Sign in through the server's single sign-on, with a code

The sign-in screen asks the server how it can be signed in to
(GET /api/auth/config) and offers what it finds: the password form, and
"Sign in with <provider>" when the server can do a device login. The TUI
shows a link and a short code, the person approves it in any browser, and
the next poll hands over the ordinary session, so it works over SSH where
no browser can be opened. The terminal never talks to the identity
provider.

The password form is hidden when the server has turned password login
off. `auth: sso` in config.yaml starts the SSO login straight away, but not
right after signing out, where that would sign the person straight back
in; any other value is refused when the config is read. Polling honours the
server's interval, backs off on slow_down, and gives up after repeated
failures rather than retrying forever.

A server without /api/auth/config answers 404 and is treated as passwords
only, so the sign-in screen is the one it had. Needs terdut-server v0.29.0
for SSO.

.gitea/workflows/ci.yaml

@@ -56,34 +56,8 @@ jobs:
             git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
           fi
 
-      # This exists because `go vet` does not look at import order: the move to
-      # git.ryuvia.com rewrote every import path without re-sorting, the new path sorts
-      # before github.com/..., and both repos sat unformatted through a green CI run and
-      # a release before anyone noticed.
-      #
-      # Both of gofmt's failure modes need handling, and they are not alike. A file that
-      # is merely misformatted is listed on stdout with exit 0 -- so the failure has to
-      # be raised by hand. A file that does not parse is the opposite: nothing on stdout
-      # and exit 2, which a naive `[ -n "$unformatted" ]` reads as success. The first
-      # draft of this step had exactly that hole.
-      - name: Format
-        run: |
-          if ! unformatted=$(gofmt -l .); then
-            echo "::error::gofmt could not parse the tree"
-            gofmt -l .    # re-run unredirected so the parse errors reach the log
-            exit 1
-          fi
-          if [ -n "$unformatted" ]; then
-            echo "::error::not gofmt'd:"
-            echo "$unformatted"
-            gofmt -d .
-            exit 1
-          fi
-
-      - name: Vet
-        run: go vet ./...
-
-      # Covers the API client against a stub server, the Update state machine, and View
-      # rendering -- all three are pure enough to test without a terminal.
-      - name: Test
-        run: go test ./...
+      # The Makefile is the single definition of the gate -- gofmt with both of its failure
+      # modes handled, go vet, and the tests -- so this is exactly what a developer and the
+      # release skill run. See the comments on the targets for why each is shaped as it is.
+      - name: Format, vet and test
+        run: make fmt lint test

.gitea/workflows/release.yaml

@@ -8,9 +8,9 @@ name: Release
 # the job that publishes them. Nothing is handed between jobs.
 #
 # The asset names matter beyond being tidy: internal/updater looks for exactly
-# terdut-tui-<tag>-<goos>-<goarch> in the latest release and reports every available name
-# when it cannot find one. Renaming the pattern here breaks self-update for every
-# installed binary.
+# terdut-tui-<tag>-<goos>-<goarch> in the latest release. The pattern is defined once, by
+# `make dist` (and `make dist-assets`, which the release skill checks the published release
+# against) -- see DIST_TARGETS in the Makefile before touching it.
 on:
   push:
     tags:
@@ -41,35 +41,9 @@ jobs:
           REF_NAME: ${{ github.ref_name }}
         run: git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
 
-      # This exists because `go vet` does not look at import order: the move to
-      # git.ryuvia.com rewrote every import path without re-sorting, the new path sorts
-      # before github.com/..., and both repos sat unformatted through a green CI run and
-      # a release before anyone noticed.
-      #
-      # Both of gofmt's failure modes need handling, and they are not alike. A file that
-      # is merely misformatted is listed on stdout with exit 0 -- so the failure has to
-      # be raised by hand. A file that does not parse is the opposite: nothing on stdout
-      # and exit 2, which a naive `[ -n "$unformatted" ]` reads as success. The first
-      # draft of this step had exactly that hole.
-      - name: Format
-        run: |
-          if ! unformatted=$(gofmt -l .); then
-            echo "::error::gofmt could not parse the tree"
-            gofmt -l .    # re-run unredirected so the parse errors reach the log
-            exit 1
-          fi
-          if [ -n "$unformatted" ]; then
-            echo "::error::not gofmt'd:"
-            echo "$unformatted"
-            gofmt -d .
-            exit 1
-          fi
-
-      - name: Vet
-        run: go vet ./...
-
-      - name: Test
-        run: go test ./...
+      # Same target CI and the release skill run; a tag that fails it publishes nothing.
+      - name: Format, vet and test
+        run: make fmt lint test
 
   binaries:
     needs: test
@@ -86,21 +60,12 @@ jobs:
           REF_NAME: ${{ github.ref_name }}
         run: git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
 
