Merge pull request #4092 from Shopify/device-auth-by-default

Make device auth the default authentication method
Shopify · Jul 5, 2024 · 140868e · 140868e
2 parents e1960f4 + f76debd
commit 140868e
Show file tree

Hide file tree

Showing 5 changed files with 28 additions and 3 deletions.
diff --git a/.changeset/chilly-walls-exist.md b/.changeset/chilly-walls-exist.md
@@ -0,0 +1,5 @@
+---
+'@shopify/cli-kit': minor
+---
+
+Device auth is the default authentication method
diff --git a/packages/cli-kit/src/private/node/constants.ts b/packages/cli-kit/src/private/node/constants.ts
@@ -16,6 +16,7 @@ export const environmentVariables = {
   alwaysLogAnalytics: 'SHOPIFY_CLI_ALWAYS_LOG_ANALYTICS',
   alwaysLogMetrics: 'SHOPIFY_CLI_ALWAYS_LOG_METRICS',
   deviceAuth: 'SHOPIFY_CLI_DEVICE_AUTH',
+  accessCodeAuth: 'SHOPIFY_CLI_ACCESS_CODE_AUTH',
   enableCliRedirect: 'SHOPIFY_CLI_ENABLE_CLI_REDIRECT',
   env: 'SHOPIFY_CLI_ENV',
   firstPartyDev: 'SHOPIFY_CLI_1P_DEV',

diff --git a/packages/cli-kit/src/public/node/context/local.test.ts b/packages/cli-kit/src/public/node/context/local.test.ts
@@ -191,13 +191,26 @@ describe('useDeviceAuth', () => {
     expect(got).toBe(true)
   })
 
-  test('returns false when SHOPIFY_CLI_DEVICE_AUTH, SPIN, CODESPACES or GITPOD_WORKSPACE_URL are missing', () => {
+  test('returns true by default', () => {
     // Given
     const env = {}
 
     // When
     const got = useDeviceAuth(env)
 
+    // Then
+    expect(got).toBe(true)
+  })
+
+  test('returns false if opted-out', () => {
+    // Given
+    const env = {
+      SHOPIFY_CLI_ACCESS_CODE_AUTH: '1',
+    }
+
+    // When
+    const got = useDeviceAuth(env)
+
     // Then
     expect(got).toBe(false)
   })

diff --git a/packages/cli-kit/src/public/node/context/local.ts b/packages/cli-kit/src/public/node/context/local.ts
@@ -116,11 +116,17 @@ export function firstPartyDev(env = process.env): boolean {
 /**
  * Returns true if the CLI should use device auth.
  *
+ * Device auth can be opted out by using SHOPIFY_CLI_ACCESS_CODE_AUTH.
+ *
  * @param env - The environment variables from the environment of the current process.
  * @returns True if SHOPIFY_CLI_DEVICE_AUTH is truthy or the CLI is run from a cloud environment.
  */
 export function useDeviceAuth(env = process.env): boolean {
-  return isTruthy(env[environmentVariables.deviceAuth]) || isCloudEnvironment(env)
+  return (
+    !isTruthy(env[environmentVariables.accessCodeAuth]) ||
+    isTruthy(env[environmentVariables.deviceAuth]) ||
+    isCloudEnvironment(env)
+  )
 }
 
 /**

diff --git a/packages/cli-kit/src/public/node/environment.ts b/packages/cli-kit/src/public/node/environment.ts
@@ -55,7 +55,7 @@ export function getBackendPort(): number | undefined {
 }
 
 /**
- * Returns the information of the identity token.
+ * Returns the information of the identity & refresh tokens, provided by environment variables.
  *
  * @returns The identity token information in case it exists.
  */