feat(auth flow): add ability to authenticate ampcc if not authenticated #1595

cmwhited · 2026-01-20T22:25:03Z

Description

Updated the auth flow in ampcc to enable authenticating using the PKCE device flow against the platform auth ui.

Auth state/flow:

check if the user passed in an AMP_AUTH_TOKEN to the env
check {home_dir}/.amp/cache/amp_cli_auth, which is set by the amp cli (and now this TUI as well)
give users the ability to authenticate using the PKCE device flow with the platform auth ui
give users the ability to logout
show the users connected wallet in the toolbar. may update this to be more dynamic based on how they logged in (discord, email, etc)

CleanShot.2026-01-20.at.12.24.04.mp4

…whited/ampcc/feat-auth

shiyasmohd · 2026-01-22T04:32:46Z

crates/bin/ampcc/src/auth/error.rs

+
+/// Errors that can occur during authentication operations.
+#[derive(Debug, Error)]
+pub enum AuthError {


Could you add detailed docs for each errors?

shiyasmohd · 2026-01-22T04:59:42Z

crates/bin/ampcc/src/registry.rs

+    /// 1. AMP_AUTH_TOKEN environment variable (highest priority)
+    /// 2. Auth storage file (~/.amp/cache/amp_cli_auth)
    pub fn new(base_url: String) -> Self {
-        let auth_token = Self::load_auth_token();
-        // Use Client::new() like other working clients in the codebase
-        let http = reqwest::Client::new();
-
-        Self {
-            http,
-            base_url: base_url.trim_end_matches('/').to_string(),
-            auth_token,
-        }
+        // Load from auth storage file, then pass to with_token which checks env var
+        let file_token = AuthStorage::load().map(|a| a.access_token);
+        Self::with_token(base_url, file_token)
    }

-    /// Create a new registry client with a specific auth token.
-    #[allow(dead_code)]
-    pub fn with_auth(base_url: String, token: String) -> Self {
+    /// Create a new registry client with an explicit auth token.
+    ///
+    /// If `token` is `None`, falls back to AMP_AUTH_TOKEN environment variable.
+    /// Use this when the app's auth state changes (login, logout, refresh).
+    pub fn with_token(base_url: String, token: Option<String>) -> Self {
+        // Use explicit token if provided, otherwise fall back to env var
+        let auth_token = token.or_else(Self::load_auth_from_env);


The docs for new() says, env has highest priority, but its actually used as fallback.

shiyasmohd

Implementation looks nice, and works smooth. Some changes needed

Added in comments
Can we remove the merge commit and rebase the branch?
There is a lag when selecting pane using mouse click, that needs to be fixed

shiyasmohd · 2026-01-22T05:27:22Z

crates/bin/ampcc/src/util.rs

+pub fn is_evm_address(s: &str) -> bool {
+    s.starts_with("0x") && s.parse::<Address>().is_ok()
+}


This can be a simple validation fn instead of importing alloy crate.
s.len() == 42 && s.starts_with("0x") && s[2..].chars().all(|c| c.is_ascii_hexdigit())

shiyasmohd · 2026-01-22T05:59:00Z

crates/bin/ampcc/src/app.rs

+            Action::SwitchToLocal => {
+                if self.current_source != DataSource::Local {
+                    self.start_loading("Switching source...");
+                    // Spawn task to switch source


