[FEATURE] Support Oauth remote device flow for headless environments

[ubiratansoares]

Is your feature request related to a problem?

I want to run the Oauth flow within a remote environment without access to a web browser. This is currently listed as an enhancement for the Oauth2 auth.

Describe the solution you'd like

After running pup auth login (within a remote environment) I want to get a URL that I'll follow inside my local box. Optionally, the auth flow should check and confirm whether I'm logging from pup at some point.

After a successful login, I expect the web browser to show me a message like

"pup vx.y.z was successful authorized, you can now close this tab.

and pup should be ready to use without any redirects to a local web server.

Describe alternatives you've considered

The alternatives here are PATs or API Keys, but having a Oauth device flow would bring to pup feature parity between with other CLIs that I use in the same remote environment.

Additional context

I think that aws-cli offers a experience similar to what I want for pup

Proposed command syntax (if applicable)

pup auth login --remote-device

or alternatively

pup auth login --no-browser

[srosenthal-dd]

Hi @ubiratansoares, thanks for filing this! Headless/remote-box OAuth is a real gap and worth closing.

We shipped a partial solution in #465. When pup auth login can't open a local browser (SSH session, headless container), it prints the auth URL and asks you to open it on any machine that has a browser. After you authorize, the redirect will fail to load on that machine since there's no listener there. You copy the failed redirect URL from the address bar and paste it back into the pup process on the remote box, and login completes from that.

This is available today and doesn't need any server-side changes. It's not full OAuth2 device flow though. Device flow would give you a short code and a "waiting for authorization" spinner instead of a manual paste step.

Before scoping a full device-flow implementation: does the #465 approach work for your environment, or is there something about your setup that makes copying the redirect URL back impractical? Want to make sure we're solving the actual blocker.

[ubiratansoares]

@srosenthal-dd Thanks for the heads up!

The partial fix helps! To me it feels less convenient than the full Oauth2 device flow, especially because I may want to spin up different boxes during the day, and to authorize pup I have to copy + paste the redirect URL everytime (and eventually an API Key is an way get rid of copying + pasting 😂). But yes, for sure it's not impractical.

[srosenthal-dd]

Thanks for the discussion! A proper device flow is definitely something we're considering, but it's a bigger project because it requires both server-side updates (Datadog doesn't yet do any device flows) and pup client side updates. I hope we get to it pretty soon, but we don't have any specific commitment or target date.