+      # The Makefile owns the target list and the asset names -- see DIST_TARGETS there for
+      # why the naming pattern cannot change.
       - name: Build every target
         env:
           REF_NAME: ${{ github.ref_name }}
-        run: |
-          set -eu
-          mkdir -p dist
-          for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64; do
-            GOOS="${target%/*}"
-            GOARCH="${target#*/}"
-            out="dist/terdut-tui-${REF_NAME}-${GOOS}-${GOARCH}"
-            echo "building $out"
-            GOOS="$GOOS" GOARCH="$GOARCH" go build \
-              -ldflags "-X main.version=${REF_NAME}" \
-              -o "$out" .
-          done
+        run: make dist VERSION="$REF_NAME"
 
       # Creating the release is made idempotent rather than assumed-new: a re-run of a
       # failed release must not die on the release that already exists. Assets are
@@ -126,6 +91,28 @@ jobs:
           [ -n "$release_id" ] || { echo "::error::could not determine release id"; exit 1; }
           echo "release id $release_id"
 
+          # The release notes are the tag's own message, minus its subject line: the
+          # tag body is the changelog for this project, and without this the release
+          # page stays empty. Only an annotated tag has one, and only a release with
+          # no notes is filled, so a re-run repairs a release created empty without
+          # overwriting notes somebody has since edited by hand.
+          #
+          # There is no jq in this image, so the JSON string is escaped by hand:
+          # backslashes first (or the ones added next would double), then quotes and
+          # tabs, then each line end becomes a literal \n.
+          if [ "$(git cat-file -t "$REF_NAME")" = tag ] \
+             && printf '%s' "$body" | grep -q '"body":""'; then
+            notes=$(git tag -l --format='%(contents)' "$REF_NAME" | sed '1,2d')
+            if [ -n "$notes" ]; then
+              notes_json=$(printf '%s\n' "$notes" \
+                | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' -e 's/\t/\\t/g' -e 's/\r$//' \
+                | awk 'BEGIN { ORS = "\\n" } { print }')
+              echo "setting release notes from the tag message"
+              curl -sf -X PATCH -H "$auth" -H 'Content-Type: application/json' \
+                -d "{\"body\":\"$notes_json\"}" "$API/releases/$release_id" > /dev/null
+            fi
+          fi
+
           for f in dist/*; do
             name=$(basename "$f")
             # Drop an existing asset of the same name first: Gitea happily stores two

.gitignore

@@ -1,2 +1,3 @@
 terdut-tui
 .graymatter/
+dist/

.release.conf

@@ -0,0 +1,9 @@
+# Read by the `release` skill (~/.claude/skills/release).
+#
+# terdut-tui publishes binaries to a Gitea release and nothing else: no image, no Helm
+# chart, no wrapper in Ryuvia/charts. KIND=binary tells the skill to gate, tag, wait for
+# release.yaml and verify the published assets, and to skip the chart steps.
+KIND=binary
+
+# English, like the rest of the terdut projects.
+PROSE_LANG=en

CLAUDE.md

@@ -23,6 +23,25 @@ All user actions target incidents. Two server behaviours the UI has to respect:
 manual resolve is **terminal** (hence the confirmation prompt), and snooze is the
 non-destructive "not now" alternative.
 
+## Release
+
+Say **"Release"** (or "Release X.Y.Z") and the `release` skill runs it. This repo is
+`KIND=binary` in `.release.conf`: it publishes binaries to a Gitea release and has no image,
+chart or wrapper-chart PR. The run is gate, commit, push, tag, wait for `release.yaml`, then
+`verify-release`. Preconditions and the plan, without side effects:
+
+```sh
+~/.claude/skills/release/scripts/release-preflight          # state + suggested version
+~/.claude/skills/release/scripts/release-preflight vX.Y.Z   # validate that release
+```
+
+- `make fmt lint test` is the gate, and it **is** what `ci.yaml` and `release.yaml` run.
+- `make dist VERSION=vX.Y.Z` builds the four binaries; `make dist-assets` lists their names.
+  The pattern `terdut-tui-<tag>-<goos>-<goarch>` is the self-updater's contract with every
+  installed binary, so changing it breaks self-update.
+- **The annotated tag's message becomes the release notes** (`release.yaml` copies it, minus
+  its subject line). Write it for a reader of the release page. Never move a published tag.
+
 ## Tech stack
 
