feat(oauth): implement authentication flow with login and logout

crates/forge_api/Cargo.toml

@@ -11,6 +11,7 @@ forge_stream = { path = "../forge_stream" }
 forge_app = { path = "../forge_app" }
 forge_walker = { path = "../forge_walker" }
 forge_infra = { path = "../forge_infra" }
+forge_oauth = { path = "../forge_oauth" }
 serde_yaml = "0.9.34"
 serde_json = { version = "1.0" }
 

crates/forge_api/src/api.rs

@@ -2,9 +2,10 @@ use std::path::Path;
 use std::sync::Arc;
 
 use anyhow::Result;
-use forge_app::{EnvironmentService, ForgeApp, Infrastructure};
+use forge_app::{CredentialRepository, EnvironmentService, ForgeApp, Infrastructure};
 use forge_domain::*;
 use forge_infra::ForgeInfra;
+use forge_oauth::AuthFlowState;
 use forge_stream::MpscStream;
 use serde_json::Value;
 
@@ -64,6 +65,21 @@ impl<F: App + Infrastructure> API for ForgeAPI<F> {
         self.app.conversation_service().create(workflow).await
     }
 
+    fn init_login(&self) -> AuthFlowState {
+        self.app.credential_repository().create()
+    }
+
+    async fn login(&self, auth_flow_state: AuthFlowState) -> anyhow::Result<()> {
+        self.app
+            .credential_repository()
+            .authenticate(auth_flow_state)
+            .await
+    }
+
+    fn logout(&self) -> anyhow::Result<bool> {
+        self.app.credential_repository().delete()
+    }
+
     fn environment(&self) -> Environment {
         self.app.environment_service().get_environment().clone()
     }

crates/forge_api/src/lib.rs

@@ -7,6 +7,7 @@ use std::path::Path;
 
 pub use api::*;
 pub use forge_domain::*;
+use forge_oauth::AuthFlowState;
 use forge_stream::MpscStream;
 use serde_json::Value;
 
@@ -29,6 +30,14 @@ pub trait API {
         chat: ChatRequest,
     ) -> anyhow::Result<MpscStream<anyhow::Result<AgentMessage<ChatResponse>, anyhow::Error>>>;
 
+    fn init_login(&self) -> AuthFlowState;
+    /// Authenticates the user with Clerk OAuth
+    async fn login(&self, auth_flow_state: AuthFlowState) -> anyhow::Result<()>;
+
+    /// Logs out the user by deleting stored credentials
+    /// Returns true if credentials were found and deleted, false otherwise
+    fn logout(&self) -> anyhow::Result<bool>;
+
     /// Returns the current environment
     fn environment(&self) -> Environment;
 

crates/forge_app/Cargo.toml

@@ -14,6 +14,7 @@ forge_open_router = { path = "../forge_open_router" }
 forge_tool_macros = { path = "../forge_tool_macros" }
 forge_display = { path = "../forge_display" }
 forge_walker = { path = "../forge_walker" }
+forge_oauth = { path = "../forge_oauth" }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0.133"
 derive_setters = "0.1.6"

crates/forge_app/src/app.rs

@@ -18,7 +18,7 @@ use crate::Infrastructure;
 pub struct ForgeApp<F> {
     infra: Arc<F>,
     tool_service: Arc<ForgeToolService>,
-    provider_service: ForgeProviderService,
+    provider_service: ForgeProviderService<F>,
     conversation_service: ForgeConversationService,
     prompt_service: ForgeTemplateService<F, ForgeToolService>,
     attachment_service: ForgeChatRequest<F>,
@@ -40,7 +40,7 @@ impl<F: Infrastructure> ForgeApp<F> {
 
 impl<F: Infrastructure> App for ForgeApp<F> {
     type ToolService = ForgeToolService;
-    type ProviderService = ForgeProviderService;
+    type ProviderService = ForgeProviderService<F>;
     type ConversationService = ForgeConversationService;
     type TemplateService = ForgeTemplateService<F, ForgeToolService>;
     type AttachmentService = ForgeChatRequest<F>;
@@ -67,11 +67,16 @@ impl<F: Infrastructure> App for ForgeApp<F> {
 }
 
 impl<F: Infrastructure> Infrastructure for ForgeApp<F> {
+    type CredentialRepository = F::CredentialRepository;
     type EnvironmentService = F::EnvironmentService;
     type FileReadService = F::FileReadService;
     type VectorIndex = F::VectorIndex;
     type EmbeddingService = F::EmbeddingService;
 
+    fn credential_repository(&self) -> &Self::CredentialRepository {
+        self.infra.credential_repository()
+    }
+
     fn environment_service(&self) -> &Self::EnvironmentService {
         self.infra.environment_service()
     }

crates/forge_app/src/attachment.rs

@@ -60,17 +60,20 @@ impl<F: Infrastructure> AttachmentService for ForgeChatRequest<F> {
 
