          baseUrl,
-          apiKey,
-          ...(existing.credentials.current === undefined
-            ? {}
-            : { current: existing.credentials.current }),
-          ...(existing.credentials.projects === undefined
-            ? {}
-            : { projects: existing.credentials.projects }),
-        }
-      : credentials;
-
-  const credentialsFile = await writeStoredCredentials(merged, environment);
+const loginWithApiKey = async (
+  options: LoginOptions,
+  environment: CliEnvironment,
+  baseUrl: string,
+  write: (text: string) => void,
+): Promise<LoginResult> => {
+  let apiKey = options.apiKey ?? environment.TOLOKA_API_KEY;
+  if (apiKey === undefined) {
+    assertCli(
+      options.prompt,
+      "No terminal to type the API key in. Pipe it to toloka login --api-key-stdin, pass --api-key, or set TOLOKA_API_KEY.",
+      { hint: { disabled: true } },
+    );
+    write(`\n${apiKeyInstructions(baseUrl)}\n`);
+    apiKey = (await options.prompt("API key: ", { mask: true })).trim();
+  }
+  assertCli(apiKey.length > 0, "No API key entered.", {
+    hint: { description: "Re-run toloka login and paste the key at the prompt, or pass --api-key." },
+  });
+  const style = options.style ?? PLAIN_STYLE;
+  const clientConfig: ClientConfig = { baseUrl, apiKey };
+  const probe = options.probe?.(clientConfig) ?? createClient(clientConfig);
+  const total = await verifyAccess(probe, baseUrl, API_KEY_LOGIN_FAILURE_ADVICE);
+  const registry = await registryFor(environment, baseUrl);
+  const credentialsFile = await writeStoredCredentials({ baseUrl, apiKey, ...registry }, environment);
 
   return {
     credentialsFile,
     baseUrl,
+    method: "apiKey",
     output: [
-      reachable,
-      `Saved credentials to ${credentialsFile}.`,
-      "",
-      "toloka reads them automatically. --api-key and TOLOKA_API_KEY still win when set.",
+      `${style.green("✔")} Authenticated against ${style.bold(baseUrl)} with an API key`,
+      style.dim(`  ${projectsVisible(total)} · stored in ${credentialsFile}`),
+      style.dim(
+        `  This API key does not expire. To revoke it, delete it in ${consoleUrlFor(baseUrl) ?? "the Business Console"}.`,
+      ),
     ].join("\n"),
   };
+};
+
+const API_KEY_CHOICE = "api-key";
+const BROWSER_CHOICE = "browser";
+
+const signInChoices = (provider: BrowserLoginProvider) => [
+  {
+    name: "Sign in with your browser",
+    value: BROWSER_CHOICE,
+    description: `${provider.identityProviders.map((choice) => choice.name).join(", ")}. Lasts up to 14 days.`,
+  },
+  {
+    name: "Use an API key",
+    value: API_KEY_CHOICE,
+    description:
+      "Paste a key from the Business Console. Works until you delete it; made for scripts, CI, and coding agents.",
+  },
+];
+
+type SignInChoice =
+  | { readonly method: "apiKey" }
+  | { readonly method: "browser"; readonly openBrowser: boolean; readonly requireBrowser: boolean };
+
+const chooseSignIn = async (
+  options: LoginOptions,
+  provider: BrowserLoginProvider,
+): Promise<SignInChoice> => {
+  if (options.browser === false) return { method: "browser", openBrowser: false, requireBrowser: false };
+  if (options.browser === true || options.choose === undefined) {
+    return { method: "browser", openBrowser: true, requireBrowser: options.choose === undefined };
+  }
+  const choice = await options.choose("How do you want to sign in?", signInChoices(provider));
+  return choice === API_KEY_CHOICE
+    ? { method: "apiKey" }
+    : { method: "browser", openBrowser: true, requireBrowser: false };
+};
+
+const loginInBrowser = async (
+  options: LoginOptions,
+  environment: CliEnvironment,
+  baseUrl: string,
+  provider: BrowserLoginProvider,
+  choice: Extract<SignInChoice, { method: "browser" }>,
+  write: (text: string) => void,
+): Promise<LoginResult> => {
+  const tokens = await (options.browserLogin ?? loginWithBrowser)(
+    {
+      provider,
+      openBrowser: choice.openBrowser,
+      requireBrowser: choice.requireBrowser,
+      registrationUrl: registrationUrlFor(baseUrl),
+      ...(options.style === undefined ? {} : { style: options.style }),
+      write,
+    },
+    { environment, ...(options.fetch === undefined ? {} : { fetch: options.fetch }) },
+  );
+  const session = browserSessionFromTokens(provider, tokens, (options.now ?? unixSeconds)());
+  const clientConfig: ClientConfig = { baseUrl, accessToken: async () => session.access_token };
+  const probe = options.probe?.(clientConfig) ?? createClient(clientConfig);
+  const total = await verifyAccess(probe, baseUrl, BROWSER_LOGIN_FAILURE_ADVICE);
+  const who = await accountEmail(probe);
+  await writeBrowserSession(session, provider, environment);
+  const registry = await registryFor(environment, baseUrl);
+  const credentialsFile = await writeStoredCredentials({ baseUrl, ...registry }, environment);
+  const style = options.style ?? PLAIN_STYLE;
+  const renewal =
+    session.refresh_token_expires_at > 0
+      ? `session renews automatically until ${formatDate(session.refresh_token_expires_at)}, then run toloka login again`
+      : "session renews automatically while the login service allows; when it lapses, run toloka login again";
+
+  return {
+    credentialsFile,
+    baseUrl,
+    method: "browser",
+    output: [
+      `${style.green("✔")} Logged in to ${style.bold(baseUrl)}${who === undefined ? "" : ` as ${style.bold(who)}`}`,
+      style.dim(`  ${projectsVisible(total)} · ${renewal}`),
+    ].join("\n"),
+  };
+};
+
+export async function login(options: LoginOptions = {}): Promise<LoginResult> {
+  const environment = options.environment ?? process.env;
+  const write = options.write ?? (() => undefined);
+  const baseUrl = normalizeBaseUrl(resolveBaseUrl(options, environment));
+  const environmentKey = options.browser === undefined ? environment.TOLOKA_API_KEY : undefined;
+  if (options.apiKey !== undefined || environmentKey !== undefined) {
+    return loginWithApiKey(options, environment, baseUrl, write);
+  }
+  const provider = browserLoginProviderFor(baseUrl);
+  if (provider === undefined) {
+    write(`Browser login is not available for ${baseUrl}, so an API key is needed.`);
+    return loginWithApiKey(options, environment, baseUrl, write);
+  }
+  const choice = await chooseSignIn(options, provider);
+  return choice.method === "apiKey"
+    ? loginWithApiKey(options, environment, baseUrl, write)
+    : loginInBrowser(options, environment, baseUrl, provider, choice, write);
 }
 
