feat(cli-auth): device-authorization poll flow, drop the loopback listener

The CLI no longer binds a local port. It generates a request id + poll secret,
opens /cli/auth, and polls /api/cli/auth/poll over TLS while the user approves
in the browser — so the flow works over SSH and inside containers, where the
browser and terminal don't share a machine.

- approve stores the approval keyed by request id (session-authed, userId from
  the session only); poll verifies the secret before an atomic claim, so an
  observer of the semi-public request id can neither mint nor cancel it
- pairing code stays as the anti-phishing compare; no key ever crosses the
  browser; done page just confirms
- removes the loopback listener, /token exchange, buildCliHandoffUrl, and
  validateCliCallbackUrl (+ its tests) — nothing hands a key to a URL anymore

Author: TheodoreSpeaks

apps/sim/app/api/cli/auth/approve/route.test.ts

@@ -5,9 +5,9 @@ import { createHash } from 'node:crypto'
 import { createMockRequest } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockGetSession, mockCreateAuthCode, mockEnforceUserRateLimit } = vi.hoisted(() => ({
+const { mockGetSession, mockCreateApproval, mockEnforceUserRateLimit } = vi.hoisted(() => ({
   mockGetSession: vi.fn(),
-  mockCreateAuthCode: vi.fn(),
+  mockCreateApproval: vi.fn(),
   mockEnforceUserRateLimit: vi.fn(),
 }))
 
@@ -16,8 +16,8 @@ vi.mock('@/lib/auth', () => ({
   getSession: mockGetSession,
 }))
 
-vi.mock('@/lib/cli-auth/code-store', () => ({
-  createAuthCode: mockCreateAuthCode,
+vi.mock('@/lib/cli-auth/approval-store', () => ({
+  createApproval: mockCreateApproval,
 }))
 
 vi.mock('@/lib/core/rate-limiter', () => ({
@@ -26,43 +26,47 @@ vi.mock('@/lib/core/rate-limiter', () => ({
 
 import { POST } from '@/app/api/cli/auth/approve/route'
 
-const CHALLENGE = createHash('sha256').update('a'.repeat(43)).digest('base64url')
+const REQUEST = 'a'.repeat(43)
+const CHALLENGE = createHash('sha256').update('b'.repeat(43)).digest('base64url')
 
 describe('POST /api/cli/auth/approve', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
     mockEnforceUserRateLimit.mockResolvedValue(null)
-    mockCreateAuthCode.mockResolvedValue('generated-code')
+    mockCreateApproval.mockResolvedValue(undefined)
   })
 
-  it('issues a code for the signed-in user', async () => {
-    const response = await POST(createMockRequest('POST', { challenge: CHALLENGE }))
-
+  it('records the approval for the signed-in user', async () => {
+    const response = await POST(
+      createMockRequest('POST', { request: REQUEST, challenge: CHALLENGE })
+    )
     expect(response.status).toBe(200)
-    await expect(response.json()).resolves.toEqual({ code: 'generated-code' })
-    expect(mockCreateAuthCode).toHaveBeenCalledWith('user-1', CHALLENGE)
+    await expect(response.json()).resolves.toEqual({ ok: true })
+    expect(mockCreateApproval).toHaveBeenCalledWith('user-1', REQUEST, CHALLENGE)
   })
 
   it('rejects an unauthenticated caller', async () => {
     mockGetSession.mockResolvedValue(null)
-
-    const response = await POST(createMockRequest('POST', { challenge: CHALLENGE }))
-
+    const response = await POST(
+      createMockRequest('POST', { request: REQUEST, challenge: CHALLENGE })
+    )
     expect(response.status).toBe(401)
-    expect(mockCreateAuthCode).not.toHaveBeenCalled()
+    expect(mockCreateApproval).not.toHaveBeenCalled()
   })
 
