Skip to main content

User Account and Web CLI Login

This section covers the operator's personal profile dashboard (/account) and the secure browser-based authorization gateway invoked by tk-ota-push login (/cli/login).

1. Operator Profile Dashboard (/account)​

Accessible via the user avatar or directly at /account (src/app/account/page.tsx), this screen aggregates identity details and live platform security indicators:

My Account Page Features
  • Identity & Role: Displays user name, email, active tenant organization, and RBAC permission role.
  • Personal API Keys: Create and revoke programmatic tokens for CLI usage and CI/CD automation.
  • Account Security: Password management and Two-Factor Authentication (2FA) controls.
CLI Browser Authorization Flow
  1. Developer runs tk-ota-push login in their terminal.
  2. Web browser opens to the authorization screen in the Web Console.
  3. User approves access for the CLI session.
  4. CLI receives the secure session token and completes sign-in.

Dashboard Indicators​

  • Role Badge: Visual indicator of the active privilege set (ROLE_ADMIN, ROLE_RELEASE_DEVELOPER, etc.).
  • Signing engine status Light: Live readiness state of cryptographic signing engine's cryptographic signing subsystem.
  • Active Governance: Reflects whether strict Four-Eyes dual-custody is currently enforced for the tenant.
  • Audit Counter: Total number of tamper-evident log records committed under the current tenant ID.

2. Web CLI Authorization Flow (/cli/login)​

The tk-ota-push (or shorebird) CLI employs an authorization code flow with PKCE (Proof Key for Code Exchange) to negotiate administrative credentials against the sovereign backend:

My Account Page Features
  • Identity & Role: Displays user name, email, active tenant organization, and RBAC permission role.
  • Personal API Keys: Create and revoke programmatic tokens for CLI usage and CI/CD automation.
  • Account Security: Password management and Two-Factor Authentication (2FA) controls.
CLI Browser Authorization Flow
  1. Developer runs tk-ota-push login in their terminal.
  2. Web browser opens to the authorization screen in the Web Console.
  3. User approves access for the CLI session.
  4. CLI receives the secure session token and completes sign-in.

3. Query Parameters Processed by /cli/login​

The consent page validates incoming URL parameters:

ParameterPurposeExample
redirect_uri / callback_urlLoopback callback URL hosted by the local CLI processhttp://127.0.0.1:45213/callback
code_challengeSHA-256 hash of the ephemeral cryptographic secret created by the CLIE9Melhoa2OwvFrGMTJguCH5...
stateRandom anti-CSRF challenge token7b4f8c92a
device_nameHostname of the developer workstation requesting accessMacBook-Pro-Dev.local

4. CLI Authentication Guardrails​

  • Permitted Roles: Only operators holding ROLE_ADMIN or ROLE_RELEASE_DEVELOPER authorities may consent to CLI sessions. If an auditor or security officer opens the prompt, access is blocked with a privilege separation notice.
  • Short Lifetime: Authorization codes expire within 120 seconds if not exchanged by the CLI.
  • Audit Logging: Every issued CLI credential is logged to the immutable audit database with the machine hostname and client IP.
  • Remote Revocation: Tenant administrators can instantly invalidate all active CLI sessions for any user via /teams or /account.