Streamline morning-auth.sh + respect $BROWSER (JumpCloud Go-aware)#116
Open
SethPaul wants to merge 2 commits into
Open
Streamline morning-auth.sh + respect $BROWSER (JumpCloud Go-aware)#116SethPaul wants to merge 2 commits into
SethPaul wants to merge 2 commits into
Conversation
Combines #43 ($BROWSER support) with a JumpCloud Go-aware simplification. `aws sso login` already drives the JumpCloud login in the browser -- a Go device tap if set up, otherwise the normal password + MFA form (verified both paths). So the manual logout -> open-login-page -> "press Enter" block was redundant; this removes it. Flow is now: version check -> session short-circuit -> (optional) logout -> aws sso login -> verify -> CodeArtifact. - Respect $BROWSER for the logout open and (via env) aws sso login, so the right browser is used (supersedes #43; also handles the %s placeholder form). - Non-blocking heads-up if the resolved browser is snap/flatpak (Go can't run there -- you get the password form, which works fine). - --no-logout to reuse an existing JumpCloud session. Works whether or not JumpCloud Go is set up. Wiki: https://github.com/hipponot/nimbee/wiki/JumpCloud-Go-Setup
Vetting surfaced gaps in warn_if_sandboxed_browser: it only knew the hardcoded firefox/chromium snap desktop-ids and did path-only checks. Now it detects any name_name.desktop snap id generically and resolves the xdg default's Exec= binary (via awk, no grep dependency) before the /snap and /flatpak path check. Tested against the real deb google-chrome/chromium/firefox (no false positives) and /snap/bin/chromium (correctly flagged). Dropped an earlier file(1)+grep content heuristic as too fragile; the snap /usr/bin/firefox wrapper-shim case stays a documented, accepted blind spot (advisory only -- the login works regardless).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Combines @jcward's #43 (respect
$BROWSER) with a JumpCloud Go-aware simplification. Supersedes #43 — can close that in favor of this.What changed
aws sso loginalready drives the JumpCloud login in the browser itself — a JumpCloud Go device tap if Go is set up, otherwise the normal JumpCloud password + MFA form. So the old manual block (log out → open login page → blocking "press Enter" → thenaws sso login) was redundant.New flow: version check → AWS-session short-circuit → (optional) logout →
aws sso login→ verify → CodeArtifact.$BROWSERrespected (from Update morning-auth.sh to respect BROWSER #43) for the logout open, andaws sso logininherits it from the env — so the right browser is used. Also handles the%splaceholder form the env var can take.readblock — fewer steps for everyone, no blocking prompt.--no-logoutto reuse an existing JumpCloud session.BROWSER=google-chrome+ the setup wiki.Works with and without JumpCloud Go
This was the design constraint — we can't assume everyone has set Go up:
aws sso login→ one device tap.aws sso login→ JumpCloud password + MFA, inline.Both verified on this machine (the non-Go path tested via snap Chromium, which can't use Go and behaves like a non-Go user — it served password+MFA inline and completed).
Notes
SC2155warnings inget_sso_expiryleft untouched to keep the diff focused.