auth: import a captured refresh token (#55)

[ironlukas1]

Why

I hit #55 from the reporter's side: my Liftoff account was created with Google Sign-In, so I have no password and auth login is a dead end. LIFTOFF_REFRESH_TOKEN only helps once you already hold a token, and per the maintainer's note on #55 the only way a Google account can get one is to read it off the phone app with mitmproxy/Proxyman.

The gap this PR closes: once you have captured that token, there's no CLI affordance for storing it. Today it means hand-writing ~/.config/liftoff-export/auth.json with a correctly formatted expires_at. internal/auth.SaveFromCapture was already written for exactly this case but nothing referenced it.

What

New auth import subcommand:

Invocation	Behaviour
auth import --refresh-token "$RT" (or token on stdin)	Exchanges the token via user.refreshToken — verifies it and fills in the real expiry — then saves to the normal token file.
auth import --no-verify --refresh-token … --access-token … --expires-at …	Writes the captured triple with no network call. Wires up the existing auth.SaveFromCapture.

Everything else is unchanged.

Contract / scope notes

• Additive to the auth surface — auth login / logout / refresh / status still behave exactly as before (CONTRACT §5).
• auth import --help makes no network call (§7); verified manually and the existing hermeticity posture is untouched.
• Does not implement native Google Sign-In. That still needs the user.signIn request capture the maintainer asked for on Google Sign-In accounts have no way to authenticate via auth login #55. This just gives Google-only accounts a supported path for the proxy-captured token instead of a hand-edited JSON file, so I've marked it Refs #55, not Closes.

Tests

cmd/auth_test.go: --no-verify round-trips the captured tokens to disk with no network, --no-verify without its companion flags is a clean error, and an empty refresh token is a clean error. go vet ./..., go test ./..., and the TestContractFormats compat suite all pass locally.

Try it

go build -o /tmp/liftoff-export .
/tmp/liftoff-export auth import --no-verify \
  --refresh-token rt --access-token at --expires-at 2099-01-02T15:04:05Z

🤖 Generated with Claude Code

https://claude.ai/code/session_015zkLbCGpBdq4SoCitH1dZZ

[Copilot]

Pull request overview

Adds a new liftoff-export auth import subcommand to let users persist a proxy-captured Liftoff refresh token to the standard on-disk auth store, primarily to support Google Sign-In accounts that cannot use auth login (Refs #55).

Changes:

• Introduces auth import with a default “verify + exchange + save” path and a --no-verify offline write path.
• Documents the new flow and Google Sign-In limitations in CLI docs/help text.
• Adds command-level tests to ensure --no-verify writes tokens to disk and validates required flags.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
README.md	Documents auth import usage and the Google Sign-In proxy-capture workflow.
cmd/prime.go	Updates “GOTCHAS” to mention persisting a captured token via auth import.
cmd/auth.go	Adds the auth import Cobra subcommand and its flag handling.
cmd/auth_test.go	Adds tests covering auth import --no-verify success and error cases.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.