Skip to content

feat(plugin-obsessiondb): auth + remote backfill routing#102

Merged
KeKs0r merged 4 commits intomainfrom
marc/obsessiondb-plugin-auth
Mar 29, 2026
Merged

feat(plugin-obsessiondb): auth + remote backfill routing#102
KeKs0r merged 4 commits intomainfrom
marc/obsessiondb-plugin-auth

Conversation

@KeKs0r
Copy link
Copy Markdown
Contributor

@KeKs0r KeKs0r commented Mar 29, 2026

Summary

  • Add onBeforePluginCommand hook to the CLI plugin system, allowing plugins to intercept other plugins' commands before execution
  • Implement device-code authentication (RFC 8628) against the ObsessionDB console-api with login, logout, and whoami commands
  • Add remote backfill routing — when authenticated, backfill commands (plan, run, resume, status, cancel, doctor) transparently route to the ObsessionDB backend
  • Support --local flag to bypass remote routing and OBSESSIONDB_API_URL env var for targeting different API instances
  • Credentials stored securely at $XDG_CONFIG_HOME/chkit/credentials.json with 0o600 permissions, scoped to the API instance used at login time

Test plan

  • bun verify passes (typecheck, lint, test, build)
  • Unit tests for onBeforePluginCommand hook dispatch (handled/unhandled/self-skip/context passing)
  • Unit tests for credential storage (write/read/delete, XDG_CONFIG_HOME)
  • Unit tests for device-code polling (pending → success, slow_down, access_denied, expired_token)
  • Unit tests for backfill handler routing (auth check, --local bypass, command mapping, 401 handling)
  • Integration test: real obsessiondb plugin intercepts backfill commands through onBeforePluginCommand hook
  • Manual: chkit obsessiondb login against staging console-api (once platform side is ready)

🤖 Generated with Claude Code

KeKs0r and others added 4 commits March 29, 2026 09:23
Add device-code authentication (login/logout/whoami) and onBeforePluginCommand
hook to intercept backfill commands. When authenticated, backfill commands
transparently route to the ObsessionDB backend; --local flag bypasses routing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…local backfill

When the obsessiondb plugin is installed, unauthenticated backfill commands
now print a login prompt and exit 1 instead of silently falling through to
local execution. Only --local explicitly opts into local mode.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ove dead branch

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Stop sending the full ResolvedChxConfig (which may contain ClickHouse
credentials) to the ObsessionDB API. The backend resolves its own
ClickHouse credentials; only the auth token, command, args, and flags
are needed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@KeKs0r KeKs0r merged commit f1066a6 into main Mar 29, 2026
2 checks passed
@KeKs0r KeKs0r deleted the marc/obsessiondb-plugin-auth branch March 29, 2026 07:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant