account

Documentation

Overview

create.go — `drift account create`. Two-step signup:

1. Initiate — POST /signup/initiate with {username, password, email}. Password travels in plaintext over TLS; the auth service bcrypts on receipt before persisting. The CLI does NOT bcrypt — that keeps signup symmetric with login (which has always sent plaintext) and lets the server enforce its own password rules on the actual plaintext rather than on a hash.
2. Verify — user enters the 6-digit OTP from email, CLI POSTs /signup/verify, server materialises the account and returns the JWT pair.

Password length and username shape are validated client-side as a UX nicety (so a typo doesn't round-trip the email-OTP step before failing). The server validates the same rules on receipt.

login.go — `drift account login`. POSTs `{username, password, device_id}` to /login; on success, persists the JWT pair to `~/.drift/session.json` (mode 0600). The device_id is a stable per-workstation random ID (see common/session.go :: GetOrCreateDeviceID) — refresh tokens are bound to it, so a stolen session.json without the matching device_id can't refresh.

Three ways to supply the password:

• Interactive (default) — `drift account login` prompts for it with terminal echo disabled.
• --password-stdin — `echo $PASS | drift account login -u alice --password-stdin`. The password never appears as a process argument; doesn't show up in `ps`, shell history, or process-listing logs. The pattern gh / docker login / kubectl / doctl / op all use. Recommended for CI.
• --password (-p) — kept for backward compatibility but prints a deprecation warning. The password ends up in shell history and `ps` output. Migrate to --password-stdin.

reset.go — `drift account reset-password`. Two-step, guided password reset, same shape as `drift account create`'s signup flow:

1. Initiate — POST /reset/initiate {username}. The server always returns success (anti-enumeration), whether or not the account exists — so the CLI can't distinguish "code sent" from "no such user" here. That's intentional; if nothing arrives, try the username again.
2. Verify — user enters the code emailed to them plus a new password; CLI POSTs /reset/verify {username, code, new_password}. A successful reset revokes every existing session for the account server-side and issues no new one, so the CLI immediately logs back in with the new password to leave you signed in.

Index

• func DoLogin(username, password string)
• func GetAccountCmd() *cobra.Command
• func GetCreateCmd() *cobra.Command
• func GetLoginCmd() *cobra.Command
• func GetResetPasswordCmd() *cobra.Command

Functions

func DoLogin

func DoLogin(username, password string)

func GetAccountCmd

func GetAccountCmd() *cobra.Command

GetAccountCmd returns the "drift account" command group. Subcommands: signup, login, reset-password.

func GetCreateCmd

func GetCreateCmd() *cobra.Command

func GetLoginCmd

func GetLoginCmd() *cobra.Command

func GetResetPasswordCmd

func GetResetPasswordCmd() *cobra.Command