Add UserAccountConnect login option (OAuth authorization code flow)

docs/command/atlas-auth-login.txt

@@ -37,6 +37,10 @@ Options
      - Type
      - Required
      - Description
+   * - --discover
+     - 
+     - false
+     - Force re-discovery of authorization server metadata.
    * - --gov
      - 
      - false

internal/cli/auth/login.go

@@ -67,6 +67,10 @@ type TrackAsker interface {
 	TrackAskOne(survey.Prompt, any, ...survey.AskOpt) error
 }
 
+type userDelegationRunner interface {
+	Run(ctx context.Context) error
+}
+
 const (
 	userAccountAuth = "UserAccount"
 	atlasName       = "atlas"
@@ -75,9 +79,10 @@ const (
 var (
 	ErrProjectIDNotFound = errors.New("project is inaccessible. You either don't have access to this project or the project doesn't exist")
 	ErrOrgIDNotFound     = errors.New("organization is inaccessible. You don't have access to this organization or the organization doesn't exist")
-	authTypeOptions      = []string{userAccountAuth, prompt.ServiceAccountAuth, prompt.APIKeysAuth}
+	authTypeOptions      = []string{userAccountAuth, prompt.UserDelegationAuth, prompt.ServiceAccountAuth, prompt.APIKeysAuth}
 	authTypeDescription  = map[string]string{
-		userAccountAuth:           "(best for getting started)",
+		userAccountAuth:           "(legacy account connection)",
+		prompt.UserDelegationAuth: "(best for user accounts)",
 		prompt.ServiceAccountAuth: "(best for automation)",
 		prompt.APIKeysAuth:        "(for existing automations)",
 	}
@@ -94,11 +99,14 @@ type LoginOpts struct {
 	PrivateAPIKey string
 	IsGov         bool
 	NoBrowser     bool
+	Discover      bool
 	authType      string
 	force         bool
 	SkipConfig    bool
 	config        LoginConfig
 	Asker         TrackAsker
+
+	userDelegationFlow userDelegationRunner
 }
 
 func (opts *LoginOpts) promptAuthType() error {
@@ -165,13 +173,27 @@ func (opts *LoginOpts) setUpCredentials(ctx context.Context) error {
 	switch opts.authType {
 	case userAccountAuth:
 		return opts.setUserAccountCredentials(ctx)
+	case prompt.UserDelegationAuth:
+		return opts.runUserDelegationFlow(ctx)
 	case prompt.ServiceAccountAuth, prompt.APIKeysAuth:
 		return opts.setProgrammaticCredentials()
 	default:
 		return errors.New("no authentication type selected")
 	}
 }
 
+func (opts *LoginOpts) runUserDelegationFlow(ctx context.Context) error {
+	if opts.userDelegationFlow == nil {
+		opts.userDelegationFlow = &UserDelegationFlow{
+			config:    config.Default(),
+			OutWriter: opts.OutWriter,
+			NoBrowser: opts.NoBrowser,
+			Discover:  opts.Discover,
+		}
+	}
+	return opts.userDelegationFlow.Run(ctx)
+}
+
 func (opts *LoginOpts) setUpAccess() {
 	// Set service
 	switch {
@@ -246,6 +268,8 @@ func (opts *LoginOpts) LoginRun(ctx context.Context) error {
 	switch opts.authType {
 	case userAccountAuth:
 		opts.config.SetAuthType(config.UserAccount)
+	case prompt.UserDelegationAuth:
+		opts.config.SetAuthType(config.UserDelegation)
 	case prompt.ServiceAccountAuth:
 		opts.config.SetAuthType(config.ServiceAccount)
 	case prompt.APIKeysAuth:
@@ -468,6 +492,7 @@ func LoginBuilder() *cobra.Command {
 
 	cmd.Flags().BoolVar(&opts.IsGov, "gov", false, "Log in to Atlas for Government.")
 	cmd.Flags().BoolVar(&opts.NoBrowser, "noBrowser", false, "Don't automatically open a browser session.")
+	cmd.Flags().BoolVar(&opts.Discover, "discover", false, "Force re-discovery of authorization server metadata.")
 	cmd.Flags().BoolVar(&opts.SkipConfig, "skipConfig", false, "Skip profile configuration.")
 	_ = cmd.Flags().MarkDeprecated("skipConfig", "if you configured a profile, the command skips the config step by default.")
 	cmd.Flags().BoolVar(&opts.force, flag.Force, false, usage.Force)

internal/cli/auth/login_test.go

@@ -16,6 +16,7 @@ package auth
 
 import (
 	"bytes"
+	"context"
 	"errors"
 	"fmt"
 	"testing"
@@ -137,6 +138,46 @@ func Test_loginOpts_LoginRun_UserAccount(t *testing.T) {
 	require.NoError(t, err)
 }
 
