Backlog auth commands (specfact backlog auth)

[djm81]

Backlog auth commands (specfact backlog auth)

Why

Module-migration-03 removes the auth module from core and keeps only a central auth interface (token storage by provider_id). Auth for DevOps providers (GitHub, Azure DevOps) belongs with the backlog domain: users who install the backlog bundle need specfact backlog auth azure-devops and specfact backlog auth github, not a global specfact auth. This change implements those commands in the specfact-cli-modules backlog bundle so that after migration-03, backlog users get auth under specfact backlog auth.

What Changes

• specfact-cli-modules (backlog bundle): Add a backlog auth subgroup to the backlog Typer app with subcommands:
  • specfact backlog auth azure-devops (options: --pat, --use-device-code; same behaviour as former specfact auth azure-devops)
  • specfact backlog auth github (device code flow; same as former specfact auth github)
  • specfact backlog auth status — show stored tokens for github / azure-devops
  • specfact backlog auth clear — clear stored tokens (optionally by provider)
• Implementation: Auth command implementations use the central auth interface from specfact-cli core (specfact_cli.utils.auth_tokens: get_token, set_token, clear_token, clear_all_tokens) to store and retrieve tokens. No duplicate token storage logic; the backlog bundle depends on specfact-cli and calls the same interface that adapters (GitHub, Azure DevOps) in the bundle use.
• specfact-cli: No code changes in this repo; migration-03 already provides the central auth interface and removes the auth module.

Capabilities

• backlog-auth-commands: When the specfact-backlog bundle is installed, the CLI exposes specfact backlog auth with subcommands azure-devops, github, status, clear. Each subcommand uses the core auth interface for persistence. Existing tokens stored by a previous specfact auth (pre–migration-03) continue to work because the storage path and provider_ids are unchanged.

Impact

• Affected code: specfact-cli-modules repo only — backlog bundle (e.g. packages/specfact-backlog/ or equivalent). Add auth as a subcommand group under the backlog app; implement by moving/copying the former auth command logic from specfact-cli modules/auth and wiring it to specfact_cli.utils.auth_tokens.
• Affected documentation: specfact-cli docs/reference/authentication.md — update to state that auth commands are specfact backlog auth when the backlog bundle is installed; remove references to top-level specfact auth. Optionally update in this change or in migration-03 doc tasks.
• Backward compatibility: Users who had used specfact auth must switch to specfact backlog auth after installing the backlog bundle (migration-03 already documents this). No breaking change in the core repo from this change.
• Blocked by: module-migration-03-core-slimming (central auth interface must exist in core; auth module removed from core).

Follow-up

None. This is the follow-up to module-migration-03 for auth commands.

---

OpenSpec Change Proposal: backlog-auth-01-backlog-auth-commands