[jonatascastro12]

Summary

Adds workos connection test <id> — an end-to-end SSO smoke test for a connection, run entirely from the CLI:

1. Registers http://localhost:<port>/callback as an environment redirect URI automatically via the existing POST /user_management/redirect_uris wrapper (client.redirectUris.add). If registration fails (e.g. insufficient permissions), it prints the URI and asks the user to add it in the Dashboard before continuing (errors out in agent/CI mode instead of prompting).
2. Builds an SSO authorize URL with sso.getAuthorizationUrl({ clientId, redirectUri, connection, state }), where clientId resolves from --client-id → WORKOS_CLIENT_ID → the active environment's stored client ID.
3. Starts a localhost HTTP callback server, opens the URL in the browser (--no-open to disable), waits for the IdP redirect (default 300s timeout, --timeout to override), validates state, exchanges the code via sso.getProfileAndToken, and prints the authenticated profile.

Flags: --client-id, --port (default 4807), --timeout, --open/--no-open, plus the usual --api-key/--json.

JSON mode outputs { connectionId, redirectUri, redirectUriRegistered, authorizationUrl, profile }.

Also registered in bin.ts and the help-json.ts command registry, with spec coverage for the happy path, flag overrides, IdP error callbacks, state mismatch, registration fallback prompts, agent-mode behavior, and JSON output.

Test plan

• pnpm test (2102 passed), pnpm typecheck, pnpm lint, pnpm format:check, pnpm build all pass
• New unit tests in src/commands/connection.spec.ts mock the HTTP server, browser open, and SDK to exercise the full callback flow

Link to Devin session: https://app.devin.ai/sessions/68e059345eaa4022851eb4f324d9c361
Requested by: @jonatascastro12

[devin-ai-integration]

Original prompt from jonatas

https://github.com/workos/cli/blob/main/src/commands/connection.ts

Can you create a command to test a connection?

It should first:

• ask the customer to add a redirect URI that points to the CLI (a localhost on some port perhaps) [unless we already have a endpoint that adds a redirect URI in the environment, so we could automatically add it]
• create an SSO authorize URL with the default application client ID and redirect_uri that redirects to the one suggested above

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; all three numbered findings are fixed and no new actionable issues were found.

Summary

Adds workos connection test <id> to run an SSO login, receive a localhost callback, and print the authenticated profile.

• The CLI can now test an SSO connection with a real login.

Diagram

sequenceDiagram
    participant User
    participant CLI
    participant WorkOS
    participant Browser
    CLI->>WorkOS: Register localhost redirect URI
    CLI->>CLI: Start callback server
    CLI-->>User: Show authorization URL
    User->>Browser: Complete SSO login
    Browser->>CLI: Return code and state
    CLI->>CLI: Check state
    CLI->>WorkOS: Exchange code
    WorkOS-->>CLI: Return profile
    CLI-->>User: Print profile

Loading

_{Reviews (7) · Last reviewed commit: "fix: address greptile review on connecti..." · Reviewed by Greptile}

[devin-ai-integration]

❌ Cannot revive Devin session - the session is too old. Please start a new session instead.

[nicknisi]

Merged main back into this branch (67127a8) and fixed the four conflicting files:

• Kept test next to the new create / update subcommands from feat: add connection create and update commands #221, in both bin.ts and help-json.ts.
• Switched clack to ui to match the UI migration on main.
• Changed the no-client-ID hint to use formatWorkOSCommand('profile add'). Main now has a guard test that blocks hardcoded workos <cmd> hints, and env is now an alias of profile.

Added one fix of my own (0027b48): the command now refuses sk_live_ keys with a clear error. Production environments don't allow http/localhost redirect URIs (docs). Before this, a production run would fail to register the URI and then ask the user to add it in the Dashboard, which the Dashboard also rejects.

bun run test (3507 tests), typecheck, oxlint, oxfmt --check and the build all pass. Nobody has run this end to end yet; the tests mock the SDK, the HTTP server and the browser. Before merging, someone should run it once against a staging environment's Test IdP connection.

[devin-ai-integration]

❌ Cannot revive Devin session - the session is too old. Please start a new session instead.

View session