feat(lightning_cloud): read the credential per request and add a PKCE login behind a switch

.github/workflows/test-cli.yaml

@@ -44,7 +44,7 @@ jobs:
     - name: Login passthrough
       run: lightning login # since we are providing the credentials, this should be a no-op
       env:
-        LIGHTNING_API_KEY: dummy-api-key
+        LIGHTNING_AUTH_TOKEN: dummy-auth-token
 
     - name: Tests
       working-directory: python/tests

python/lightning_sdk/cli/entrypoint.py

@@ -112,7 +112,7 @@ def login(no_browser: bool) -> None:
     if no_browser and not oidc_login_enabled():
         raise click.UsageError("`lightning login --no-browser` is not available yet.")
     auth = Auth()
-    if auth.api_key or auth.auth_token:
+    if auth.auth_token:
         click.echo('"lightning login" is not required within a Studio or when credentials are set in the environment')
         return
 

python/lightning_sdk/cli/resource_completion.py

@@ -14,11 +14,11 @@
 def has_credentials() -> bool:
     """Check for existing credentials without starting the browser login flow."""
     auth = Auth()
-    if auth.api_key or auth.auth_token:
+    if auth.auth_token:
         return True
     if not auth.load():
         return False
-    return bool(auth.api_key or auth.auth_token)
+    return bool(auth.auth_token)
 
 
 def accessible_teamspaces() -> dict[str, dict[str, str]]:

python/lightning_sdk/cli/utils/auth.py

@@ -228,7 +228,7 @@ def _login_with_session_token(self: AuthServer, auth: Auth) -> None:
             )
         raise RuntimeError(
             "Failed to authenticate to Lightning. When running without access to a browser, "
-            "'LIGHTNING_API_KEY' should be exported."
+            "'LIGHTNING_AUTH_TOKEN' should be exported."
         )
 
     @app.get("/login-complete")

python/lightning_sdk/cli/utils/lockdown_status.py

@@ -86,7 +86,7 @@ def _auth_header() -> Optional[str]:
     Reads the saved credentials unless the environment sets some, as the rest of the CLI does.
     """
     auth = Auth()
-    if not (auth.api_key or auth.auth_token):
+    if not auth.auth_token:
         auth.load()
     try:
         return auth.get_auth_header()

python/lightning_sdk/cli/utils/logging.py

@@ -34,7 +34,7 @@
 
 def _auth_header_without_browser() -> Optional[str]:
     auth = Auth()
-    if not (auth.api_key or auth.auth_token):
+    if not auth.auth_token:
         try:
             if not auth.load():
                 return None