feat(cli): add browser-assisted login and logout flow

[maciej-flexcompute]

Summary

• add browser-assisted flow360 login and flow360 logout for Flow360 CLI auth
• update the localhost callback flow to match the merged frontend handoff on flow360.dev-simulation.cloud
• support encrypted browser->CLI handoff payloads with P-256 ECDH + HKDF + AES-GCM
• keep the CLI branch scoped to login/auth flow files only

What changed

The CLI login callback server now supports:

• encrypted query callbacks via payload + epk + iv
• plaintext query callbacks for fallback/testing
• form-encoded POST callbacks
• browser-facing success/error pages on the localhost callback

The CLI login command also now prints a manual fallback hint for headless environments:

• flow360 configure ... --apikey <apikey>

Why it changed

The frontend handoff now delivers an encrypted localhost callback payload, so the CLI needs to:

• generate a one-time callback public key
• advertise the callback encryption algorithm in the login URL
• decrypt the localhost callback payload before storing the API key

Security notes

This improves the current flow by removing the plaintext API key from the callback URL and normal browser history.

It does not fully eliminate plaintext exposure inside the browser page itself, because the page still receives the API key before encrypting it for the localhost callback. A future one-time backend code exchange would still be stronger.

Verification

python -m pytest tests/v1/test_cli_login.py -q

Result: 10 passed

start screen:

success:

---

Note

Medium Risk
Adds new CLI auth flows that spin up a local HTTP callback server and process (including decrypt) browser handoff payloads, plus changes how API keys are stored/removed; mistakes here could break login or leak credentials.

Overview
Adds browser-assisted authentication to the CLI via new flow360 login/flow360 logout commands. login starts a localhost callback server, opens a web login URL, accepts GET/POST callback payloads (optionally encrypted via P-256 ECDH + HKDF + AES-GCM), and stores the returned API key; logout removes a stored key for the selected profile/environment and reports when none exists.

Refactors config persistence into user_config helpers (read_user_config/write_user_config/store_apikey/delete_apikey) and updates configure to use them with centralized environment flag validation. Config directory/file permissions are now best-effort hardened (0700/0600), and tests are added/updated to cover configure/logout and login callback variants (plaintext, form-encoded, encrypted, and error paths).

^{Reviewed by Cursor Bugbot for commit 8ec9150. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit acd46bd. Configure here.}

[github-actions]

Coverage report (flow360)

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
flow360
user_config.py					24-25, 139
flow360/cli
api_set_func.py
app.py					25-26, 77-80, 83-84, 89, 146, 162-163
auth.py					46, 49, 54, 56, 142, 162, 164, 169, 180, 311-312, 323-324, 328, 332-339, 345-346, 369-370, 374-375, 380-384, 388-393, 455, 466
auth_guidance.py					12-16, 21-27, 37
Project Total

This report was generated by python-coverage-comment-action