alt-where-cli-is-unaware-of-oauth2

    sequenceDiagram
        actor user as User
        participant cli as Nextstrain CLI
        participant .org as nextstrain.org
        participant idp as IdP

        user->>cli: nextstrain login
        activate cli

        note over cli: generates {uuid} (v4)

        cli->>user: "Visit /cli/login/{uuid}"
        user-->>.org: GET /cli/login/{uuid}
        activate .org
        note over .org: stores {uuid} in session
        .org-->>idp: Location: /authorize?state&code_challenge&…
        deactivate .org

        activate idp
        user-->>idp: Logs in
        idp-->>.org: Location: /cli/logged-in?code&state
        deactivate idp

        activate .org
        .org-->>user: "Confirm intent to log in to the CLI"
        user-->>.org: confirms (or denies)
        note over .org: exchanges code for tokens <br> stores them <br> keyed by uuid <br> (or discards)
        .org-->>user: "Login complete, return to the terminal."
        deactivate .org

        cli->>.org: GET /cli/logged-in/{uuid}
        activate .org
        note over cli,.org: polling
        note over .org: deletes tokens <br> keyed by uuid
        .org->>cli: {id_token, access_token, refresh_token}
        deactivate .org

        cli->>user: success
        deactivate cli