Conversation
|
Does the regular ClickHouse binary create a .clickhouse dir? I'm not aware of it doing that, just tried the installer and it doesn't create one. If not, we should revert to .clickhouse. We can think about that decision separately to Auth. |
|
Also, we'll need to make a call on Auth scope. I had deliberately made Auth project-local, so two projects weren't accidentally authd to the same workspace without being intentional. I think this is safer than making Auth global in the users home dir, as agents will likely just see that they have Auth and not question it. |
|
@sdairs makes sense! I've updated the changes to reflect your comments. I do think we should reach out in the I think this change is now reflective of whats required for cloud auth login. The rest of changes need to happen on control-plane. |
|
thanks @kcmannem looking good! before we merge, one thing I want to consider for a moment is the command surface. I'm going to research how some other CLIs structure this. e.g. |
|
Looks like the strip CLI does this too: https://docs.stripe.com/stripe-cli/install#login-account They provide a flag to login that allows you to use tokens with non-human flows |
|
@kcmannem I think I like that direction, seems pretty consistent login (device flow) Thoughts - do we nest under |
sdairs
temporarily deployed
to
cloud-integration
GitHub Actions
Inactive
|
Updated the command structure |
- login (default): OAuth device flow - login --interactive: prompt for API key/secret - login --api-key X --api-secret Y: non-interactive API key login - logout: clears all credentials (tokens + API keys) - Remove standalone "keys" subcommand Update help text, agent context, CLAUDE.md, and README. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
kcmannem
force-pushed
the
add-device-auth
branch
from
abd1a4e to
173685a
Compare
kcmannem
temporarily deployed
to
cloud-integration
GitHub Actions
Inactive
auth_config_for_url used substring matching, so a URL like api.clickhouse.cloud.evil.com would match the production config and cause real OAuth tokens to be sent to an attacker's server. Now uses the url crate to parse and compare the exact hostname. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
sdairs
had a problem deploying
to
cloud-integration
GitHub Actions
Failure
|
pushed a small change, otherwise LGTM can merge when tests pass |
3 participants
I don't know rust. All vibe code
We'll need a better token store strategy as well. Right now its a plaintext json file under
Tokens saved to /Users/k/work/clickhousectl/.clickhouse/tokens.jsonScreen.Recording.2026-03-24.at.3.50.25.PM.mov