feat: add secrets management, OAuth login, and --env-file support

- ink secrets (set/import/list/delete/unset) with server-side merge
- ink login with OAuth PKCE browser flow (default) and --api-key flag
- --env-file flag on deploy/redeploy for secure secret passing

Author: gluonfield

cmd/deploy.go

@@ -1,7 +1,9 @@
 package cmd
 
 import (
+	"bufio"
 	"fmt"
+	"os"
 	"strings"
 
 	"github.com/Khan/genqlient/graphql"
@@ -36,6 +38,9 @@ func addServiceFlags(cmd *cobra.Command) {
 	if f.Lookup("env") == nil {
 		f.StringArray("env", nil, "Environment variable as KEY=VALUE (repeatable)")
 	}
+	if f.Lookup("env-file") == nil {
+		f.StringArray("env-file", nil, "Read env vars from file (repeatable, e.g. .env)")
+	}
 	if f.Lookup("build-command") == nil {
 		f.String("build-command", "", "Custom build command")
 	}
@@ -63,8 +68,11 @@ var deployCmd = &cobra.Command{
 	Example: `# Deploy a Node.js app
 ink deploy myapp
 
-# Deploy with environment variables
-ink deploy myapi --env DATABASE_URL=postgres://... --env SECRET_KEY=abc123
+# Deploy with env vars from a file (recommended for secrets)
+ink deploy myapi --env-file .env
+
+# Deploy with inline env vars (for non-sensitive values)
+ink deploy myapi --env NODE_ENV=production --env PORT=8080
 
 # Deploy with custom resources
 ink deploy myapi --memory 2Gi --vcpu 1
@@ -105,8 +113,8 @@ ink redeploy myapi
 # Redeploy and update memory
 ink redeploy myapi --memory 2Gi
 
-# Redeploy with new env vars
-ink redeploy myapi --env DATABASE_URL=postgres://... --env SECRET_KEY=abc123
+# Redeploy with env vars from file
+ink redeploy myapi --env-file .env
 
 # Redeploy with different build settings
 ink redeploy myapi --buildpack dockerfile --dockerfile Dockerfile.prod`,
@@ -186,9 +194,7 @@ func runCreate(cmd *cobra.Command, client graphql.Client, name string) {
 		input.Regions = []string{region}
 	}
 
-	if envs, _ := cmd.Flags().GetStringArray("env"); len(envs) > 0 {
-		input.EnvVars = parseEnvVars(envs)
-	}
+	input.EnvVars = collectEnvVars(cmd)
 
 	result, err := gql.CreateService(ctx(), client, input)
 	if err != nil {
@@ -264,9 +270,7 @@ func runUpdate(cmd *cobra.Command, client graphql.Client, name string) {
 		input.Port = &v
 	}
 
-	if envs, _ := cmd.Flags().GetStringArray("env"); len(envs) > 0 {
-		input.EnvVars = parseEnvVars(envs)
-	}
+	input.EnvVars = collectEnvVars(cmd)
 
 	result, err := gql.UpdateService(ctx(), client, input)
 	if err != nil {
@@ -285,12 +289,66 @@ func runUpdate(cmd *cobra.Command, client graphql.Client, name string) {
 	fmt.Println()
 }
 
-func parseEnvVars(envs []string) []gql.EnvVarInput {
+func collectEnvVars(cmd *cobra.Command) []gql.EnvVarInput {
+	vars := make(map[string]string)
+
+	// env-file first (lower priority)
+	if files, _ := cmd.Flags().GetStringArray("env-file"); len(files) > 0 {
+		for _, f := range files {
+			parsed, err := parseEnvFile(f)
+			if err != nil {
+				fatal(err.Error())
+			}
+			for _, v := range parsed {
+				vars[v.Key] = v.Value
+			}
+		}
+	}
+
+	// --env flags override env-file
+	if envs, _ := cmd.Flags().GetStringArray("env"); len(envs) > 0 {
+		for _, e := range envs {
+			if k, v, ok := strings.Cut(e, "="); ok {
+				vars[k] = v
+			}
+		}
+	}
+
+	if len(vars) == 0 {
+		return nil
+	}
+
+	result := make([]gql.EnvVarInput, 0, len(vars))
+	for k, v := range vars {
+		result = append(result, gql.EnvVarInput{Key: k, Value: v})
+	}
+	return result
+}
+
+func parseEnvFile(path string) ([]gql.EnvVarInput, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return nil, fmt.Errorf("cannot read env file %s: %w", path, err)
+	}
+	defer f.Close()
+
 	var vars []gql.EnvVarInput
-	for _, e := range envs {
-		if k, v, ok := strings.Cut(e, "="); ok {
-			vars = append(vars, gql.EnvVarInput{Key: k, Value: v})
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		k, v, ok := strings.Cut(line, "=")
+		if !ok {
+			continue
+		}
+		k = strings.TrimSpace(k)
+		v = strings.TrimSpace(v)
+		if len(v) >= 2 && ((v[0] == '"' && v[len(v)-1] == '"') || (v[0] == '\'' && v[len(v)-1] == '\'')) {
+			v = v[1 : len(v)-1]
 		}
+		vars = append(vars, gql.EnvVarInput{Key: k, Value: v})
 	}
-	return vars
+	return vars, scanner.Err()
 }

