feat: browser-based OAuth login flow (story 406)

Add three HTTP endpoints for OAuth login without terminal access:
- GET /oauth/authorize — generates PKCE params, redirects to
  claude.com/cai/oauth/authorize with code=true and full scopes
- GET /callback — exchanges auth code for tokens via JSON POST to
  platform.claude.com/v1/oauth/token, writes ~/.claude/.credentials.json
- GET /oauth/status — returns current credential state as JSON

Uses SHA-256 (sha2 crate) for PKCE code challenge. The authorize URL
targets claude.com/cai/ (not platform.claude.com) which is required
for Max/Pro subscriptions to grant user:inference scope.

Users visit http://localhost:3001/oauth/authorize in their browser
to authenticate. Matrix/WhatsApp can send this link when auth fails.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

This commit is contained in:

Timmy

2026-03-26 19:58:18 +00:00

parent 710b604b7c

commit 877f69c897

6 changed files with 472 additions and 0 deletions

									
										Cargo.toml
									
		+1
		
												View File
												
				@@ -21,6 +21,7 @@ rust-embed = "8"

				serde = { version = "1", features = ["derive"] }

				serde_json = "1"

				serde_urlencoded = "0.7"

				sha2 = "0.10"

				serde_yaml = "0.9"

				strip-ansi-escapes = "0.2"

				tempfile = "3"