 - Go 1.25+
@@ -62,7 +81,7 @@ Location: `~/.config/terdut-tui/config.yaml`
 
 ```yaml
 server_url: https://terdut.example.com
-api_key: <64-char hex key>
+username: niklas      # optional, prefills the sign-in form
 refresh_interval: 30  # seconds, optional, default 30
 theme: gruvbox-dark   # optional, default gruvbox-dark
 team: Ops             # optional, team name or id to start on, default all
@@ -72,7 +91,14 @@ Built-in themes are `gruvbox-dark` and `gruvbox-light`; user themes are YAML
 files in `~/.config/terdut-tui/themes/`, optionally `extends:`-ing a built-in.
 See the README for the token list.
 
-The API key is a one-time secret generated by terdut-server (`POST /api/users/{id}/api-keys`).
+There is no API key in the config. The TUI signs in as a user (`POST /api/login`, the
+same session cookie as the web UI) and `internal/session` keeps the token in
+`~/.config/terdut-tui/session.json`, mode 0600, keyed by server URL. The client
+attaches `terdut_session` itself rather than using a cookie jar, because a jar drops the
+server's Secure cookie over plain http. It must never send `Authorization` as well: the
+server judges a request with that header on it alone. A 401 from anything (`msgError`
+in `update.go`) returns to the sign-in form and clears `Model`. A user with no password
+cannot sign in, and the server answers it like a wrong one, so the form says so.
 
 ## Running
 
@@ -105,6 +131,7 @@ go build -ldflags="-X main.version=v0.1.0" -o terdut-tui .
 | 5 | User management and API key lifecycle |
 | 6 | Incidents: queue, timeline, ack/assign/snooze/resolve, MTTA/MTTR |
 | 7 | Teams: `T` switcher, per-team schedule, admin/disabled markers (server v0.20) |
+| 8 | Sign in as a user instead of an API key (server v0.10+ session cookie) |
 
 <!-- graymatter:instructions:begin — managed by `graymatter init`; edits inside this block are overwritten -->
 ## Memory (GrayMatter)

Makefile

@@ -1,6 +1,6 @@
 VERSION := $(shell git describe --tags --always --dirty)
 
-.PHONY: build install test
+.PHONY: build install test lint fmt dist dist-assets release-vars
 
 build:
 	go build -ldflags "-X main.version=$(VERSION)" -o terdut-tui .
@@ -8,5 +8,59 @@ build:
 install:
 	go install -ldflags "-X main.version=$(VERSION)" .
 
-test:
+# ci.yaml and release.yaml run `make fmt lint test`, so a green gate here and a green
+# pipeline are the same code rather than two descriptions of it. It is also what the
+# release skill runs before tagging.
+
+# Covers the API client against a stub server, the sign-in flow, the Update state
+# machine, and View rendering -- all pure enough to test without a terminal.
+test: ## Run the test suite
 	go test ./...
+
+lint: ## go vet
+	go vet ./...
+
+# This exists because `go vet` does not look at import order: the move to
+# git.ryuvia.com rewrote every import path without re-sorting, the new path sorts
+# before github.com/..., and both repos sat unformatted through a green CI run and
+# a release before anyone noticed.
+#
+# Both of gofmt's failure modes need handling, and they are not alike. A file that
+# is merely misformatted is listed on stdout with exit 0 -- so the failure has to
+# be raised by hand. A file that does not parse is the opposite: nothing on stdout
+# and exit 2, which a naive `[ -n "$$unformatted" ]` reads as success. The first
+# draft of this target had exactly that hole.
+fmt: ## Fail on files that are not gofmt'd
+	@if ! unformatted=$$(gofmt -l .); then \
+		echo "gofmt could not parse the tree:"; gofmt -l .; exit 1; \
+	fi; \
+	if [ -n "$$unformatted" ]; then \
+		echo "not gofmt'd:"; echo "$$unformatted"; gofmt -d .; exit 1; \
+	fi
+
+# What a release publishes. The asset names matter beyond being tidy: internal/updater
+# looks for exactly terdut-tui-<tag>-<goos>-<goarch> in the latest release and reports
+# every available name when it cannot find one. Renaming the pattern here breaks
+# self-update for every installed binary.
+DIST_TARGETS := linux/amd64 linux/arm64 darwin/amd64 darwin/arm64
+
+dist: ## Build every release binary into dist/ (VERSION=vX.Y.Z to name them)
+	@set -eu; mkdir -p dist; \
+	for target in $(DIST_TARGETS); do \
+		goos="$${target%/*}"; goarch="$${target#*/}"; \
+		out="dist/terdut-tui-$(VERSION)-$$goos-$$goarch"; \
+		echo "building $$out"; \
+		GOOS="$$goos" GOARCH="$$goarch" go build -ldflags "-X main.version=$(VERSION)" -o "$$out" .; \
+	done
+
+# The names dist produces, one per line, so the release skill can check the published
+# release has every one of them rather than a count.
+dist-assets: ## Print the asset names a release of VERSION carries
+	@for target in $(DIST_TARGETS); do \
+		echo "terdut-tui-$(VERSION)-$${target%/*}-$${target#*/}"; \
+	done
+
+# Read by the release skill for a repo that publishes binaries and no image or chart
+# (KIND=binary in .release.conf). There is nothing to say about images or charts.
+release-vars: ## Print the variables the release process reads
+	@printf 'APP=terdut-tui\n'

README.md

@@ -32,8 +32,8 @@ The schedule is one team's rota, so the Schedule section shows the active team,
 or with *all* showing the first team you own. Only a team's owners, and
 administrators, can change its rota; anyone else gets the reason in the status
 bar instead of a picker. The picker offers only that team's members, because the
-server refuses anybody else. Stats are not team-scoped by the server and always
-cover all your teams.
+server refuses anybody else. Stats always cover all your teams; the server
+cannot narrow them to one.
 
 Administrators are the only users who can create or delete users, or act on
 someone else's password, topic or API keys. Everyone can manage their own.
@@ -85,13 +85,31 @@ Create `~/.config/terdut-tui/config.yaml`:
 
