feat(cache): copy-code login for remote shells, logout and sign-in hardening

README.md

@@ -308,7 +308,9 @@ cache after one `aster cache login`: it opens your browser, you sign in with
 your company account and confirm, and Aster stores a read-only token under
 `$XDG_CONFIG_HOME/aster` (else `~/.config/aster`) until it expires. Signed
 out, Aster prints one line (`not signed in; run aster cache login`) and
-continues with the local cache. See
+continues with the local cache. Over SSH or on a devbox, where the browser
+cannot reach the CLI, it prints a URL and you paste back a one-time code;
+`aster cache logout` signs out everywhere. See
 [Reading the cache from a laptop](docs/test-tracking.md#reading-the-cache-from-a-laptop).
 The same sign-in reads the flaky, broken, cluster and quarantine data the
 dashboard shows: `aster srv flaky`, `aster srv clusters`, `aster srv get <path>`

crates/aster-srv/src/auth.rs

@@ -575,13 +575,11 @@ mod tests {
             .issue("accounts.google.com:1", "ada@example.com")
             .unwrap()
             .token;
-        assert_eq!(
+        assert!(matches!(
             principal(Some(&issuer), &person).await,
-            Ok(Principal::Person(crate::person::Person {
-                subject: "accounts.google.com:1".into(),
-                email: "ada@example.com".into()
-            }))
-        );
+            Ok(Principal::Person(p))
+                if p.subject == "accounts.google.com:1" && p.email == "ada@example.com"
+        ));
         let ci = token(claims("ArchAstro/firstlanding"), "k1");
         assert!(matches!(
             principal(Some(&issuer), &ci).await,

crates/aster-srv/src/cache/policy.rs

@@ -265,6 +265,7 @@ mod tests {
         let person = |email: &str| Person {
             subject: "accounts.google.com:1".into(),
             email: email.into(),
+            issued_at: 0,
         };
         let repo = "ArchAstro/firstlanding";
         let allow = &config.repositories;