 #[cfg(test)]
 mod tests {
+    use core::str;
     use std::collections::HashMap;
     use std::path::{Path, PathBuf};
     use std::sync::{Arc, Mutex};
 
     use base64::Engine;
     use bytes::Bytes;
     use forge_domain::{AttachmentService, ContentType, Environment, Point, Query, Suggestion};
+    use forge_oauth::AuthFlowState;
 
     use crate::attachment::ForgeChatRequest;
     use crate::{
-        EmbeddingService, EnvironmentService, FileReadService, Infrastructure, VectorIndex,
+        CredentialRepository, EmbeddingService, EnvironmentService, FileReadService,
+        Infrastructure, VectorIndex,
     };
 
     struct MockEnvironmentService {}
@@ -90,6 +93,7 @@ mod tests {
                 provider_key: "key".to_string(),
                 provider_url: "url".to_string(),
                 openai_key: None,
+                force_antinomy: None,
             }
         }
     }
@@ -162,6 +166,7 @@ mod tests {
         file_service: MockFileReadService,
         vector_index: MockVectorIndex,
         embedding_service: MockEmbeddingService,
+        auth_service: MockAuthService,
     }
 
     impl MockInfrastructure {
@@ -171,16 +176,37 @@ mod tests {
                 file_service: MockFileReadService::new(),
                 vector_index: MockVectorIndex {},
                 embedding_service: MockEmbeddingService {},
+                auth_service: MockAuthService {},
             }
         }
     }
 
+    struct MockAuthService {}
+
+    #[async_trait::async_trait]
+    impl CredentialRepository for MockAuthService {
+        fn create(&self) -> AuthFlowState {
+            unimplemented!()
+        }
+        async fn authenticate(&self, _: AuthFlowState) -> Result<(), anyhow::Error> {
+            Ok(())
+        }
+
+        fn delete(&self) -> Result<bool, anyhow::Error> {
+            Ok(false)
+        }
+
+        fn credentials(&self) -> Option<String> {
+            None
+        }
+    }
+
     impl Infrastructure for MockInfrastructure {
         type EnvironmentService = MockEnvironmentService;
         type FileReadService = MockFileReadService;
         type VectorIndex = MockVectorIndex;
         type EmbeddingService = MockEmbeddingService;
-
+        type CredentialRepository = MockAuthService;
         fn environment_service(&self) -> &Self::EnvironmentService {
             &self.env_service
         }
@@ -196,6 +222,10 @@ mod tests {
         fn embedding_service(&self) -> &Self::EmbeddingService {
             &self.embedding_service
         }
+
+        fn credential_repository(&self) -> &Self::CredentialRepository {
+            &self.auth_service
+        }
     }
 
     #[tokio::test]

crates/forge_app/src/lib.rs

@@ -11,6 +11,24 @@ use std::path::Path;
 pub use app::*;
 use bytes::Bytes;
 use forge_domain::{Point, Query, Suggestion};
+use forge_oauth::AuthFlowState;
+
+#[async_trait::async_trait]
+pub trait CredentialRepository: Send + Sync + 'static {
+    /// Returns the current authentication state
+    fn create(&self) -> AuthFlowState;
+
+    /// Authenticates the user and stores credentials
+    async fn authenticate(&self, state: AuthFlowState) -> anyhow::Result<()>;
+
+    /// Logs out the user by removing stored credentials
+    /// Returns true if credentials were found and removed, false otherwise
+    fn delete(&self) -> anyhow::Result<bool>;
+
+    /// Retrieves the current authentication token if available
+    /// Returns the token as a string if found, or an error if not authenticated
+    fn credentials(&self) -> Option<String>;
+}
 
 /// Repository for accessing system environment information
 #[async_trait::async_trait]
@@ -45,11 +63,13 @@ pub trait EmbeddingService: Send + Sync {
 }
 
 pub trait Infrastructure: Send + Sync + 'static {
+    type CredentialRepository: CredentialRepository;
     type EnvironmentService: EnvironmentService;
     type FileReadService: FileReadService;
     type VectorIndex: VectorIndex<Suggestion>;
     type EmbeddingService: EmbeddingService;
 
+    fn credential_repository(&self) -> &Self::CredentialRepository;
     fn environment_service(&self) -> &Self::EnvironmentService;
     fn file_read_service(&self) -> &Self::FileReadService;
     fn vector_index(&self) -> &Self::VectorIndex;

crates/forge_app/src/provider.rs

@@ -5,55 +5,80 @@ use forge_domain::{
     ChatCompletionMessage, Context as ChatContext, Model, ModelId, Parameters, ProviderService,
     ResultStream,
 };
-use forge_open_router::ProviderBuilder;
+use forge_open_router::{Client, ClientBuilder};
 use moka2::future::Cache;
+use tokio::sync::Mutex;
 
-use crate::{EnvironmentService, Infrastructure};
+use crate::{CredentialRepository, EnvironmentService, Infrastructure};
 
