fix: use server-returned code in browser URL during login

The CLI was generating its own code client-side and sending it to
/api/auth/cli/start, but the server ignores that and generates its
own code. The CLI then opened the browser with the client-generated
code, which was never stored in the database, causing 'Authorization
Failed - Invalid or expired code' immediately on the /cli-auth page.

Fix: remove client-side code generation. The start endpoint already
returns both code_id and code — parse the code from the response and
use it for both the terminal display and the browser URL.

Fixes #11

Author: fullstackjam

internal/auth/auth.go

@@ -1,10 +1,8 @@
 package auth
 
 import (
-	"crypto/rand"
 	"encoding/json"
 	"fmt"
-	"math/big"
 	"os"
 	"path/filepath"
 	"time"
@@ -90,15 +88,3 @@ func IsAuthenticated() bool {
 	return err == nil && auth != nil
 }
 
-func GenerateCode() (string, error) {
-	const charset = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789"
-	code := make([]byte, 8)
-	for i := range code {
-		n, err := rand.Int(rand.Reader, big.NewInt(int64(len(charset))))
-		if err != nil {
-			return "", fmt.Errorf("generate auth code: %w", err)
-		}
-		code[i] = charset[n.Int64()]
-	}
-	return string(code), nil
-}

internal/auth/auth_test.go

@@ -4,7 +4,6 @@ import (
 	"encoding/json"
 	"os"
 	"path/filepath"
-	"regexp"
 	"testing"
 	"time"
 
@@ -332,43 +331,6 @@ func TestIsAuthenticated_NoToken(t *testing.T) {
 	assert.False(t, IsAuthenticated())
 }
 
-func TestGenerateCode_Length(t *testing.T) {
-	code, err := GenerateCode()
-	require.NoError(t, err)
-	assert.Equal(t, 8, len(code))
-}
-
-func TestGenerateCode_Alphanumeric(t *testing.T) {
-	alphanumericRegex := regexp.MustCompile(`^[ABCDEFGHJKLMNPQRSTUVWXYZ23456789]{8}$`)
-
-	for i := 0; i < 100; i++ {
-		code, err := GenerateCode()
-		require.NoError(t, err)
-		assert.True(t, alphanumericRegex.MatchString(code), "code %s is not alphanumeric", code)
-	}
-}
-
-func TestGenerateCode_Uniqueness(t *testing.T) {
-	codes := make(map[string]bool)
-
-	for i := 0; i < 1000; i++ {
-		code, err := GenerateCode()
-		require.NoError(t, err)
-		assert.False(t, codes[code], "duplicate code generated: %s", code)
-		codes[code] = true
-	}
-
-	assert.Equal(t, 1000, len(codes))
-}
-
-func TestGenerateCode_NoFixedValue(t *testing.T) {
-	code1, err := GenerateCode()
-	require.NoError(t, err)
-	code2, err := GenerateCode()
-	require.NoError(t, err)
-	assert.NotEqual(t, code1, code2)
-}
-
 func TestTokenPath_Format(t *testing.T) {
 	tmpDir := t.TempDir()
 	t.Setenv("HOME", tmpDir)

internal/auth/login.go

@@ -1,7 +1,6 @@
 package auth
 
 import (
-	"bytes"
 	"crypto/tls"
 	"encoding/json"
 	"fmt"
@@ -39,12 +38,9 @@ func GetAPIBase() string {
 	return DefaultAPIBase
 }
 
-type cliStartRequest struct {
-	Code string `json:"code"`
-}
-
 type cliStartResponse struct {
 	CodeID string `json:"code_id"`
+	Code   string `json:"code"`
 }
 
 type cliPollResponse struct {
@@ -55,12 +51,7 @@ type cliPollResponse struct {
 }
 
 func LoginInteractive(apiBase string) (*StoredAuth, error) {
-	code, err := GenerateCode()
-	if err != nil {
-		return nil, err
-	}
-
-	codeID, err := startAuthSession(apiBase, code)
+	codeID, code, err := startAuthSession(apiBase)
 	if err != nil {
 		return nil, err
 	}
@@ -109,34 +100,32 @@ func LoginInteractive(apiBase string) (*StoredAuth, error) {
 	return stored, nil
 }
 
-func startAuthSession(apiBase, code string) (string, error) {
-	body, err := json.Marshal(cliStartRequest{Code: code})
+func startAuthSession(apiBase string) (codeID, code string, err error) {
+	req, err := http.NewRequest("POST", fmt.Sprintf("%s/api/auth/cli/start", apiBase), http.NoBody)
 	if err != nil {
-		return "", fmt.Errorf("marshal start request: %w", err)
+		return "", "", fmt.Errorf("create request: %w", err)
 	}
 
-	req, err := http.NewRequest("POST", fmt.Sprintf("%s/api/auth/cli/start", apiBase), bytes.NewReader(body))
-	if err != nil {
-		return "", fmt.Errorf("create request: %w", err)
-	}
-	req.Header.Set("Content-Type", "application/json")
-
 	resp, err := httpClient.Do(req)
 	if err != nil {
-		return "", fmt.Errorf("start auth session: %w", err)
+		return "", "", fmt.Errorf("start auth session: %w", err)
 	}
 	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusOK {
-		return "", fmt.Errorf("auth start failed with status %d", resp.StatusCode)
+		return "", "", fmt.Errorf("auth start failed with status %d", resp.StatusCode)
 	}
 
 	var result cliStartResponse
 	if err := json.NewDecoder(io.LimitReader(resp.Body, 1<<20)).Decode(&result); err != nil {
-		return "", fmt.Errorf("parse auth response: %w", err)
+		return "", "", fmt.Errorf("parse auth response: %w", err)
+	}
+
+	if result.CodeID == "" || result.Code == "" {
+		return "", "", fmt.Errorf("server returned incomplete auth session")
 	}
 
-	return result.CodeID, nil
+	return result.CodeID, result.Code, nil
 }
 
 // pollTimeout and pollInterval are package-level defaults, overridable in tests.