Auth
The local dashboard can securely sign a device in and continue to Stackie app billing. Stackie app handles plans, trials, checkout, and payment; the local daemon stores the device session before returning the browser there.
This module provides REST API endpoints for authentication operations exposed by both the dashboard HTTP server and the legacy daemon IPC-backed server.
Dashboard auth endpoints (same-tab redirect flow)
| Endpoint | Method | Handler |
|---|---|---|
/api/auth/status | GET | dashboard_auth_status |
/api/auth/login | POST | dashboard_auth_login |
/api/auth/logout | POST | dashboard_auth_logout |
/api/auth/callback | GET | handle_callback |
The dashboard login flow (POST /api/auth/login) returns the auth URL as JSON
so the dashboard-ui can navigate same-tab via window.location.href. The
callback returns to the normalized local dashboard origin that initiated the
login. A billing hand-off may instead request Stackie’s fixed, validated
/billing app route after the daemon has persisted the device session. This
is different from the CLI flow where the daemon opens the system browser
directly.
Security note: POST /api/auth/login must only be served over localhost.
Exposing it on a public interface would allow remote callers to obtain a CSRF
state nonce. The daemon’s HTTP server binds to 127.0.0.1 only.
Callback endpoint
handle_callback receives the browser redirect from the web app after device
authentication. It validates the CSRF state, persists the session to the OS
keychain, and returns a 302 redirect to a validated billing completion route,
the normalized local dashboard origin, or / in that order. CLI flow session
delivery still happens via the oneshot channel while the receiver is active.
See: auth/oauth.rs for CsrfStateStore, OAuthFlow, and build_auth_url