Replace password based auth with oauth device flow (#1085)

Author: ericmj

.github/workflows/main.yml

@@ -62,6 +62,7 @@ jobs:
     env:
       HEXPM_OTP: OTP-28.1
       HEXPM_ELIXIR: v1.18.4
+      HEXPM_BRANCH: main
       HEXPM_PATH: hexpm
       HEXPM_ELIXIR_PATH: hexpm_elixir
       HEXPM_OTP_PATH: hexpm_otp
@@ -92,7 +93,7 @@ jobs:
 
       - name: Set up hexpm
         run: |
-          git clone https://github.com/hexpm/hexpm.git hexpm
+          git clone -b ${HEXPM_BRANCH} https://github.com/hexpm/hexpm.git hexpm
           cd hexpm; PATH=$(pwd)/../${HEXPM_ELIXIR_PATH}/bin:$(pwd)/../${HEXPM_OTP_PATH}/bin:${PATH} MIX_HOME=$(pwd)/../${HEXPM_MIX_HOME} MIX_ARCHIVES=$(pwd)/../${HEXPM_MIX_HOME} MIX_ENV=hex ../${HEXPM_ELIXIR_PATH}/bin/mix deps.get; cd ..
           cd hexpm; PATH=$(pwd)/../${HEXPM_ELIXIR_PATH}/bin:$(pwd)/../${HEXPM_OTP_PATH}/bin:${PATH} MIX_HOME=$(pwd)/../${HEXPM_MIX_HOME} MIX_ARCHIVES=$(pwd)/../${HEXPM_MIX_HOME} MIX_ENV=hex ../${HEXPM_ELIXIR_PATH}/bin/mix compile; cd ..
 

config/config.exs

@@ -1,6 +1,6 @@
 import Config
 
 if config_env() == :test do
-  config :logger, level: :warn
+  config :logger, level: :warning
   config :logger, :console, format: "$date $time [$level] $message\n"
 end

lib/hex/api/client.ex

@@ -18,7 +18,9 @@ defmodule Hex.API.Client do
   defp maybe_put_api_key(config, opts) do
     cond do
       opts[:key] ->
-        Map.put(config, :api_key, opts[:key])
+        # Add Bearer prefix only for OAuth tokens
+        token = if opts[:oauth], do: "Bearer #{opts[:key]}", else: opts[:key]
+        Map.put(config, :api_key, token)
 
       opts[:user] && opts[:pass] ->
         # For basic auth, add it as an HTTP header

lib/hex/api/oauth.ex

@@ -0,0 +1,98 @@
+defmodule Hex.API.OAuth do
+  @moduledoc false
+
+  alias Hex.API.Client
+
+  @client_id "78ea6566-89fd-481e-a1d6-7d9d78eacca8"
+
+  @doc """
+  Initiates the OAuth device authorization flow.
+
+  Returns device code, user code, and verification URIs for user authentication.
+  Optionally accepts a name parameter to identify the token.
+
+  ## Examples
+
+      iex> Hex.API.OAuth.device_authorization("api")
+      {:ok, {200, _headers, %{
+        "device_code" => "...",
+        "user_code" => "ABCD-1234",
+        "verification_uri" => "https://hex.pm/oauth/device",
+        "verification_uri_complete" => "https://hex.pm/oauth/device?user_code=ABCD-1234",
+        "expires_in" => 600,
+        "interval" => 5
+      }}}
+  """
+  def device_authorization(scopes, name \\ nil) do
+    config = Client.config()
+    opts = if name, do: [name: name], else: []
+    :mix_hex_api_oauth.device_authorization(config, @client_id, scopes, opts)
+  end
+
+  @doc """
+  Polls the OAuth token endpoint for device authorization completion.
+
+  ## Examples
+
+      iex> Hex.API.OAuth.poll_device_token(device_code)
+      {:ok, {200, _headers, %{
+        "access_token" => "...",
+        "refresh_token" => "...",
+        "token_type" => "Bearer",
+        "expires_in" => 3600
+      }}}
+  """
+  def poll_device_token(device_code) do
+    config = Client.config()
+    :mix_hex_api_oauth.poll_device_token(config, @client_id, device_code)
+  end
+
+  @doc """
+  Exchanges a token for a new token with different scopes using RFC 8693 token exchange.
+
+  ## Examples
+
+      iex> Hex.API.OAuth.exchange_token(subject_token, "api:write")
+      {:ok, {200, _headers, %{
+        "access_token" => "...",
+        "refresh_token" => "...",
+        "token_type" => "Bearer",
+        "expires_in" => 3600
+      }}}
+  """
+  def exchange_token(subject_token, scope) do
+    config = Client.config()
+    :mix_hex_api_oauth.exchange_token(config, @client_id, subject_token, scope)
+  end
+
+  @doc """
+  Refreshes an access token using a refresh token.
+
+  ## Examples
+
+      iex> Hex.API.OAuth.refresh_token(refresh_token)
+      {:ok, {200, _headers, %{
+        "access_token" => "...",
+        "refresh_token" => "...",
+        "token_type" => "Bearer",
+        "expires_in" => 3600
+      }}}
+  """
+  def refresh_token(refresh_token) do
+    config = Client.config()
+    :mix_hex_api_oauth.refresh_token(config, @client_id, refresh_token)
+  end
+
+  @doc """
+  Revokes an OAuth token (access or refresh token).
+
+  ## Examples
+
+      iex> Hex.API.OAuth.revoke_token(token)
+      {:ok, {200, _headers, nil}}
+  """
+  def revoke_token(token) do
+    config = Client.config()
+    :mix_hex_api_oauth.revoke_token(config, @client_id, token)
+  end
+end