cmd/login.go

@@ -1,51 +1,62 @@
 package cmd
 
 import (
-	"bufio"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
 	"fmt"
-	"os"
+	"net"
+	"net/http"
+	"net/url"
+	"os/exec"
+	"runtime"
 	"strings"
 
 	"github.com/mldotink/cli/internal/config"
 	"github.com/spf13/cobra"
 )
 
-var loginGlobal bool
+const oauthServerBase = "https://mcp.ml.ink"
 
 func init() {
-	loginCmd.Flags().BoolVar(&loginGlobal, "global", true, "Save globally (~/.config/ink/config)")
+	loginCmd.Flags().Bool("global", true, "Save globally (~/.config/ink/config)")
+	loginCmd.Flags().String("api-key", "", "Authenticate with an API key directly")
 	rootCmd.AddCommand(loginCmd)
 }
 
 var loginCmd = &cobra.Command{
-	Use:   "login [api-key]",
+	Use:   "login",
 	Short: "Authenticate with Ink",
-	Long:  "Store your API key. Get one at https://ml.ink/account/api-keys",
-	Example: `# Interactive prompt
+	Long:  "Log in via browser (default) or provide an API key directly.",
+	Example: `# Browser login (opens browser, recommended)
 ink login
 
-# Pass key directly
-ink login dk_live_abc123`,
-	Args: maxArgs(1),
+# API key directly
+ink login --api-key dk_live_abc123`,
+	Args: cobra.NoArgs,
 	Run: func(cmd *cobra.Command, args []string) {
+		global, _ := cmd.Flags().GetBool("global")
+		apiKey, _ := cmd.Flags().GetString("api-key")
+
 		var key string
-		if len(args) > 0 {
-			key = strings.TrimSpace(args[0])
+
+		if apiKey != "" {
+			if !strings.HasPrefix(apiKey, "dk_") {
+				fatal("Invalid API key — keys start with dk_live_ or dk_test_")
+			}
+			key = apiKey
 		} else {
-			fmt.Print("Enter API key: ")
-			scanner := bufio.NewScanner(os.Stdin)
-			if scanner.Scan() {
-				key = strings.TrimSpace(scanner.Text())
+			k, err := oauthBrowserLogin()
+			if err != nil {
+				fatal(err.Error())
 			}
-		}
-
-		if !strings.HasPrefix(key, "dk_") {
-			fatal("Invalid API key — keys start with dk_live_ or dk_test_")
+			key = k
 		}
 
 		c := &config.Config{APIKey: key}
 		var err error
-		if loginGlobal {
+		if global {
 			err = config.SaveGlobal(c)
 		} else {
 			err = config.SaveLocal(c)
@@ -54,10 +65,165 @@ ink login dk_live_abc123`,
 			fatal(fmt.Sprintf("Failed to save: %v", err))
 		}
 