-export type LogoutResult = { readonly removed: readonly string[]; readonly output: string };
+export type LogoutOptions = {
+  readonly baseUrl?: string;
+  readonly fetch?: typeof globalThis.fetch;
+};
+
+export type LogoutResult = {
+  readonly removed: readonly string[];
+  readonly sessionEnded?: boolean;
+  readonly output: string;
+};
+
+type EndedBrowserLogin = {
+  readonly issuer: string;
+  readonly ended: boolean;
+  readonly path: string | undefined;
+};
 
-export async function logout(environment: CliEnvironment = process.env): Promise<LogoutResult> {
+const endBrowserLogins = async (
+  environment: CliEnvironment,
+  fetchImplementation: typeof globalThis.fetch | undefined,
+): Promise<EndedBrowserLogin[]> => {
+  const ended: EndedBrowserLogin[] = [];
+  for (const provider of KNOWN_BROWSER_LOGIN_PROVIDERS) {
+    const session = await readBrowserSession(provider, environment);
+    if (session === undefined) continue;
+    const ok = await endKeycloakSession(provider, session.refresh_token, fetchImplementation);
+    const path = await removeBrowserSession(provider, environment);
+    ended.push({ issuer: provider.issuer, ended: ok, path });
+  }
+  return ended;
+};
+
+const browserLogoutLine = (browser: EndedBrowserLogin): string =>
+  browser.ended
+    ? `Signed out of ${browser.issuer}.`
+    : `The login at ${browser.issuer} could not be ended and will expire on its own; the local session was removed.`;
+
+export async function logout(
+  environment: CliEnvironment = process.env,
+  options: LogoutOptions = {},
+): Promise<LogoutResult> {
+  let stored: StoredCredentials | undefined;
+  for (const path of storedCredentialsPaths(environment)) {
+    const inspected = await inspectCredentialsFile(path);
+    if (inspected === "missing") continue;
+    stored = typeof inspected === "object" ? inspected.credentials : undefined;
+    break;
+  }
+  const baseUrl = normalizeBaseUrl(resolveBaseUrl(options, environment, stored));
   const removed = await clearStoredCredentials(environment);
+  const browsers = await endBrowserLogins(environment, options.fetch);
+  for (const browser of browsers) if (browser.path !== undefined) removed.push(browser.path);
+
+  if (removed.length === 0) {
+    return { removed, output: `No stored credentials found at ${credentialsPath(environment)}.` };
+  }
 