Comment could be changed to something like, Async spawning handled in handle_async_action

shiyasmohd · 2026-01-22T05:59:22Z

crates/bin/ampcc/src/app.rs

+                    // Spawn task to switch source
+                }


shiyasmohd · 2026-01-22T06:02:16Z

crates/bin/ampcc/src/app.rs

+            // Datasets
+            Action::RefreshDatasets => {
+                self.start_loading("Refreshing datasets...");
+                // Spawn task to refresh datasets


update comment

shiyasmohd · 2026-01-22T06:02:41Z

crates/bin/ampcc/src/app.rs

+            // Manifest
+            Action::LoadManifest => {
+                self.start_loading("Loading manifest...");
+                // Spawn task to load manifest


update comment

shiyasmohd · 2026-01-22T06:07:28Z

crates/bin/ampcc/src/app.rs

+
+            Action::LoadWorkerDetail(_node_id) => {
+                self.start_loading("Loading worker details...");
+                // Spawn task to load worker detail


update comment

shiyasmohd · 2026-01-22T06:08:32Z

crates/bin/ampcc/src/app.rs

+            Action::AuthLogin => {
+                if self.auth_state.is_none() && self.auth_device_flow.is_none() {
+                    self.start_loading("Logging in...");
+                    // Spawn task to start device flow


update comment

shiyasmohd · 2026-01-22T06:19:06Z

crates/bin/ampcc/src/app.rs

+                    let _ = clipboard.set_text(&user_code);
+                }


This could silently ignore copy to clipboard errors and showing users copied to clipboard in auth_screen.rs, could be fixed in another PR.

shiyasmohd · 2026-01-22T06:33:22Z

crates/bin/ampcc/src/app.rs

+            Action::AuthDeviceFlowPoll {
+                device_code,
+                code_verifier,
+                interval,
+                is_first_poll,
+            } => {
+                if let Some(ref mut flow) = self.auth_device_flow {
+                    flow.status = DeviceFlowStatus::Polling;
+                }
+                // Spawn task to poll for token
+                let _ = (device_code, code_verifier, interval, is_first_poll); // Will be used by spawn
+            }


Suggested change

Action::AuthDeviceFlowPoll {

device_code,

code_verifier,

interval,

is_first_poll,

} => {

if let Some(ref mut flow) = self.auth_device_flow {

flow.status = DeviceFlowStatus::Polling;

}

// Spawn task to poll for token

let _ = (device_code, code_verifier, interval, is_first_poll); // Will be used by spawn

}

Action::AuthDeviceFlowPoll { .. } => {

if let Some(ref mut flow) = self.auth_device_flow {

flow.status = DeviceFlowStatus::Polling;

}

// Updated comment with same pattern as others

}

shiyasmohd · 2026-01-22T07:23:05Z

crates/bin/ampcc/src/app.rs

+
+            Action::AuthDeviceFlowConfirm => {
+                if let Some(ref mut flow) = self.auth_device_flow {
+                    let _ = crate::auth::PkceDeviceFlowClient::open_browser(&flow.verification_uri);


We should handle the case, if opening browser fails, maybe like show url in terminal, but we don't support selecting text in tui since we have selecting pane using mouse pointer feature. this needs a discussion.

cmwhited added 3 commits January 20, 2026 12:14

feat(auth flow): add ability to authenticate ampcc if not authenticated

ffa4432

Merge branch 'main' of https://github.com/edgeandnode/amp into chris.…

22b63ec

…whited/ampcc/feat-auth

Merge branch 'main' of https://github.com/edgeandnode/amp into chris.…

ef5f55e

…whited/ampcc/feat-auth

shiyasmohd self-requested a review January 21, 2026 17:08

cmwhited added 2 commits January 21, 2026 07:27

Merge branch 'main' of https://github.com/edgeandnode/amp into chris.…

01a318d

…whited/ampcc/feat-auth

Merge branch 'main' of https://github.com/edgeandnode/amp into chris.…

d7038bc

…whited/ampcc/feat-auth

shiyasmohd reviewed Jan 22, 2026

View reviewed changes

shiyasmohd requested changes Jan 22, 2026

View reviewed changes

feat(auth flow): add ability to authenticate ampcc if not authenticated #1595

Are you sure you want to change the base?

feat(auth flow): add ability to authenticate ampcc if not authenticated #1595

Conversation

cmwhited commented Jan 20, 2026

Description

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

shiyasmohd left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants