Skip to content

feat: support OAuth device login for Vana Account - #3

Merged
tnunamak merged 1 commit into
mainfrom
tim/oauth-device-login
Jul 1, 2026
Merged

feat: support OAuth device login for Vana Account#3
tnunamak merged 1 commit into
mainfrom
tim/oauth-device-login

Conversation

@tnunamak

Copy link
Copy Markdown
Member

Summary

  • add OIDC discovery + RFC 8628 device-code login for Vana Account
  • default public client IDs to vana-cli / vana-cli-dev, with VANA_OAUTH_CLIENT_ID, VANA_ACCOUNT_CLIENT_ID, and vana login --client-id overrides
  • keep the legacy /api/auth/device fallback when Account discovery is unavailable

Tests

  • pnpm test test/cli/auth.test.ts test/cli/index.test.ts
  • pnpm build

@tnunamak tnunamak changed the title Support OAuth device login for Vana Account feat: support OAuth device login for Vana Account Jun 30, 2026
@tnunamak
tnunamak merged commit 05328cb into main Jul 1, 2026
6 of 7 checks passed
@tnunamak
tnunamak deleted the tim/oauth-device-login branch July 1, 2026 04:33
github-actions Bot pushed a commit that referenced this pull request Jul 1, 2026
## [0.15.0](v0.14.0...v0.15.0) (2026-07-01)

### Features

* support account oauth device login ([#3](#3)) ([05328cb](05328cb))

### Bug Fixes

* align CLI auth compatibility checks ([#1](#1)) ([8a7cc43](8a7cc43))
@github-actions

github-actions Bot commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

🎉 This PR is included in version 0.15.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

tnunamak added a commit that referenced this pull request Jul 2, 2026
Account OAuth login (the OIDC device-grant path added in #3) never
returns Personal Server fields on the real token response, so the CLI
silently kept a previous account's pinned personalServerUrl in
~/.vana/vana-connect-state.json after switching accounts. Clear it
whenever a fresh login reports no PS, and read PS fields from
id_token claims as a secondary source alongside the top-level token
fields. Surface a clear "no Personal Server found" hint instead of
silently omitting it.

This is a preparatory correctness/UX fix, not full Account OAuth -> PS
sync enablement: Unity Account has no authenticated-session endpoint
that mints or returns a caller's Personal Server URL/session token
(the legacy connect app's device-poll route does this via
personal_servers/sessions tables, but Unity Account doesn't expose an
equivalent yet). See the accompanying report for what's still needed
server-side.
github-actions Bot pushed a commit that referenced this pull request Jul 2, 2026
## [0.15.1](v0.15.0...v0.15.1) (2026-07-02)

### Bug Fixes

* prevent stale Personal Server URL after Account OAuth login ([#6](#6)) ([60288c4](60288c4)), closes [#3](#3)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant