feat(auth): add --port flag for orgs that block Desktop OAuth by VictorML11 · Pull Request #559 · googleworkspace/cli

VictorML11 · 2026-03-18T22:11:13Z

Summary

Adds a --port flag to gws auth login that uses a fixed port for the OAuth redirect server, enabling authentication for users in organizations that block the Desktop/installed OAuth flow via admin_policy_enforced.

Problem

Organizations with strict Google Workspace admin policies block the "installed" (Desktop) OAuth flow. The current implementation uses yup_oauth2::InstalledFlowReturnMethod::HTTPRedirect which binds to a random port — Google identifies this as a Desktop flow pattern and some orgs block it.

Solution

Added --port <PORT> flag to gws auth login
When provided: uses HTTPPortRedirect(port) with a fixed redirect URI (http://localhost:<port>) — compatible with Web Application type OAuth clients
When omitted: preserves current behavior (random port, Desktop flow) — no breaking change

Usage

# Current behavior (unchanged)
gws auth login

# For orgs that block Desktop OAuth
gws auth login --port 8080

Users with admin_policy_enforced would:

Create a Web Application (not Desktop) OAuth client in GCP Console
Set redirect URI to http://localhost:8080
Run gws auth login --port 8080

Changes

src/auth_commands.rs: Parse --port flag, conditionally use HTTPPortRedirect(port) and fixed redirect URI

Test plan

Builds successfully (cargo build --release)
Without --port: existing behavior preserved (random port)
With --port 8080: fixed port used, Web Application OAuth client works
Tested with managed Google Workspace account that blocks Desktop OAuth

Closes #557

Organizations with strict Google Workspace admin policies (admin_policy_enforced) block the "installed" (Desktop) OAuth flow that uses a random port. This adds a --port flag that uses yup_oauth2's HTTPPortRedirect with a fixed port, enabling authentication with Web Application type OAuth clients. Usage: gws auth login --port 8080 When --port is provided, uses HTTPPortRedirect(port) with a fixed redirect URI (http://localhost:<port>). When omitted, preserves current behavior (random port, Desktop flow). Closes googleworkspace#557 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

changeset-bot · 2026-03-18T22:11:21Z

⚠️ No Changeset found

Latest commit: 627c5ae

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

gemini-code-assist · 2026-03-18T22:11:28Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the gws auth login command by introducing a new --port flag. This flag allows users to specify a fixed port for the OAuth redirect server, which is crucial for successful authentication in Google Workspace organizations that enforce policies blocking the standard Desktop OAuth flow. By enabling the use of Web Application OAuth clients with a predictable redirect URI, this change significantly improves accessibility for users in restricted environments without altering the existing default behavior.

Highlights

New --port flag for gws auth login: Introduced a --port flag to the gws auth login command, allowing users to specify a fixed port for the OAuth redirect server.
Enables authentication for restricted organizations: This feature addresses issues for organizations that block the default Desktop OAuth flow by allowing the use of Web Application type OAuth clients with a fixed redirect URI.
Preserves existing behavior: The current authentication flow, which uses a random port, remains unchanged when the --port flag is omitted, ensuring no breaking changes.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Generative AI Prohibited Use Policy, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

google-cla · 2026-03-18T22:11:36Z

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

gemini-code-assist

Code Review

This pull request introduces a --port flag to gws auth login to support organizations that block the standard Desktop OAuth flow. The implementation correctly uses a fixed port when the flag is provided, while preserving the existing random-port behavior otherwise. However, there is a critical issue in src/oauth_config.rs where the generated client_secret.json is hardcoded to use port 8080, which is misleading and inconsistent with the default flow. This change is unnecessary and introduces scope creep, therefore it should be reverted.

src/oauth_config.rs

Reverts the change to save_client_config that hardcoded port 8080 in the client_secret.json redirect_uris. This was unnecessary because: - handle_login overwrites redirect_uris based on the --port flag - The default Desktop flow expects http://localhost (no port) - Hardcoding 8080 would confuse users who run setup without --port The --port flag in auth_commands.rs handles the redirect URI dynamically — no config file changes needed.

googleworkspace-bot · 2026-03-18T22:24:44Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces a --port flag to the gws auth login command, allowing users to specify a fixed port for the OAuth redirect server. This is a valuable addition for users in organizations that block the default Desktop OAuth flow. The implementation correctly parses the new flag and conditionally adjusts the OAuth authenticator and redirect URI. My review identified one area for improvement: the provided port number is not validated to disallow port 0. Using port 0 would cause the operating system to select a random ephemeral port, which negates the purpose of this feature. I have provided a suggestion to add this validation.

