Summary#
osyrin login --server https://osyrin.app opens your browser on Osyrin's sign-in page. You sign in there, with your
password and two-step code, or with GitHub or Google where that Osyrin offers them, and the terminal says
Logged in as …. The sign-in is kept in ~/.osyrin/credentials.json, and every other command uses it without asking
for anything.
Signature#
osyrin login --server <url> # in the browser (the default)
osyrin login --server <url> --no-browser # typed here: email, password, and a code if your account has one
osyrin login --server <url> --email <e> --password <p> [--code <c>] # typed, from a scriptDescription#
In the browser by default. osyrin login listens on 127.0.0.1, on a port the system picks, and opens the browser
at the server's sign-in with that address to come back to. It also prints the address, so if no browser opened you can
open it yourself. Once you have signed in, the browser goes back to the program, the terminal says who you are, and the
tab says you can close it. The program waits ten minutes; after that it stops listening and says so.
Typed, when there is no browser. --no-browser asks for your email and password in the terminal, and for the code
from your authenticator app if your account has two-step sign-in. Passing --email or --password does the same
without asking, which is how a script signs in.
One sign-in rule. Both ways give the same sign-in. It stays signed in while you work and also while you do not: it
ends 12 hours after you signed in, or when you sign out (osyrin logout), whichever comes first. A browser tab on the
same Osyrin is signed out after an hour without use; a sign-in from this program is not, so a long release run can sit
quiet for an hour and carry on. osyrin whoami prints when the sign-in ends.
osyrin logout asks Osyrin to end the sign-in first, then forgets it on this computer, so a copy of the old ticket is refused
from then on. If Osyrin cannot be reached the sign-in is forgotten here anyway and the command says Osyrin was not told (it
ends by itself within 12 hours). It signs out the tools on this computer only: a browser tab stays signed in, since that is a
separate sign-in. Studio's Sign out runs it.
What the browser sign-in protects. It is an OAuth 2.1 sign-in for a program on your computer (RFC 8252):
| where the result can go | only to http://127.0.0.1:<port> or http://[::1]:<port>. Osyrin refuses any other address for this sign-in |
| who can use the result | only this run of the program. It holds a secret whose hash it sent at the start (PKCE), and the result is useless without it |
| a result that is not its own | refused. Each run sends a random value and accepts only an answer that carries it back |
| how often | once. The result is good for two minutes and one exchange; a second try is refused |
| the listener | answers one sign-in, then closes. It listens on 127.0.0.1 only, never on the network |
The page you sign in on hands its result only to a program on the same computer. It completes no sign-in for an address anywhere else, so a link someone sends you cannot sign you in on their behalf.
From Studio. Settings and the Publish sheet have Sign in to Osyrin, which runs osyrin login in the background
with no window of its own. The browser opens on Osyrin's sign-in, and Studio notices by itself when you are signed in.
If no browser opened, Studio shows the address to open.
Against a local platform there is nobody to sign in: the person at the keyboard is the platform's admin, and
osyrin login says so and succeeds.
Examples#
osyrin login --server https://osyrin.app
# Your browser opened Osyrin's sign-in. If it did not, open this address to sign in:
# https://admin.osyrin.app/oauth/authorize?response_type=code&client_id=osyrin-cli&redirect_uri=http%3A%2F%2F127.0.0.1%3A53111%2Fcallback&…
# ✓ Logged in as [email protected] on https://osyrin.app
osyrin login --server https://osyrin.app --no-browser # over SSH: asks for the email, the password and the code
osyrin whoami --server https://osyrin.app # who, and when this sign-in ends
osyrin logout --server https://osyrin.appSee also#
Publishing a project to Osyrin — what you sign in for: putting a project on Osyrin.
Opening Studio — Studio, whose Settings has Sign in to Osyrin.
Deploying your app to an environment — a deploy, which uses the sign-in this keeps.