fix(coder-lite): set OPENAGENTS_API_KEY after device login

2ac810f0c7d2 · AtlantisPleb · 3d ago · parent b17bf694bdd8

fix(coder-lite): set OPENAGENTS_API_KEY after device login

do_login now validates the token against /api/v1/models, then sets the
OPENAGENTS_API_KEY environment variable with the plaintext token before
storing it in the credential store. This keeps the runtime from relying
on a second CredentialStore lookup that can fail or return a stale token
from the OS keychain.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

Not deployed through the forge lane

No push, promotion, build, or deploy receipt references this commit (receipts are scanned over a bounded recent window). Changes shipped by full node replacement carry their proof in the release gate receipt instead.

Changed files

modified crates/coder-lite/src/interactive.rs

Diff

1 file changed, +8 -3


/// Start the GitHub device-authorization flow against the current endpoint,
/// open the approval URL in the browser, poll for the token, store it, and
/// verify it against the model catalog.
/// verify it against the model catalog. The token is also placed in
/// `OPENAGENTS_API_KEY` so the runtime spends it without a second store lookup.
pub async fn do_login() -> Result<String, Box<dyn std::error::Error>> {
    let endpoint = openagents_cli::auth::resolve_endpoint(None, None)?;
    let client = DeviceClient::new(&endpoint.origin);

    open_browser(&auth.verification_uri_complete);

    let token = client.wait(&auth).await?;
    validate_token(&endpoint.origin, &token).await?;

    let store = CredentialStore::for_origin(&endpoint.origin);
    let _ = store.store(&token)?;
    let _ = store.store(&token);

    // SAFETY: this process owns the environment; the TUI has not started here.
    unsafe { std::env::set_var("OPENAGENTS_API_KEY", token.expose()) };

    validate_token(&endpoint.origin, &token).await?;
    Ok("Authenticated.".to_string())
}


272	272
273	273		`/// Start the GitHub device-authorization flow against the current endpoint,`
274	274		`/// open the approval URL in the browser, poll for the token, store it, and`
275		-	`/// verify it against the model catalog.`
	275	+	`/// verify it against the model catalog. The token is also placed in`
	276	+	/// `OPENAGENTS_API_KEY` so the runtime spends it without a second store lookup.
276	277		`pub async fn do_login() -> Result<String, Box<dyn std::error::Error>> {`
277	278		`let endpoint = openagents_cli::auth::resolve_endpoint(None, None)?;`
278	279		`let client = DeviceClient::new(&endpoint.origin);`

282	283		`open_browser(&auth.verification_uri_complete);`
283	284
284	285		`let token = client.wait(&auth).await?;`
	286	+	`validate_token(&endpoint.origin, &token).await?;`
	287	+
285	288		`let store = CredentialStore::for_origin(&endpoint.origin);`
286		-	`let _ = store.store(&token)?;`
	289	+	`let _ = store.store(&token);`
	290	+
	291	+	`// SAFETY: this process owns the environment; the TUI has not started here.`
	292	+	`unsafe { std::env::set_var("OPENAGENTS_API_KEY", token.expose()) };`
287	293
288		-	`validate_token(&endpoint.origin, &token).await?;`
289	294		`Ok("Authenticated.".to_string())`
290	295		`}`
291	296