Review summary

Verdict

Approved PR buildkite/cli#975 at commit ae23c0b5c1148a25ed7639d8057f899ced37f69f with no inline findings.

Change reviewed

This PR allows bk auth login --device --org <organization> instead of rejecting the --device/--org combination. The device-login path now uses the same existing organization identifier handling as browser login: canonical UUIDs populate oauth.Config.OrgUUID, while other values populate oauth.Config.OrgSlug.

pkg/oauth.RequestDeviceAuthorization encodes the hint in the device authorization form as either organization_uuid or organization, preferring UUID when both configuration fields are set. Requests without an organization remain unchanged. The command help now demonstrates device login for a specific organization.

Tests were updated at both layers:

• cmd/auth/login_test.go verifies that device login accepts --org and that the end-to-end command flow sends the slug hint.
• pkg/oauth/device_test.go verifies requests with no hint, a slug hint, and a UUID hint, including UUID precedence.

Evidence examined

I read the complete four-file diff and the full changed files:

• cmd/auth/login.go
• cmd/auth/login_test.go
• pkg/oauth/oauth.go
• pkg/oauth/device_test.go

I traced all Go call sites for organizationIdentifier, runDeviceLogin, RequestDeviceAuthorization, OrgSlug, and OrgUUID, and compared the new device-flow behavior with the established browser authorization path in pkg/oauth/oauth.go and its tests in pkg/oauth/oauth_test.go.

I also inspected the related server-side implementation in buildkite/buildkite#33566, which is merged. It accepts the same form field names, resolves the optional organization, and leaves membership/selection enforcement in the consent flow. The related documentation PR explicitly describes these values as preselection hints rather than access controls.

No Linear issue identifier was present in the branch name, PR title, or PR description, so there was no Linear issue to inspect.

Checks

GitHub reports the Buildkite CLI build for this exact commit as successful: buildkite/buildkite-cli build #3469 passed in 2 minutes 51 seconds. Both Socket Security checks also passed/skipped without dependency alerts.

I did not run the Go tests or linter locally because neither the pinned Go toolchain nor mise was available in the review workspace. The successful repository CI status is therefore the execution evidence used for this review; the PR description's local-test claims were not treated as checks run by this reviewer.

Notes

The change is additive and preserves the previous request shape when --org is omitted. UUID-versus-slug handling matches browser login, URL form encoding is handled by url.Values, and the device token polling/exchange paths are unchanged. I found no correctness, security, data-integrity, API-contract, or resource-management issue requiring feedback.

Trigger source: comment.