oh signs in through oxy's credential store; pin oxygen with oxy auth and remote bookmarks (refs andymccall/oxygen#47, #48) 2bbe88a85860

## Unreleased

- **Device tokens expire, and the approval page says where a request came from (#70).** A token from device sign-in lasts 90 days past its last use; Settings → Tokens shows its expiry, renewed on use. The `/device` page shows when the code was asked for and from which address (the client's, through the proxy when `behind_proxy` is set), and warns to approve only a code you started yourself. `DELETE /api/v1/user/token` revokes the token it is called with, which `oxy auth logout` uses.

- **Device sign-in (#67).** An app gets a token without a pasted secret. It asks `/api/v1/device/code` for a code and shows it; you approve the code at `/device`, signed in with your second factor, choosing what the app may do; its next poll gets the token. `oh auth login` signs in this way; `--token` still takes a token.

    std::env::remove_var("OXY_TOKEN");

    assert!(ok);

    // Linking a key: upload the identity, sign the challenge, see attribution.

    let (key, identity) = {

        let k = client.config.author_key.unwrap();

    let app = client(&format!("{}/andy/app", h.base), work.path());

    app.submodule_add(&format!("{}/andy/lib", h.base), "deps/lib", Some("main")).unwrap();

    // Vault is private: a checkout with no token for this hub cannot add

    sqlx::query("UPDATE repositories SET visibility = 'private' WHERE name = 'vault'").execute(&h.app.db).await.unwrap();

    let bare_work = tempfile::tempdir().unwrap();

    let mut bare = Repo::init(bare_work.path()).unwrap();

    assert!(bare.submodule_add(&format!("{}/andy/vault", h.base), "deps/vault", Some("main")).is_err(), "not without a token");

    app.submodule_add(&format!("{}/andy/vault", h.base), "deps/vault", Some("main")).unwrap();

    let nested = Repo::open(&work.path().join("deps/vault")).unwrap();

    // The pusher below is the site token, which has no account: it cannot read vault.

    write(work.path(), ".flow/pipeline.kdl", &pipeline(""));

    write(work.path(), "Makefile", "all:\n");

use client::Client;

use hub_api::{FlowLogLine, FlowRun, Issue, IssueStateChange, NewComment, NewIssue, NewProposal, NewRelease, Proposal, Release};

use std::time::Duration;

#[derive(Parser)]

#[command(name = "oh", version = env!("OXY_VERSION_LONG"), about = "OxygenHub from the command line: issues, proposals, Flow runs and releases")]

    }

    let t = Target { hub: hub.clone(), token: Some(token.clone()), ca: ca.clone(), owner: String::new(), name: String::new() };

    let me: serde_json::Value = Client::new(&t)?.get("/user").context("checking the token")?;

    cfg.default_hub = Some(hub.clone());

    cfg.save()?;

    Ok(0)

}

use anyhow::{anyhow, bail, Context, Result};

use serde::{Deserialize, Serialize};

use std::path::{Path, PathBuf};

#[derive(Debug, Default, Serialize, Deserialize)]

pub struct Config {

    #[serde(default)]

    pub default_hub: Option<String>,

}

pub struct Host {

    pub token: String,

    pub ca: Option<PathBuf>,

}

pub fn config_path() -> Result<PathBuf> {

pub fn resolve(choice: &Choice, dir: &Path, cfg: &Config) -> Result<Target> {

    let env_token = std::env::var("OH_TOKEN").ok().or_else(|| std::env::var("OXY_TOKEN").ok()).filter(|t| !t.is_empty());

    let env_ca = std::env::var_os("OXY_CA").map(PathBuf::from);

    if let Some(r) = choice.repo {

        let (owner, name) = r.split_once('/').ok_or_else(|| anyhow!("--repo takes OWNER/NAME"))?;

        let hub = choice