   it('ignores a user id supplied in the body', async () => {
-    await POST(createMockRequest('POST', { challenge: CHALLENGE, userId: 'attacker' }))
-
-    expect(mockCreateAuthCode).toHaveBeenCalledWith('user-1', CHALLENGE)
+    await POST(
+      createMockRequest('POST', { request: REQUEST, challenge: CHALLENGE, userId: 'attacker' })
+    )
+    expect(mockCreateApproval).toHaveBeenCalledWith('user-1', REQUEST, CHALLENGE)
   })
 
   it('rejects a malformed challenge', async () => {
-    const response = await POST(createMockRequest('POST', { challenge: 'not-a-digest' }))
-
+    const response = await POST(
+      createMockRequest('POST', { request: REQUEST, challenge: 'not-a-digest' })
+    )
     expect(response.status).toBe(400)
-    expect(mockCreateAuthCode).not.toHaveBeenCalled()
+    expect(mockCreateApproval).not.toHaveBeenCalled()
   })
 })

apps/sim/app/api/cli/auth/approve/route.ts

@@ -3,16 +3,19 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { approveCliAuthContract } from '@/lib/api/contracts'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
-import { createAuthCode } from '@/lib/cli-auth/code-store'
+import { createApproval } from '@/lib/cli-auth/approval-store'
 import { enforceUserRateLimit } from '@/lib/core/rate-limiter'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 
 const logger = createLogger('CliAuthApproveAPI')
 
 /**
+ * Records a signed-in user's approval of a CLI handoff so the waiting terminal's
+ * poll can complete.
+ *
  * The approving user comes from the session and nothing else — a client-supplied
- * user id here would let any caller mint a code redeemable for someone else's
- * key. No key is generated until redemption.
+ * user id here would let any caller approve a request redeemable for someone
+ * else's key. No key is generated until the CLI polls.
  */
 export const POST = withRouteHandler(async (request: NextRequest) => {
   const session = await getSession()
@@ -26,8 +29,8 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
   const parsed = await parseRequest(approveCliAuthContract, request, {})
   if (!parsed.success) return parsed.response
 
-  const code = await createAuthCode(session.user.id, parsed.data.body.challenge)
-  logger.info('Issued CLI authorization code', { userId: session.user.id })
+  await createApproval(session.user.id, parsed.data.body.request, parsed.data.body.challenge)
+  logger.info('Recorded CLI authorization approval', { userId: session.user.id })
 
-  return NextResponse.json({ code })
+  return NextResponse.json({ ok: true })
 })