+  const apiKeyNote = `This does not revoke the API key. Delete it in ${consoleUrlFor(baseUrl) ?? "the Business Console"} to do that.`;
+  const lines = [
+    `Removed ${removed.join(", ")}.`,
+    ...(stored?.apiKey === undefined ? [] : ["", apiKeyNote]),
+    ...browsers.flatMap((browser) => ["", browserLogoutLine(browser)]),
+  ];
   return {
     removed,
-    output:
-      removed.length === 0
-        ? `No stored credentials found at ${credentialsPath(environment)}.`
-        : `Removed ${removed.join(", ")}.\n\nThis does not revoke the key. Delete it in console.toloka.ai to do that.`,
+    ...(browsers.length === 0 ? {} : { sessionEnded: browsers.every((browser) => browser.ended) }),
+    output: lines.join("\n"),
   };
 }
 
@@ -208,9 +437,11 @@ export type AuthStatusOptions = {
   readonly showToken?: boolean;
   readonly flagApiKey?: string;
   readonly flagBaseUrl?: string;
-  readonly probe?: (credentials: StoredCredentials) => AuthProbe;
+  readonly probe?: (config: ClientConfig) => AuthProbe;
   readonly credentialLookup?: CommandCredentialLookup;
   readonly project?: ProjectContext;
+  readonly fetch?: typeof globalThis.fetch;
+  readonly now?: () => number;
 };
 
 export type AuthStatusResult = { readonly authenticated: boolean; readonly output: string };
@@ -221,7 +452,7 @@ const firstDefined = (
   candidates: ReadonlyArray<ResolvedValue | undefined>,
 ): ResolvedValue | undefined => candidates.find((candidate) => candidate !== undefined);
 
-const resolveApiKey = (
+const resolveStatusApiKey = (
   options: AuthStatusOptions,
   environment: CliEnvironment,
   found: FoundCredentials | undefined,
@@ -234,7 +465,7 @@ const resolveApiKey = (
     environment.TOLOKA_API_KEY === undefined
       ? undefined
       : { value: environment.TOLOKA_API_KEY, source: "from TOLOKA_API_KEY" },
-    found === undefined
+    found?.credentials.apiKey === undefined
       ? undefined
       : { value: found.credentials.apiKey, source: `stored in ${storedPath}` },
   ]);
@@ -265,12 +496,14 @@ const accountLines = async (probe: AuthProbe): Promise<readonly string[]> => {
   if (probe.me === undefined) return [];
   try {
     const me = await probe.me();
-    if (me.teams === undefined) return [`Internal: ${me.internal}`];
+    const account = typeof me.email === "string" && me.email.length > 0 ? [`Account:  ${me.email}`] : [];
+    if (me.teams === undefined) return [...account, `Internal: ${me.internal}`];
     const teams = me.teams.map((team) => {
       const qualifiers = [...(team.internal ? ["internal"] : []), ...(team.writable ? [] : ["read-only"])];
       return qualifiers.length === 0 ? team.id : `${team.id} (${qualifiers.join(", ")})`;
     });
     return [
+      ...account,
       `Internal: ${me.internal}`,
       `Teams:    ${teams.length === 0 ? "(none)" : teams.join(", ")}`,
     ];
@@ -279,24 +512,81 @@ const accountLines = async (probe: AuthProbe): Promise<readonly string[]> => {
   }
 };
 