-pub struct ForgeProviderService {
-    or: Box<dyn ProviderService>,
+pub struct ForgeProviderService<F> {
+    infra: Arc<F>,
+
+    // The provider service implementation
+    client: Mutex<Option<Arc<Client>>>,
     cache: Cache<ModelId, Parameters>,
 }
 
-impl ForgeProviderService {
-    pub fn new<F: Infrastructure>(infra: Arc<F>) -> Self {
-        let env = infra.environment_service().get_environment();
-        let or = ProviderBuilder::from_url(env.provider_url)
-            .with_key(env.provider_key)
-            .build()
-            .expect("Failed to build provider");
+impl<F: Infrastructure> ForgeProviderService<F> {
+    pub fn new(infra: Arc<F>) -> Self {
+        let infra = infra.clone();
+        Self { infra, client: Mutex::new(None), cache: Cache::new(1024) }
+    }
+
+    async fn provider(&self) -> Result<Arc<Client>> {
+        let mut guard = self.client.lock().await;
+        if let Some(provider) = guard.as_ref() {
+            return Ok(provider.clone());
+        }
+
+        let env = self.infra.environment_service().get_environment();
+        let key = if env.force_antinomy.unwrap_or_default() {
+            self.infra
+                .credential_repository()
+                .credentials()
+                .ok_or_else(|| anyhow::anyhow!("Failed to authenticate the user"))?
+        } else {
+            env.provider_key.clone()
+        };
+        let provider = Arc::new(
+            ClientBuilder::from_url(env.provider_url)
+                .api_key(key)
+                .build()?,
+        );
 
-        Self { or, cache: Cache::new(1024) }
+        *guard = Some(provider.clone());
+        Ok(provider)
     }
 }
 
 #[async_trait::async_trait]
-impl ProviderService for ForgeProviderService {
+impl<F: Infrastructure> ProviderService for ForgeProviderService<F> {
     async fn chat(
         &self,
         model_id: &ModelId,
         request: ChatContext,
     ) -> ResultStream<ChatCompletionMessage, anyhow::Error> {
-        self.or
+        self.provider()
+            .await?
             .chat(model_id, request)
             .await
             .with_context(|| format!("Failed to chat with model: {}", model_id))
     }
 
     async fn models(&self) -> Result<Vec<Model>> {
-        self.or.models().await
+        self.provider().await?.models().await
     }
 
     async fn parameters(&self, model: &ModelId) -> anyhow::Result<Parameters> {
-        Ok(self
-            .cache
+        self.cache
             .try_get_with_by_ref(model, async {
-                self.or
+                self.provider()
+                    .await?
                     .parameters(model)
                     .await
                     .with_context(|| format!("Failed to get parameters for model: {}", model))
             })
             .await
-            .map_err(|e| anyhow::anyhow!(e))?)
+            .map_err(|e| anyhow::anyhow!(e))
     }
 }

crates/forge_app/src/tools/mod.rs

@@ -41,9 +41,10 @@ mod tests {
 
     use bytes::Bytes;
     use forge_domain::{Environment, Point, Query, Suggestion};
+    use forge_oauth::AuthFlowState;
 
     use super::*;
-    use crate::{EmbeddingService, FileReadService, VectorIndex};
+    use crate::{CredentialRepository, EmbeddingService, FileReadService, VectorIndex};
 
     /// Create a default test environment
     fn stub() -> Stub {
@@ -64,6 +65,7 @@ mod tests {
                 provider_url: Default::default(),
                 provider_key: Default::default(),
                 openai_key: Default::default(),
+                force_antinomy: None,
             },
         }
     }
@@ -102,13 +104,36 @@ mod tests {
         }
     }
 
+    #[async_trait::async_trait]
+    impl CredentialRepository for Stub {
+        fn create(&self) -> AuthFlowState {
+            unimplemented!()
+        }
+        async fn authenticate(&self, _auth_flow_state: AuthFlowState) -> anyhow::Result<()> {
+            unimplemented!()
+        }
+
+        fn delete(&self) -> anyhow::Result<bool> {
+            unimplemented!()
+        }
+
+        fn credentials(&self) -> Option<String> {
+            unimplemented!()
+        }
+    }
+
     #[async_trait::async_trait]
     impl Infrastructure for Stub {
+        type CredentialRepository = Stub;
         type EnvironmentService = Stub;
         type FileReadService = Stub;
         type VectorIndex = Stub;
         type EmbeddingService = Stub;
 
+        fn credential_repository(&self) -> &Self::CredentialRepository {
+            self
+        }
+
         fn environment_service(&self) -> &Self::EnvironmentService {
             self
         }

crates/forge_app/src/tools/shell/shell_tool.rs

@@ -146,6 +146,7 @@ mod tests {
             qdrant_cluster: None,
             pid: std::process::id(),
             openai_key: None,
+            force_antinomy: None,
         }
     }