login: simplify flow selection after review

334df98→main·

Cleanups from a reuse/simplification/efficiency/altitude review of the browser-flow hardening commits; no behavior change:

• Collapse runLoginAuto's three trailing bools into a loginFlowFacts struct, so call sites are self-documenting instead of relying on /* useDevice */-style comments.
• Pass canPrompt into runLogin instead of re-probing /dev/tty via interactive.CanPromptInteractively() a second time on the device path.
• Slim the startBrowser adapter closure to a direct return — the typed-nil interface on error is harmless since callers check err first.
• Move the SSH_* env blanking from the one browser-flow integration test into startLoginProcess, so future login subprocess tests are SSH-safe by default (same centralization idea as GitIsolatedEnv).
• Share one noopOpenURL test helper instead of seven inline lambdas.

Co-Authored-By: Claude Fable 5 noreply@anthropic.com

Sessions

Changes

3

• cmd/entire/cli

• integration_test

• Mlogin_test.go+7/-7

• Mlogin.go+30/-19

• Mlogin_test.go+29/-36

215 unmodified lines

// Blank the SSH_* vars too: startLoginProcess inherits os.Environ(), so a
// developer running tests over SSH would otherwise flip the subprocess'
// isSSHSession() detection and route it to the device flow.
proc := startLoginProcess(t, server.URL, []string{
    "ENTIRE_TEST_TTY=1",
    "SSH_CONNECTION=", "SSH_CLIENT=", "SSH_TTY=",
}, "login", "--insecure-http-auth")

Mcmd/entire/cli/integration_test/login_test.go+7/-7

73 unmodified lines

loginFlowFacts

type loginFlowFacts struct {
    useDevice  bool // --device flag
    canPrompt  bool // interactive terminal present
    sshSession bool // running inside an SSH session
}

// runLoginAuto picks between the browser (loopback authorization-code) and
// device-code flows and runs the chosen one. The browser flow is the
// default — no code to type, no poll latency — but it needs a browser that
// and we're not inside an SSH session (where the loopback listener binds
// on the remote host, out of the user's browser's reach); otherwise the
// caller falls back to the device flow.

// shouldUseBrowserLogin reports whether `entire login` should use the
// fall back to the device flow with a one-line explanation; the same
// both-flows-with-fallback shape gh / gcloud / aws sso ship. --device
// forces the device flow without commentary.

func shouldUseBrowserLogin(useDevice, canPrompt, sshSession bool) bool {
    return !useDevice && canPrompt && !sshSession
}

// isSSHSession reports whether this process is running inside an SSH
// session.

// The fake blocks until the wait context expires — the deadline must
// come from runBrowserLogin's own timeout, or this test would hang.
flow := &fakeBrowserFlow{authURL: "https://auth.test/authorize", waitUntilDone: true}
noopOpen := func(context.Context, string) error { return nil }

err := runBrowserLogin(context.Background(), &bytes.Buffer{}, &bytes.Buffer{}, flow, "https://auth.test", noopOpen, time.Minute)