Prefer an available OAuth flow instead of hard-coding device code

util/common.go

@@ -3,6 +3,7 @@ package util
 import (
 	"os"
 	"os/exec"
+	"runtime"
 
 	"github.com/skratchdot/open-golang/open"
 )
@@ -15,6 +16,39 @@ func OpenBrowser(url string) error {
 	return open.Run(url)
 }
 
+// browserSessionEnvVars returns the variables that decide whether OpenBrowser can open a URL:
+// BROWSER is the explicit override it honors first, DESKTOP_SESSION and XDG_CURRENT_DESKTOP are
+// what xdg-open uses to pick a handler, and DISPLAY / WAYLAND_DISPLAY are what any graphical
+// browser it launches needs.
+func browserSessionEnvVars() []string {
+	return []string{"BROWSER", "DESKTOP_SESSION", "XDG_CURRENT_DESKTOP", "DISPLAY", "WAYLAND_DISPLAY"}
+}
+
+// HasGraphicalSession reports whether this process can open a browser and serve a loopback
+// redirect back to it. Windows and macOS always can. On Linux and FreeBSD the answer is env
+// based, so it only holds for a process started from the graphical session itself: a service
+// does not inherit those variables and always reports false, which is why callers running in
+// the user's session pass their own answer to the daemon.
+func HasGraphicalSession() bool {
+	if runtime.GOOS != "linux" && runtime.GOOS != "freebsd" {
+		return true
+	}
+
+	for _, env := range browserSessionEnvVars() {
+		if os.Getenv(env) != "" {
+			return true
+		}
+	}
+
+	// tty and unspecified sessions have no display; anything else (x11, wayland, mir) does
+	switch os.Getenv("XDG_SESSION_TYPE") {
+	case "", "tty", "unspecified":
+		return false
+	default:
+		return true
+	}
+}
+
 // SliceDiff returns the elements in slice `x` that are not in slice `y`
 func SliceDiff(x, y []string) []string {
 	mapY := make(map[string]struct{}, len(y))

util/session_test.go

@@ -0,0 +1,47 @@
+package util
+
+import (
+	"os"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestHasGraphicalSession(t *testing.T) {
+	if runtime.GOOS != "linux" && runtime.GOOS != "freebsd" {
+		assert.True(t, HasGraphicalSession(), "%s always has a graphical session", runtime.GOOS)
+		return
+	}
+
+	// clear anything inherited from the session running the test, restored on cleanup
+	for _, env := range append(browserSessionEnvVars(), "XDG_SESSION_TYPE") {
+		t.Setenv(env, "")
+		os.Unsetenv(env)
+	}
+
+	assert.False(t, HasGraphicalSession(), "no session variables means no graphical session")
+
+	tests := []struct {
+		env      string
+		value    string
+		expected bool
+	}{
+		{env: "DISPLAY", value: ":0", expected: true},
+		{env: "WAYLAND_DISPLAY", value: "wayland-0", expected: true},
+		{env: "DESKTOP_SESSION", value: "gnome", expected: true},
+		{env: "XDG_CURRENT_DESKTOP", value: "KDE", expected: true},
+		{env: "BROWSER", value: "firefox", expected: true},
+		{env: "XDG_SESSION_TYPE", value: "wayland", expected: true},
+		{env: "XDG_SESSION_TYPE", value: "x11", expected: true},
+		{env: "XDG_SESSION_TYPE", value: "tty", expected: false},
+		{env: "XDG_SESSION_TYPE", value: "unspecified", expected: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.env+"="+tt.value, func(t *testing.T) {
+			t.Setenv(tt.env, tt.value)
+			assert.Equal(t, tt.expected, HasGraphicalSession(), "%s=%s", tt.env, tt.value)
+		})
+	}
+}