 ```yaml
 server_url: https://terdut.example.com
-api_key: <your-api-key>
+username: niklas      # optional, prefills the sign-in form
 refresh_interval: 30  # seconds, optional
 theme: gruvbox-dark   # optional, this is the default
 team: Ops             # optional, a team name or id to start on; default is all
 ```
 
-The API key is generated in terdut-server. See the server documentation for how to bootstrap a user and issue an API key.
+## Signing in
+
+The TUI signs in the way the web UI does: with a user account's username and
+password, on a form shown at start. It keeps the server's session, not the
+password, in `~/.config/terdut-tui/session.json` (readable by you only), so the
+next start resumes it. The server's sessions last 30 days and slide with use.
+When it has ended, or the account is disabled or the session is ended from the web
+UI, the TUI returns to the form and says so. `L` signs out, which also ends the
+session on the server and deletes the saved one.
+
+The account needs a password, since that is what signing in uses. A user
+created only for API access has none and cannot sign in: the server answers it
+exactly like a wrong password. Set one in the web UI, or have an administrator
+press `p` on that user in Users. Too many failed attempts are rate limited by
+the server for a few minutes.
+
+> **Upgrading from v0.10.0 and earlier:** `api_key` in `config.yaml` is no longer
+> used. Remove it and sign in. API keys still exist on the server, and `k` in
+> Users still manages them, for whatever else uses them.
 
 ## Themes
 
@@ -152,6 +170,7 @@ Global:
 | `esc` | Go back |
 | `r` | Refresh |
 | `f` | Cycle filter |
+| `L` | Sign out |
 | `T` | Switch team: all → each of your teams (when you have more than one) |
 | `q` | Quit |
 

internal/api/client.go

@@ -3,6 +3,7 @@ package api
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"net/url"
@@ -11,29 +12,190 @@ import (
 	"time"
 )
 
+// SessionCookie is the cookie terdut-server's web UI signs in with.
+const SessionCookie = "terdut_session"
+
+// Client talks to terdut-server as the user who signed in. Login trades a
+// username and password for a session, the same one the web UI holds, and every
+// request after it carries that session's cookie.
+//
+// The cookie is attached by hand rather than through a cookie jar: the server
+// marks it Secure behind https, and a jar drops a Secure cookie it is handed
+// over plain http, which would make a local server unusable for no reason. There
+// is nothing else a jar would do here — the token is opaque and does not change
+// while the session lives.
 type Client struct {
 	baseURL    string
 	httpClient *http.Client
-	apiKey     string
+	session    string
 }
 
-func NewClient(baseURL, apiKey string) *Client {
+func NewClient(baseURL string) *Client {
 	return &Client{
 		baseURL: strings.TrimRight(baseURL, "/"),
-		apiKey:  apiKey,
 		httpClient: &http.Client{
 			Timeout: 10 * time.Second,
 		},
 	}
 }
 
+// SetSession resumes a session from a token saved earlier.
+func (c *Client) SetSession(token string) { c.session = token }
+
+// HasSession reports whether there is a session to try. It says nothing about
+// whether the server still honours it.
+func (c *Client) HasSession() bool { return c.session != "" }
+
+// Login signs in and returns the session token, which the client also keeps and
+// sends from then on. The server answers a wrong password, an unknown user and
