New Authentication Flow

[Michael-F-Bryan]

Motivation

We want to improve the user experience for wasmer login and align more closely with other CLI tools

Proposed solution

The new login flow will be a variant of OAuth:

1. The CLI starts up a HTTP server on localhost
2. CLI runs a mutation on the backend that generates a "pre-token" for logging a user in (something with an ID, URL, and a secret)
3. The CLI prints the URL to the screen
4. The user clicks on the URL, which takes them to the frontend so they can log in
5. Once logged in, the frontend sends a POST request to the CLI with the login token
6. The CLI saves this token to $WASMER_DIR/wasmer.toml and stops the HTTP server

The full plan is on Notion, but here's the overall flow:

[theduke]

Just a note: let's please keep the simple token copy/paste flow as a fallback, potentially with a --token flag (which then prompts you to enter the token, the token shouldn't end up in shell history).

[Michael-F-Bryan]

let's please keep the simple token copy/paste flow as a fallback, potentially with a --token flag

@syrusakbary is probably the best person to talk about this, but i feel like we might not want to keep the old flow.

That would mean we now have three different flows for logging in (four if you count $WASMER_TOKEN or --token=some-token accepted by each command):

• you can do wasmer login $my_token (which is usable on remote servers or in CI)
• you can go through the OAuth-like flow (the way most people will login interactive), or
• you can copy/paste into stdin

The concern I have is that we'll be giving users multiple overlapping ways of authenticating, which will be quite confusing for users.

That said, I just checked gcloud and they have a --no-browser flag:

If you'd rather authorize without a web browser but still interact with the command line, use the --no-browser flag.

[theduke]

Yes exactly, there will be contexts and environments where you don't want to create a new token with a new login every time, but also not specify token/registry env vars constantly.

Also in contexts where a browser simply isn't available, like on servers.

It would be annoying to then have to manually edit the config file.

[dynamite-bud]

Closed in #4057