Replace password based auth with oauth device flow #1085

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

ericmj merged 14 commits into main from ericmj/oauth-device

Oct 2, 2025

.github/workflows/main.yml

-Original file line number
+Diff line change
@@ Expand Up / @@ -62,6 +62,7 @@ jobs: @@
         env:
           HEXPM_OTP: OTP-28.1
           HEXPM_ELIXIR: v1.18.4
+          HEXPM_BRANCH: main
           HEXPM_PATH: hexpm
           HEXPM_ELIXIR_PATH: hexpm_elixir
           HEXPM_OTP_PATH: hexpm_otp
@@ Expand Down Expand Up / @@ -92,7 +93,7 @@ jobs: @@
           - name: Set up hexpm
             run: |
-              git clone https://github.com/hexpm/hexpm.git hexpm
+              git clone -b ${HEXPM_BRANCH} https://github.com/hexpm/hexpm.git hexpm
               cd hexpm; PATH=$(pwd)/../${HEXPM_ELIXIR_PATH}/bin:$(pwd)/../${HEXPM_OTP_PATH}/bin:${PATH} MIX_HOME=$(pwd)/../${HEXPM_MIX_HOME} MIX_ARCHIVES=$(pwd)/../${HEXPM_MIX_HOME} MIX_ENV=hex ../${HEXPM_ELIXIR_PATH}/bin/mix deps.get; cd ..
               cd hexpm; PATH=$(pwd)/../${HEXPM_ELIXIR_PATH}/bin:$(pwd)/../${HEXPM_OTP_PATH}/bin:${PATH} MIX_HOME=$(pwd)/../${HEXPM_MIX_HOME} MIX_ARCHIVES=$(pwd)/../${HEXPM_MIX_HOME} MIX_ENV=hex ../${HEXPM_ELIXIR_PATH}/bin/mix compile; cd ..
@@ Expand Down @@

config/config.exs

-Original file line number
+Diff line change
@@ -1,6 +1,6 @@
     import Config
     if config_env() == :test do
-      config :logger, level: :warn
+      config :logger, level: :warning
       config :logger, :console, format: "$date $time [$level] $message\n"
     end

lib/hex/api/client.ex

-Original file line number
+Diff line change
@@ Expand Up / @@ -18,7 +18,9 @@ defmodule Hex.API.Client do @@
       defp maybe_put_api_key(config, opts) do
         cond do
           opts[:key] ->
-            Map.put(config, :api_key, opts[:key])
+            # Add Bearer prefix only for OAuth tokens
+            token = if opts[:oauth], do: "Bearer #{opts[:key]}", else: opts[:key]
+            Map.put(config, :api_key, token)
           opts[:user] && opts[:pass] ->
             # For basic auth, add it as an HTTP header
@@ Expand Down @@

lib/hex/api/oauth.ex

-Original file line number
+Diff line change
@@ -0,0 +1,98 @@
+    defmodule Hex.API.OAuth do
+      @moduledoc false
+      alias Hex.API.Client
+      @client_id "78ea6566-89fd-481e-a1d6-7d9d78eacca8"
+      @doc """
+      Initiates the OAuth device authorization flow.
+      Returns device code, user code, and verification URIs for user authentication.
+      Optionally accepts a name parameter to identify the token.
+      ## Examples
+          iex> Hex.API.OAuth.device_authorization("api")
+          {:ok, {200, _headers, %{
+            "device_code" => "...",
+            "user_code" => "ABCD-1234",
+            "verification_uri" => "https://hex.pm/oauth/device",
+            "verification_uri_complete" => "https://hex.pm/oauth/device?user_code=ABCD-1234",
+            "expires_in" => 600,
+            "interval" => 5
+          }}}
+      """
+      def device_authorization(scopes, name \\ nil) do
+        config = Client.config()
+        opts = if name, do: [name: name], else: []
+        :mix_hex_api_oauth.device_authorization(config, @client_id, scopes, opts)
+      end
+      @doc """
+      Polls the OAuth token endpoint for device authorization completion.
+      ## Examples
+          iex> Hex.API.OAuth.poll_device_token(device_code)
+          {:ok, {200, _headers, %{
+            "access_token" => "...",
+            "refresh_token" => "...",
+            "token_type" => "Bearer",
+            "expires_in" => 3600
+          }}}
+      """
+      def poll_device_token(device_code) do
+        config = Client.config()
+        :mix_hex_api_oauth.poll_device_token(config, @client_id, device_code)
+      end
+      @doc """
+      Exchanges a token for a new token with different scopes using RFC 8693 token exchange.
+      ## Examples
+          iex> Hex.API.OAuth.exchange_token(subject_token, "api:write")
+          {:ok, {200, _headers, %{
+            "access_token" => "...",
+            "refresh_token" => "...",
+            "token_type" => "Bearer",
+            "expires_in" => 3600
+          }}}
+      """
+      def exchange_token(subject_token, scope) do
+        config = Client.config()
+        :mix_hex_api_oauth.exchange_token(config, @client_id, subject_token, scope)
+      end
+      @doc """
+      Refreshes an access token using a refresh token.
+      ## Examples
+          iex> Hex.API.OAuth.refresh_token(refresh_token)
+          {:ok, {200, _headers, %{
+            "access_token" => "...",
+            "refresh_token" => "...",
+            "token_type" => "Bearer",
+            "expires_in" => 3600
+          }}}
+      """
+      def refresh_token(refresh_token) do
+        config = Client.config()
+        :mix_hex_api_oauth.refresh_token(config, @client_id, refresh_token)
+      end
+      @doc """
+      Revokes an OAuth token (access or refresh token).
+      ## Examples
+          iex> Hex.API.OAuth.revoke_token(token)
+          {:ok, {200, _headers, nil}}
+      """
+      def revoke_token(token) do
+        config = Client.config()
+        :mix_hex_api_oauth.revoke_token(config, @client_id, token)
+      end
+    end

lib/hex/crypto.ex

This file was deleted.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Replace password based auth with oauth device flow #1085

Uh oh!

Diff view

Diff view

There are no files selected for viewing

Uh oh!

Uh oh!

Uh oh!