src/auth_commands.rs

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

googleworkspace-bot · 2026-03-18T22:33:12Z

/gemini review

gemini-code-assist

Code Review

This pull request successfully adds the --port flag to support OAuth flows in environments that block the standard desktop flow. The implementation is clean and follows existing patterns. I've identified two high-severity issues: one related to code duplication in argument parsing that impacts maintainability, and another where the saved client_secret.json can contain an incorrect redirect_uris value when the new --port flag is used with environment variables. Addressing these will make the implementation more robust and maintainable.

gemini-code-assist · 2026-03-18T22:36:27Z

src/auth_commands.rs

+        // Parse --port <PORT> or --port=<PORT>
+        let port_str = if args[i] == "--port" && i + 1 < args.len() {
+            skip_next = true;
+            Some(args[i + 1].as_str())
+        } else {
+            args[i].strip_prefix("--port=")
+        };
+        if let Some(value) = port_str {
+            let port = value.parse::<u16>().map_err(|_| {
+                GwsError::Validation(format!("Invalid port number: {value}"))
+            })?;
+            if port == 0 {
+                return Err(GwsError::Validation(
+                    "Port number must be a non-zero value between 1 and 65535.".to_string(),
+                ));
+            }
+            fixed_port = Some(port);
+            continue;
+        }


The argument parsing logic for --port is very similar to the existing logic for --services that follows this block. This duplication makes the code harder to read and maintain. Future changes, like adding more flags or fixing a bug in the parsing, would require modifications in multiple places.

To improve maintainability, consider refactoring this logic. A helper function could encapsulate the shared pattern of parsing flags that accept a value (e.g., --flag <value> or --flag=<value>). This would make handle_login cleaner and less prone to errors as it evolves.

gemini-code-assist · 2026-03-18T22:36:27Z

src/auth_commands.rs

+        redirect_uris: vec![match fixed_port {
+            Some(p) => format!("http://localhost:{p}"),
+            None => "http://localhost".to_string(),
+        }],


While this block correctly configures the redirect_uris for the current authentication flow, there's a related issue with how the client configuration is persisted. When credentials are provided via environment variables, gws saves them to client_secret.json (around line 276). The save_client_config function used for this hardcodes redirect_uris to ["http://localhost"]. If a user provides a fixed port via --port, this saved configuration will be incorrect for their "Web Application" type client.

To fix this, save_client_config could be updated to accept the fixed_port and generate the correct redirect_uris in the saved file. This would involve changes in oauth_config.rs and its call sites in auth_commands.rs and setup.rs.

googleworkspace-bot added the area: auth label Mar 18, 2026

VictorML11 mentioned this pull request Mar 18, 2026

feat: Add --port flag to gws auth login for orgs that block Desktop OAuth flow #557

Closed

gemini-code-assist bot reviewed Mar 18, 2026

View reviewed changes

src/oauth_config.rs Outdated Show resolved Hide resolved

gemini-code-assist bot reviewed Mar 18, 2026

View reviewed changes

src/auth_commands.rs Outdated Show resolved Hide resolved

Update src/auth_commands.rs

627c5ae

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

gemini-code-assist bot reviewed Mar 18, 2026

View reviewed changes

VictorML11 closed this Mar 18, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(auth): add --port flag for orgs that block Desktop OAuth#559

feat(auth): add --port flag for orgs that block Desktop OAuth#559
VictorML11 wants to merge 3 commits intogoogleworkspace:mainfrom
VictorML11:feat/auth-port-flag

VictorML11 commented Mar 18, 2026

Uh oh!

changeset-bot bot commented Mar 18, 2026 •

edited

Loading

Uh oh!

gemini-code-assist bot commented Mar 18, 2026

Uh oh!

google-cla bot commented Mar 18, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

googleworkspace-bot commented Mar 18, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

googleworkspace-bot commented Mar 18, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Mar 18, 2026

Uh oh!

gemini-code-assist bot Mar 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

VictorML11 commented Mar 18, 2026

Summary

Problem

Solution

Usage

Changes

Test plan

Uh oh!

changeset-bot bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

gemini-code-assist bot commented Mar 18, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

google-cla bot commented Mar 18, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

googleworkspace-bot commented Mar 18, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

googleworkspace-bot commented Mar 18, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

changeset-bot bot commented Mar 18, 2026 •

edited

Loading