0xrsydn/idx-cli
1
mirror of https://github.com/0xrsydn/idx-cli.git synced 2026-11-07 09:45:36 +00:00
Code Issues Projects Releases 1 Packages Wiki Activity

feat(stockbit): connect a session from a local browser page

Browse source 
idx stockbit login in a terminal now serves a page on 127.0.0.1: a
bookmarklet that reads stockbit.com's session cookie in the user's own
browser and opens the page with it in the URL fragment, or a
read-the-clipboard button, with the manual paste as the fallback. A
per-run secret guards the path, the page is no-store with a strict CSP,
and it stops on success or after five minutes. --no-browser prints the
URL (--port pins it for ssh -L); piped stdin keeps the paste path.

A paste Stockbit refuses now restores the previous session instead of
losing it.
This commit is contained in:
hermes 2026-10-23 12:29:01 +00:00
commit 12fdc8c8e8
7 changed files with 508 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/ARCHITECTURE.md
View file

@ -195,7 +195,13 @@ WIB as the fallback.
`credentialStorage` cookie (or a bare refresh token) in
`<config dir>/stockbit-session.json`, written atomically with mode 0600;
`IDX_STOCKBIT_REFRESH_TOKEN` / `IDX_STOCKBIT_ACCESS_TOKEN` fill fields the
file lacks. `api/stockbit/auth.rs` reads expiries from the JWTs (`exp`,
file lacks. In a terminal it first serves a page on 127.0.0.1
(`api/stockbit/loopback.rs`): a bookmarklet that reads the cookie in the
user's own browser and opens the page with it in the URL fragment, or a
clipboard button; a per-run secret guards the path, the page is `no-store`
with a strict CSP, and the server stops on success or after five minutes.
Piped stdin keeps the paste path. `api/stockbit/auth.rs` reads expiries
from the JWTs (`exp`,
unverified) and refreshes an access token within an hour of expiry with
`POST /login/refresh` (bearer = refresh token), which rotates both tokens.
Because a refresh token is spent once, refreshes run under an exclusive