-		if loginGlobal {
-			success("Saved to ~/.config/ink/config")
+		if global {
+			success("Logged in — saved to ~/.config/ink/config")
 		} else {
-			success("Saved to .ink (project-local)")
+			success("Logged in — saved to .ink (project-local)")
 		}
 	},
 }
+
+func oauthBrowserLogin() (string, error) {
+	// Generate PKCE code verifier (43-128 URL-safe chars)
+	verifierBytes := make([]byte, 32)
+	if _, err := rand.Read(verifierBytes); err != nil {
+		return "", fmt.Errorf("failed to generate PKCE verifier: %w", err)
+	}
+	codeVerifier := base64.RawURLEncoding.EncodeToString(verifierBytes)
+
+	// code_challenge = BASE64URL(SHA256(code_verifier))
+	hash := sha256.Sum256([]byte(codeVerifier))
+	codeChallenge := base64.RawURLEncoding.EncodeToString(hash[:])
+
+	// Generate state for CSRF protection
+	stateBytes := make([]byte, 16)
+	rand.Read(stateBytes)
+	state := base64.RawURLEncoding.EncodeToString(stateBytes)
+
+	// Start local server on random port
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		return "", fmt.Errorf("failed to start local server: %w", err)
+	}
+	port := listener.Addr().(*net.TCPAddr).Port
+	redirectURI := fmt.Sprintf("http://127.0.0.1:%d/callback", port)
+
+	// Register client
+	regBody, _ := json.Marshal(map[string]any{
+		"redirect_uris": []string{redirectURI},
+		"client_name":   "ink-cli",
+	})
+	resp, err := http.Post(oauthServerBase+"/oauth/register", "application/json", strings.NewReader(string(regBody)))
+	if err != nil {
+		listener.Close()
+		return "", fmt.Errorf("failed to register OAuth client: %w", err)
+	}
+	var regResult struct {
+		ClientID string `json:"client_id"`
+	}
+	json.NewDecoder(resp.Body).Decode(&regResult)
+	resp.Body.Close()
+	clientID := regResult.ClientID
+
+	// Build authorize URL
+	authorizeURL, _ := url.Parse(oauthServerBase + "/oauth/authorize")
+	q := authorizeURL.Query()
+	q.Set("client_id", clientID)
+	q.Set("redirect_uri", redirectURI)
+	q.Set("code_challenge", codeChallenge)
+	q.Set("code_challenge_method", "S256")
+	q.Set("state", state)
+	q.Set("response_type", "code")
+	authorizeURL.RawQuery = q.Encode()
+
+	// Channel to receive result
+	result := make(chan oauthResult, 1)
+
+	// Set up callback handler
+	mux := http.NewServeMux()
+	mux.HandleFunc("/callback", func(w http.ResponseWriter, r *http.Request) {
+		returnedState := r.URL.Query().Get("state")
+		code := r.URL.Query().Get("code")
+		errMsg := r.URL.Query().Get("error")
+
+		if errMsg != "" {
+			w.Header().Set("Content-Type", "text/html")
+			fmt.Fprintf(w, "<html><body><h2>Login failed</h2><p>%s</p><p>You can close this tab.</p></body></html>", errMsg)
+			result <- oauthResult{err: fmt.Errorf("OAuth error: %s", errMsg)}
+			return
+		}
+
+		if returnedState != state {
+			w.Header().Set("Content-Type", "text/html")
+			fmt.Fprint(w, "<html><body><h2>Login failed</h2><p>State mismatch.</p></body></html>")
+			result <- oauthResult{err: fmt.Errorf("OAuth state mismatch")}
+			return
+		}
+
+		w.Header().Set("Content-Type", "text/html")
+		fmt.Fprint(w, "<html><body><h2>Login successful!</h2><p>You can close this tab and return to the terminal.</p></body></html>")
+		result <- oauthResult{code: code}
+	})
+
+	server := &http.Server{Handler: mux}
+	go server.Serve(listener)
+
+	// Open browser
+	fmt.Println()
+	fmt.Println(dim.Render("  Opening browser to log in..."))
+	fmt.Println(dim.Render("  If the browser doesn't open, visit:"))
+	fmt.Println(dim.Render("  " + authorizeURL.String()))
+	fmt.Println()
+
+	openBrowser(authorizeURL.String())
+
+	// Wait for callback
+	res := <-result
+	server.Close()
+
+	if res.err != nil {
+		return "", res.err
+	}
+
+	// Exchange code for token
+	tokenData := url.Values{
+		"grant_type":    {"authorization_code"},
+		"code":          {res.code},
+		"code_verifier": {codeVerifier},
+		"redirect_uri":  {redirectURI},
+		"client_id":     {clientID},
+	}
+
+	tokenResp, err := http.PostForm(oauthServerBase+"/oauth/token", tokenData)
+	if err != nil {
+		return "", fmt.Errorf("failed to exchange code for token: %w", err)
+	}
+	defer tokenResp.Body.Close()
+
+	var tokenResult struct {
+		AccessToken string `json:"access_token"`
+		Error       string `json:"error"`
+		Description string `json:"error_description"`
+	}
+	json.NewDecoder(tokenResp.Body).Decode(&tokenResult)
+
+	if tokenResult.Error != "" {
+		return "", fmt.Errorf("token exchange failed: %s — %s", tokenResult.Error, tokenResult.Description)
+	}
+
+	if tokenResult.AccessToken == "" {
+		return "", fmt.Errorf("no access token in response")
+	}
+
+	return tokenResult.AccessToken, nil
+}
+
+type oauthResult struct {
+	code string
+	err  error
+}
+
+func openBrowser(url string) {
+	var cmd *exec.Cmd
+	switch runtime.GOOS {
+	case "darwin":
+		cmd = exec.Command("open", url)
+	case "linux":
+		cmd = exec.Command("xdg-open", url)
+	case "windows":
+		cmd = exec.Command("rundll32", "url.dll,FileProtocolHandler", url)
+	}
+	if cmd != nil {
+		cmd.Start()
+	}
+}