From 3f2ad8bf059d8a3cea0bd7a9cfbf1c8d51dab39b Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Mon, 19 Oct 2026 16:29:00 +0200 Subject: [PATCH] internal/oauth: avoid opening browser after login cancellation Check the context after reading stdin to avoid launching the browser if login was canceled while waiting for ENTER. Signed-off-by: Sebastiaan van Stijn --- internal/oauth/manager/manager.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/internal/oauth/manager/manager.go b/internal/oauth/manager/manager.go index 96deb61b13..63af81128f 100644 --- a/internal/oauth/manager/manager.go +++ b/internal/oauth/manager/manager.go @@ -83,6 +83,9 @@ var ErrDeviceLoginStartFail = errors.New("failed to start device code flow login // The retrieved tokens are stored in the credentials store (under a separate // key), and the refresh token is concatenated with the client ID. func (m *OAuthManager) LoginDevice(ctx context.Context, w io.Writer) (*types.AuthConfig, error) { + ctx, cancel := context.WithCancel(ctx) + defer cancel() + state, err := m.api.GetDeviceCode(ctx, m.audience) if err != nil { logrus.Debugf("failed to start device code login: %v", err) @@ -120,7 +123,9 @@ func (m *OAuthManager) LoginDevice(ctx context.Context, w io.Writer) (*types.Aut go func() { reader := bufio.NewReader(os.Stdin) - _, _ = reader.ReadString('\n') + if _, err := reader.ReadString('\n'); err != nil || ctx.Err() != nil { + return + } _ = m.openBrowser(state.VerificationURI) }()