apps/sim/app/api/cli/auth/poll/route.test.ts

@@ -0,0 +1,75 @@
+/**
+ * @vitest-environment node
+ */
+import { createMockRequest } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockPollApproval, mockGenerateCopilotApiKey, mockEnforceIpRateLimit } = vi.hoisted(() => ({
+  mockPollApproval: vi.fn(),
+  mockGenerateCopilotApiKey: vi.fn(),
+  mockEnforceIpRateLimit: vi.fn(),
+}))
+
+vi.mock('@/lib/cli-auth/approval-store', () => ({
+  pollApproval: mockPollApproval,
+}))
+
+vi.mock('@/lib/copilot/server/api-keys', () => ({
+  generateCopilotApiKey: mockGenerateCopilotApiKey,
+  CopilotApiKeyError: class extends Error {},
+}))
+
+vi.mock('@/lib/core/rate-limiter', () => ({
+  enforceIpRateLimit: mockEnforceIpRateLimit,
+}))
+
+import { POST } from '@/app/api/cli/auth/poll/route'
+
+const REQUEST = 'a'.repeat(43)
+const VERIFIER = 'b'.repeat(43)
+
+function pollRequest(body: Record<string, unknown>) {
+  return createMockRequest('POST', body)
+}
+
+describe('POST /api/cli/auth/poll', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockEnforceIpRateLimit.mockResolvedValue(null)
+    mockGenerateCopilotApiKey.mockResolvedValue({ id: 'key-1', apiKey: 'sk-test' })
+  })
+
+  it('returns pending without minting while unapproved', async () => {
+    mockPollApproval.mockResolvedValue({ status: 'pending' })
+    const response = await POST(pollRequest({ request: REQUEST, verifier: VERIFIER }))
+    expect(response.status).toBe(200)
+    await expect(response.json()).resolves.toEqual({ status: 'pending' })
+    expect(mockGenerateCopilotApiKey).not.toHaveBeenCalled()
+  })
+
+  it('mints for the approving user once approved', async () => {
+    mockPollApproval.mockResolvedValue({ status: 'approved', userId: 'user-1' })
+    const response = await POST(pollRequest({ request: REQUEST, verifier: VERIFIER }))
+    expect(response.status).toBe(200)
+    await expect(response.json()).resolves.toEqual({
+      status: 'complete',
+      key: { id: 'key-1', apiKey: 'sk-test' },
+    })
+    expect(mockGenerateCopilotApiKey).toHaveBeenCalledWith('user-1', expect.stringMatching(/^CLI /))
+  })
+
+  it('rejects a malformed verifier before touching the store', async () => {
+    const response = await POST(pollRequest({ request: REQUEST, verifier: 'too-short' }))
+    expect(response.status).toBe(400)
+    expect(mockPollApproval).not.toHaveBeenCalled()
+  })
+
+  it('honors the IP rate limiter', async () => {
+    mockEnforceIpRateLimit.mockResolvedValue(
+      new Response(null, { status: 429 }) as unknown as never
+    )
+    const response = await POST(pollRequest({ request: REQUEST, verifier: VERIFIER }))
+    expect(response.status).toBe(429)
+    expect(mockPollApproval).not.toHaveBeenCalled()
+  })
+})

apps/sim/app/api/cli/auth/poll/route.ts

@@ -0,0 +1,48 @@
+import { createLogger } from '@sim/logger'
+import { type NextRequest, NextResponse } from 'next/server'
+import { pollCliAuthContract } from '@/lib/api/contracts'
+import { parseRequest } from '@/lib/api/server'
+import { pollApproval } from '@/lib/cli-auth/approval-store'
+import { CopilotApiKeyError, generateCopilotApiKey } from '@/lib/copilot/server/api-keys'
+import { enforceIpRateLimit } from '@/lib/core/rate-limiter'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+const logger = createLogger('CliAuthPollAPI')
+
+/** Keys are named for the day they were issued, matching what the CLI prints. */
+function cliKeyName(): string {
+  return `CLI (${new Date().toISOString().slice(0, 10)})`
+}
+
+/**
+ * The CLI's poll endpoint. Unauthenticated by necessity — the CLI has no
+ * session — but the request id is only a rendezvous handle and minting requires
+ * the poll secret, which never leaves the CLI. Returns `pending` until the user
+ * approves; on the first authorized poll it consumes the approval and mints.
+ */
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  const rateLimited = await enforceIpRateLimit('cli-auth-poll', request)
+  if (rateLimited) return rateLimited
+
+  const parsed = await parseRequest(pollCliAuthContract, request, {})
+  if (!parsed.success) return parsed.response
+
+  const { request: requestId, verifier } = parsed.data.body
+
+  const result = await pollApproval(requestId, verifier)
+  if (result.status === 'pending') {
+    return NextResponse.json({ status: 'pending' })
+  }
+
+  try {
+    const key = await generateCopilotApiKey(result.userId, cliKeyName())
+    logger.info('Minted CLI key on approved poll', { userId: result.userId })
+    return NextResponse.json({ status: 'complete', key })
+  } catch (error) {
+    const status = error instanceof CopilotApiKeyError ? error.upstreamStatus : undefined
+    return NextResponse.json(
+      { error: 'Failed to generate copilot API key' },
+      { status: status ?? 500 }
+    )
+  }
+})