OAuth device flow: accept a login hint so the expected account is enforced #127918

Problem

The Sentry CLI is adding multi-account support (getsentry/toolkit#1526), including sentry auth login <email> to log in as a specific account. With the OAuth device flow, the server has no way to know which account the CLI expects, so the approval always goes to whichever user is signed in to the browser.

Today the CLI can only check after the fact: it compares the email returned with the token against the requested one and throws the token away on a mismatch. That works, but the user only finds out after approving, and the server has already issued a token for the wrong account.

Current behavior (from source)

• POST /oauth/device/code/ (src/sentry/web/frontend/oauth_device_authorization.py) reads only client_id and scope.
• ApiDeviceCode (src/sentry/models/apidevicecode.py) has no field for an expected user.
• The verification page (src/sentry/web/frontend/oauth_device.py) approves for request.user without checking against anything the client sent.

Proposal

Accept an optional login_hint on the device authorization request (same idea as OpenID Connect login_hint; RFC 8628 allows extra parameters). Store it on ApiDeviceCode, and on the verification page:

• if the signed-in user doesn't match the hint, show which account is expected and offer to switch accounts, instead of approving for the current user;
• deny approval for a non-matching user (or at least require an explicit confirmation).

Unknown or missing hints keep today's behavior, so existing clients are unaffected.

Context

Raised in review of getsentry/toolkit#1526: getsentry/toolkit#1526 (comment)

via Junior system actor event.

--

View Junior Session [Sentry]