[itssimon]

Summary

Browser-based apitally auth fails in Safari: WebKit blocks any http:// subresource request from an https:// page as mixed content, including http://127.0.0.1 (WebKit bug 171934). Chrome also gates it behind a Local Network Access permission prompt. Top-level form navigations are not subject to mixed-content blocking, so the callback transport changes from a cross-origin fetch() to a form POST.

Requires the matching dashboard change to be deployed first.

Changes

• The CLI opens {app_url}/cli-auth?callback_port=<port>&callback_mode=form.
• The callback server accepts POST /callback with an application/x-www-form-urlencoded body containing api_key:
  • On success it responds 303 See Other with Location: {app_url}/cli-auth/success and stops listening.
  • A POST without api_key gets 400 Bad Request and the server keeps listening.
• The request is read until the full body has arrived according to Content-Length (capped at 64 KiB), instead of a single read().
• JSON body parsing and CORS handling (OPTIONS preflight, Access-Control-* headers) are removed.
• Over SSH (SSH_CONNECTION or SSH_TTY set), the browser cannot reach the CLI's loopback server, so no callback server is started. The CLI opens {app_url}/cli-auth without query parameters and waits for the API key to be pasted. Without an interactive terminal it fails immediately, pointing to --api-key / APITALLY_API_KEY.
• Adds form_urlencoded as a direct dependency (already in the lock file via mockito).

Testing

• Updated test_run_with_callback for the form POST protocol, including headers and body arriving in separate writes.
• Manual end-to-end check with curl against the built binary (303 + Location, 400 without api_key, auth.json written).
• Manual check of both SSH paths (fails fast without a terminal; with a terminal no port is bound and the pasted key is saved).

[cubic-dev-ai]

All reported issues were addressed across 3 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[codecov]

Codecov Report

❌ Patch coverage is 87.71930% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 91.44%. Comparing base (03a79e7) to head (15eb969).

Files with missing lines	Patch %	Lines
src/auth.rs	87.71%	7 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #86      +/-   ##
==========================================
- Coverage   91.67%   91.44%   -0.23%     
==========================================
  Files          13       13              
  Lines        2523     2538      +15     
==========================================
+ Hits         2313     2321       +8     
- Misses        210      217       +7     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.