From 8e6d29f1806cc569b48d913564c7d80a1c2f2355 Mon Sep 17 00:00:00 2001
From: Christian Cleberg <hello@cleberg.net>
Date: Fri, 17 Jul 2026 17:04:15 -0500
Subject: Replace env-var PAT with GitHub device authorization flow + Keychain
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes #6, #7 (milestone 0.4.0).

- GitHubDeviceAuthClient implements the OAuth 2.0 device authorization
  grant (device code request + poll for token) against GitHub's OAuth
  App endpoints. Verified against the real endpoints directly.
- KeychainTokenStore stores the resulting token in the app's own
  Keychain item (not synced to iCloud Keychain), no shared entitlement
  needed since nothing else reads it.
- AuthStore drives the sign-in state machine (signedOut /
  awaitingAuthorization / signedIn) and a new SignInView replaces the
  old "missing token" error state with an actual sign-in UI.
- SecurityEventStore now reads the token from Keychain instead of the
  GITHUB_TOKEN environment variable, which is fully retired.
- Scope requested is security_events, the narrowest available for
  classic OAuth Apps (no read-only variant exists at this level, unlike
  fine-grained PATs). Private-repo Dependabot alerts may need broader
  repo scope — to be confirmed with real-world testing.
---
 octosentry/AuthStore.swift | 60 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)
 create mode 100644 octosentry/AuthStore.swift

(limited to 'octosentry/AuthStore.swift')

diff --git a/octosentry/AuthStore.swift b/octosentry/AuthStore.swift
new file mode 100644
index 0000000..4386e38
--- /dev/null
+++ b/octosentry/AuthStore.swift
@@ -0,0 +1,60 @@
+//
+//  AuthStore.swift
+//  octosentry
+//
+//  Drives the device authorization flow and mirrors whether a token is
+//  currently in the Keychain. Replaces the GITHUB_TOKEN env var dev
+//  shortcut (spec §13) with the real v1 auth flow (spec §6).
+//
+
+import Foundation
+import Observation
+
+@Observable
+final class AuthStore {
+    private(set) var state: AuthState
+    private(set) var errorMessage: String?
+
+    private let client = GitHubDeviceAuthClient()
+    private var authorizationTask: Task<Void, Never>?
+
+    init() {
+        state = KeychainTokenStore.load() != nil ? .signedIn : .signedOut
+    }
+
+    var isSignedIn: Bool {
+        if case .signedIn = state { return true }
+        return false
+    }
+
+    func signIn() {
+        guard authorizationTask == nil else { return }
+        errorMessage = nil
+
+        authorizationTask = Task {
+            defer { authorizationTask = nil }
+            do {
+                let deviceCode = try await client.requestDeviceCode()
+                state = .awaitingAuthorization(userCode: deviceCode.userCode, verificationURL: deviceCode.verificationUri)
+
+                let token = try await client.pollForToken(
+                    deviceCode: deviceCode.deviceCode,
+                    interval: deviceCode.interval,
+                    expiresIn: deviceCode.expiresIn
+                )
+                try KeychainTokenStore.save(token)
+                state = .signedIn
+            } catch {
+                errorMessage = (error as? LocalizedError)?.errorDescription ?? error.localizedDescription
+                state = .signedOut
+            }
+        }
+    }
+
+    func signOut() {
+        authorizationTask?.cancel()
+        authorizationTask = nil
+        KeychainTokenStore.delete()
+        state = .signedOut
+    }
+}
-- 
cgit v1.2.3