Repository navigation
feat(cli): create organization access tokens through the dashboard - #15409
Conversation
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 23 files
Confidence score: 3/5
- In
clients/packages/cli/README.md, the login and dashboard commands fail if run in the same shell as the preceding local-API snippet because the required environment variables conflict or are missing. Update the example to set the required variables or show the commands in a separate shell.
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="clients/packages/cli/README.md">
<violation number="1" location="clients/packages/cli/README.md:65">
P2: These commands fail after following the preceding local-API snippet in the same shell: `auth login` rejects `POLAR_ACCESS_TOKEN`, and the dashboard resolver requires `POLAR_DASHBOARD_URL` when `POLAR_API_URL` is set. Unset the token override and set the local dashboard URL before either command.</violation>
</file>
This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.
View guided diff | Turn on auto-fix | Re-trigger cubic
There was a problem hiding this comment.
0 issues found across 9 files (changes from recent commits).
Confidence score: 5/5
- Automated review surfaced no issues in the provided summaries.
- No files require special attention.
Requires human review: Auto-approval blocked by 2 unresolved issues from previous reviews.
View guided diff | Turn on auto-fix | Re-trigger cubic
There was a problem hiding this comment.
All reported issues were addressed across 4 files (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
View guided diff | Turn on auto-fix | Re-trigger cubic
`polar auth token` opens /dashboard/:slug/cli/token for the active organization. The page creates the token with the web session, so the fresh-session requirement on token creation stays and an OAuth session still can't mint a token that outlives it. The CLI sends a one-time RSA public key and a state with the page link. The page encrypts the token in the browser and redirects to the CLI's loopback listener on 127.0.0.1:3333, which only ever receives ciphertext. The CLI decrypts it and writes it to .env (or --env-file) without printing it, so the token stays out of terminal and agent history. Opened without a key, the page shows the token once to copy. Along the way: - OAuth login and the token handoff share the loopback callback server (utils/loopback.ts) and the dashboard origin (dashboardOrigin in services/api.ts), so --local and POLAR_DASHBOARD_URL apply to both. - The create-token logic, including the fresh-session retry, moves out of CreateAccessTokenModal into useSubmitOrganizationAccessToken. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Sandbox tokens also write POLAR_ENVIRONMENT=sandbox and local tokens POLAR_API_URL, and a variable left from another environment is flagged rather than removed. --stdout prints KEY=value lines to pipe into a hosting provider, with status messages on stderr. Drop --env-var and --name: the token is always POLAR_ACCESS_TOKEN and is named after the current directory, editable on the dashboard page. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- Ignore loopback callbacks whose state doesn't match instead of ending the wait, so another page can't abort a login or token handoff. - Create new env files with mode 600 and remove later duplicate assignments, so the new token is the one that takes effect. - Unset the token-override variables before the local login steps in the README. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Without --env-file, write to .env.local when it exists and .env otherwise, so projects that commit .env keep secrets in .env.local. After writing, warn when git doesn't ignore the file. Writing env files moves into services/env-file.ts, which runs git check-ignore. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
aeccbf3 to
1c84132
Compare
There was a problem hiding this comment.
0 issues found across 3 files (changes from recent commits).
Confidence score: 5/5
- Automated review surfaced no issues in the provided summaries.
- No files require special attention.
Requires human review: Auto-approval blocked by 2 unresolved issues from previous reviews.
View guided diff | Turn on auto-fix | Re-trigger cubic
…nv file Drop --stdout and --env-file. auth token now prints KEY=value lines on stdout and leaves storing them to the caller; prompts and hints go to stderr so the output can be piped or redirected. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
All reported issues were addressed across 8 files (changes from recent commits).
Reply with feedback, questions, or to request a fix.
View guided diff | Turn on auto-fix | Re-trigger cubic
Drop the KEY=value lines so the output can go straight into a secret store or a variable. The environment becomes an SDK hint on stderr. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
All reported issues were addressed across 4 files (changes from recent commits).
Reply with feedback, questions, or to request a fix.
View guided diff | Turn on auto-fix | Re-trigger cubic
There was a problem hiding this comment.
No issues found across 23 files
Confidence score: 5/5
- Automated review surfaced no issues in the provided summaries.
- No files require special attention.
Requires human review: Adds polar auth token CLI command and a dashboard page that mints long-lived org access tokens via an encrypted loopback handoff. This is a new authentication/token-issuance path with a novel security design, so it needs human security review.
View guided diff | Turn on auto-fix | Re-trigger cubic
awaitCallback already rejects callbacks with the wrong state before parsing them. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
0 issues found across 2 files (changes from recent commits).
Confidence score: 5/5
- Automated review surfaced no issues in the provided summaries.
- No files require special attention.
Requires human review: Adds a CLI command and dashboard page that mint long-lived org access tokens via an encrypted loopback handoff, and refactors auth login into shared loopback code. New token-issuance/auth surface and accepted docs risks require human sign-off.
View guided diff | Turn on auto-fix | Re-trigger cubic
Summary
polar auth tokencreates an organization access token (OAT) for an app and prints it on stdout, for the caller to store wherever it belongs.What
polar auth token [--scope …]auth whoami), including--local./dashboard/<slug>/cli/token, waits on the existing loopback listener (127.0.0.1:3333), and prints the token, nothing else, on stdout.echo "POLAR_ACCESS_TOKEN=$(polar auth token)" >> .env.localandpolar auth token | gh secret set POLAR_ACCESS_TOKENcapture only the token.--jsonis refused./dashboard/[organization]/cli/token: full-screen page with the existing token form, prefilled with the CLI's name and scopes. Cancel notifies the CLI. Opened without a CLI key, it shows the token once to copy.utils/loopback.ts: the callback server is shared byauth loginandauth token.dashboardOrigininservices/api.ts: OAuthauthorizationUrland the token page resolve the dashboard the same way, includingPOLAR_DASHBOARD_URLand the guard against the hosted dashboard whenPOLAR_API_URLis set.useSubmitOrganizationAccessToken: create-token logic, including the fresh-session retry, is shared by the settings modal and the new page.Why
Creating an OAT requires a fresh web session. That stays: an OAuth session must not be able to mint an OAT, because the OAT can outlive it. But developers and agents setting up Polar in an app need a token from the CLI. The token prints on stdout, so an agent should redirect or pipe it rather than read it, to keep it out of its history.
How
The CLI generates a one-time RSA-OAEP key pair and a
state, and passes the public key to the page. After the user creates the token in their web session, the page encrypts it with WebCrypto and redirects to the fixed loopback URL. The CLI checksstateand decrypts.127.0.0.1:3333, so a crafted link cannot redirect the token.Checklist
Verification
dev seed,bun src/cli.ts auth login --local, thenbun src/cli.ts auth token.http://127.0.0.1:3333can only be checked on sandbox after deploy.auth loginalready makes the same jump in production (polar.sh→http://127.0.0.1:3333/oauth/callback); this page navigates withwindow.locationrather than a server redirect, which browsers also treat as a top-level navigation.🤖 Generated with Claude Code