+type fakeUserDelegationFlow struct {
+	called bool
+}
+
+func (f *fakeUserDelegationFlow) Run(context.Context) error {
+	f.called = true
+	return nil
+}
+
+func Test_loginOpts_LoginRun_UserDelegation(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mockConfig := NewMockLoginConfig(ctrl)
+	mockAsker := NewMockTrackAsker(ctrl)
+
+	flow := &fakeUserDelegationFlow{}
+	opts := &LoginOpts{
+		config:             mockConfig,
+		Asker:              mockAsker,
+		userDelegationFlow: flow,
+	}
+	opts.OutWriter = new(bytes.Buffer)
+
+	mockAsker.EXPECT().
+		TrackAskOne(gomock.Any(), gomock.Any()).
+		DoAndReturn(func(_ survey.Prompt, answer any, _ ...survey.AskOpt) error {
+			if s, ok := answer.(*string); ok {
+				*s = prompt.UserDelegationAuth
+			}
+			return nil
+		})
+
+	mockConfig.EXPECT().SetAuthType(config.UserDelegation).Times(1)
+
+	opts.SkipConfig = true
+
+	err := opts.LoginRun(t.Context())
+	require.NoError(t, err)
+	assert.True(t, flow.called)
+}
+
 func TestLoginRun_APIKeys_Success(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	mockConfig := NewMockLoginConfig(ctrl)

internal/cli/auth/logout.go

@@ -16,6 +16,7 @@ package auth
 
 import (
 	"context"
+	"errors"
 	"io"
 	"net/http"
 	"strings"
@@ -52,6 +53,9 @@ type ConfigDeleter interface {
 	ClientSecret() string
 	AccessTokenSubject() (string, error)
 	RefreshToken() string
+	Service() string
+	AuthServerURL() string
+	AuthServerMetadata() map[string]any
 	Save() error
 }
 
@@ -67,16 +71,14 @@ type logoutOpts struct {
 	flow                      Revoker
 	keepConfig                bool
 	revokeServiceAccountToken func() error
+	revokeAuthServerToken     func(context.Context) error
 }
 
-func (opts *logoutOpts) initFlow(ctx context.Context) error {
+func (opts *logoutOpts) initFlow() error {
 	var err error
 	client := http.DefaultClient
 	client.Transport = transport.Default()
 	opts.flow, err = transport.FlowWithConfig(config.Default(), client, version.Version)
-	opts.revokeServiceAccountToken = func() error {
-		return revokeServiceAccountToken(ctx, opts.config.ClientID(), opts.config.ClientSecret())
-	}
 	return err
 }
 
@@ -95,6 +97,31 @@ func revokeServiceAccountToken(ctx context.Context, clientID, clientSecret strin
 	return cfg.RevokeToken(ctx, token)
 }
 
+func revokeAuthServerToken(ctx context.Context, cfg ConfigDeleter) error {
+	metadata := cfg.AuthServerMetadata()
+	if metadata == nil {
+		return errors.New("no auth server metadata available")
+	}
+	m, ok := metadata["metadata"].(map[string]any)
+	if !ok {
+		return errors.New("invalid auth server metadata")
+	}
+	revocationEndpoint, ok := m["revocation_endpoint"].(string)
+	if !ok || revocationEndpoint == "" {
+		return errors.New("revocation_endpoint not found in auth server metadata")
+	}
+
+	client := http.DefaultClient
+	client.Transport = transport.Default()
+
+	authCfg, err := transport.FlowForAuthIssuer(cfg, client, version.Version)
+	if err != nil {
+		return err
+	}
+
+	return authCfg.RevokeAuthServerToken(ctx, revocationEndpoint, cfg.RefreshToken(), "refresh_token")
+}
+
 func (opts *logoutOpts) Run(ctx context.Context) error {
 	if !opts.Confirm {
 		return nil
@@ -106,6 +133,10 @@ func (opts *logoutOpts) Run(ctx context.Context) error {
 		if err != nil {
 			_, _ = log.Warningf("Warning: unable to revoke user account token: %v, proceeding with logout\n", err)
 		}
+	case config.UserDelegation:
+		if err := opts.revokeAuthServerToken(ctx); err != nil {
+			_, _ = log.Warningf("Warning: unable to revoke token: %v, proceeding with logout\n", err)
+		}
 	case config.ServiceAccount:
 		if err := opts.revokeServiceAccountToken(); err != nil {
 			_, _ = log.Warningf("Warning: unable to revoke service account token: %v, proceeding with logout\n", err)
@@ -155,9 +186,18 @@ func LogoutBuilder() *cobra.Command {
 				opts.config = config.Default()
 			}
 
-			// Only initialize OAuth flow if we have OAuth-based auth
-			if opts.config.AuthType() == config.UserAccount || opts.config.AuthType() == config.ServiceAccount {
-				return opts.initFlow(cmd.Context())
+			// Wire up the revoke path for the profile's auth type.
+			switch opts.config.AuthType() {
+			case config.UserAccount:
+				return opts.initFlow()
+			case config.ServiceAccount:
+				opts.revokeServiceAccountToken = func() error {
+					return revokeServiceAccountToken(cmd.Context(), opts.config.ClientID(), opts.config.ClientSecret())
+				}
+			case config.UserDelegation:
+				opts.revokeAuthServerToken = func(ctx context.Context) error {
+					return revokeAuthServerToken(ctx, opts.config)
+				}
 			}
 
 			return nil
@@ -184,6 +224,8 @@ func LogoutBuilder() *cobra.Command {
 				}
 
 				message = logoutMessage + " with user account " + subject + "?"
+			case config.UserDelegation:
+				message = logoutMessage + "?"
 			case config.NoAuth, "":
 				message = logoutMessage + "?"
 			}