+const describeSession = (session: BrowserSession, now: number): string => {
+  if (isRefreshTokenExpired(session, now)) {
+    return `expired on ${formatDate(session.refresh_token_expires_at)}; run toloka login`;
+  }
+  return session.refresh_token_expires_at > 0
+    ? `renews automatically; the current refresh window ends ${formatDate(session.refresh_token_expires_at)}`
+    : "renews automatically";
+};
+
+type BrowserStatus = {
+  readonly lines: readonly string[];
+  readonly clientConfig?: ClientConfig;
+  readonly failure?: string;
+};
+
+const browserStatus = async (
+  browser: BrowserLogin,
+  baseUrl: string,
+  environment: CliEnvironment,
+  options: AuthStatusOptions,
+  now: number,
+): Promise<BrowserStatus> => {
+  const header = `Login:    browser (stored in ${browser.path})`;
+  const accessToken = createBrowserSessionAuth({
+    provider: browser.provider,
+    baseUrl,
+    environment,
+    ...(options.fetch === undefined ? {} : { fetch: options.fetch }),
+    ...(options.now === undefined ? {} : { now: options.now }),
+  });
+  try {
+    const token = await accessToken();
+    const session = (await readBrowserSession(browser.provider, environment)) ?? browser.session;
+    return {
+      lines: [
+        header,
+        `Session:  ${describeSession(session, now)}`,
+        ...(options.showToken === true ? [`Access token: ${token}`] : []),
+      ],
+      clientConfig: { baseUrl, accessToken },
+    };
+  } catch (error) {
+    if (error instanceof BrowserLoginExpiredError) {
+      return {
+        lines: [header, `Session:  ${describeSession(browser.session, now)}`],
+        failure: STATUS_FAILURE_ADVICE.rejected(baseUrl),
+      };
+    }
+    return {
+      lines: [header, "Session:  could not be renewed"],
+      failure: `Not reachable: ${error instanceof Error ? error.message : String(error)}`,
+    };
+  }
+};
+
 export async function authStatus(options: AuthStatusOptions = {}): Promise<AuthStatusResult> {
   const environment = options.environment ?? process.env;
+  const now = (options.now ?? unixSeconds)();
   const credentialLookup =
     options.credentialLookup ??
     (await findCommandCredentials(environment, options.flagApiKey ?? environment.TOLOKA_API_KEY));
   const { found, warning } = credentialLookup;
   const storedPath = found?.path ?? credentialsPath(environment);
-  const apiKey = resolveApiKey(options, environment, found, storedPath);
+  const apiKey = resolveStatusApiKey(options, environment, found, storedPath);
   const platform = resolvePlatform(options, environment, found);
+  const browser = apiKey === undefined ? await findBrowserLogin(platform.value, environment) : undefined;
   const projectLine = formatProjectContextLine(options.project, found?.credentials);
 
   const lines: string[] = warning === undefined ? [] : [warning, ""];
 
-  if (apiKey === undefined) {
+  if (apiKey === undefined && browser === undefined) {
     lines.push(
       "Not logged in.",
       "",
-      "Run toloka login to store an API key for this machine.",
+      "Run toloka login to sign in through your browser, or store an API key with toloka login --api-key-stdin.",
       "",
       projectLine,
     );
@@ -304,13 +594,26 @@ export async function authStatus(options: AuthStatusOptions = {}): Promise<AuthS
   }
 
   const { value: baseUrl, source: urlSource } = platform;
-  lines.push(
-    `Platform: ${baseUrl} (${urlSource})`,
-    `API key:  ${options.showToken === true ? apiKey.value : maskApiKey(apiKey.value)} (${apiKey.source})`,
-    projectLine,
-  );
+  lines.push(`Platform: ${baseUrl} (${urlSource})`);
+  let clientConfig: ClientConfig;
+  if (apiKey !== undefined) {
+    lines.push(
+      `API key:  ${options.showToken === true ? apiKey.value : maskApiKey(apiKey.value)} (${apiKey.source})`,
+    );
+    clientConfig = { baseUrl, apiKey: apiKey.value };
+  } else {
+    assertCli(browser, "No login is in effect.", { hint: { description: "Run toloka login." } });
+    const status = await browserStatus(browser, baseUrl, environment, options, now);
+    lines.push(...status.lines);
+    if (status.clientConfig === undefined) {
+      lines.push(projectLine, "", status.failure ?? "");
+      return { authenticated: false, output: lines.join("\n") };
+    }
+    clientConfig = status.clientConfig;
+  }
+  lines.push(projectLine);
 
-  if (environment.TOLOKA_API_KEY !== undefined && found !== undefined) {
+  if (environment.TOLOKA_API_KEY !== undefined && found?.credentials.apiKey !== undefined) {
     lines.push("", `TOLOKA_API_KEY is set, so the key stored in ${found.path} is ignored.`);
   }
   if (found?.legacy === true) {
@@ -320,9 +623,7 @@ export async function authStatus(options: AuthStatusOptions = {}): Promise<AuthS
     );
   }
 
-  const probe: AuthProbe =
-    options.probe?.({ baseUrl, apiKey: apiKey.value }) ??
-    createClient({ baseUrl, apiKey: apiKey.value });
+  const probe: AuthProbe = options.probe?.(clientConfig) ?? createClient(clientConfig);
   try {
     const page = await probe.projects.listPage({ limit: 1 });
     lines.push("", `Reachable: ${page.pagination.total} project(s) visible.`);