+// an account with no password all with the same 401, so the caller cannot tell
+// them apart. Too many failures come back as 429.
+func (c *Client) Login(username, password string) (string, error) {
+	body := struct {
+		Username string `json:"username"`
+		Password string `json:"password"`
+	}{Username: username, Password: password}
+	req, err := c.newRequestWithBody(http.MethodPost, "/api/login", body)
+	if err != nil {
+		return "", err
+	}
+	// A stale session must not ride along on the request that replaces it.
+	req.Header.Del("Cookie")
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 400 {
+		return "", statusError(resp)
+	}
+	for _, ck := range resp.Cookies() {
+		if ck.Name == SessionCookie && ck.Value != "" {
+			c.session = ck.Value
+			return ck.Value, nil
+		}
+	}
+	return "", fmt.Errorf("server signed us in but sent no %s cookie", SessionCookie)
+}
+
+// AuthConfig asks how the server can be signed in to. It is unauthenticated, so
+// it works before anybody has signed in.
+func (c *Client) AuthConfig() (AuthConfig, error) {
+	var cfg AuthConfig
+	req, err := http.NewRequest(http.MethodGet, c.baseURL+"/api/auth/config", nil)
+	if err != nil {
+		return cfg, err
+	}
+	req.Header.Set("Accept", "application/json")
+	err = c.do(req, &cfg)
+	return cfg, err
+}
+
+// The ways a device login poll can end other than with a session.
+var (
+	// ErrDevicePending means nobody has approved yet: poll again after the
+	// interval.
+	ErrDevicePending = errors.New("waiting for approval")
+
+	// ErrDeviceSlowDown means the server was polled faster than it asked. It is
+	// not a failure; poll again, a little slower.
+	ErrDeviceSlowDown = errors.New("polling too fast")
+
+	// ErrDeviceExpired means the person took too long, or the server forgot the
+	// login. ErrDeviceDenied means they refused it.
+	ErrDeviceExpired = errors.New("the sign-in expired")
+	ErrDeviceDenied  = errors.New("the sign-in was refused")
+)
+
+// StartDeviceLogin asks the server to begin a device login.
+func (c *Client) StartDeviceLogin() (*DeviceLogin, error) {
+	req, err := c.newRequestWithBody(http.MethodPost, "/api/oidc/device", struct{}{})
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Del("Cookie")
+	var d DeviceLogin
+	if err := c.do(req, &d); err != nil {
+		return nil, err
+	}
+	if d.DeviceCode == "" || d.UserCode == "" || d.VerificationURL == "" {
+		return nil, errors.New("server started a sign-in but sent no code")
+	}
+	return &d, nil
+}
+
+// PollDeviceLogin asks whether the person has approved. On approval it returns
+// the session token, which the client also keeps; until then it returns one of
+// the ErrDevice* errors.
+func (c *Client) PollDeviceLogin(deviceCode string) (string, error) {
+	req, err := c.newRequestWithBody(http.MethodPost, "/api/oidc/device/token",
+		struct {
+			DeviceCode string `json:"device_code"`
+		}{deviceCode})
+	if err != nil {
+		return "", err
+	}
+	req.Header.Del("Cookie")
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+
+	switch resp.StatusCode {
+	case http.StatusAccepted:
+		return "", ErrDevicePending
+	case http.StatusTooManyRequests:
+		return "", ErrDeviceSlowDown
+	case http.StatusGone:
+		var e struct {
+			Error string `json:"error"`
+		}
+		_ = json.NewDecoder(resp.Body).Decode(&e)
+		if e.Error == "denied" {
+			return "", ErrDeviceDenied
+		}
+		return "", ErrDeviceExpired
+	}
+	if resp.StatusCode >= 400 {
+		return "", statusError(resp)
+	}
+	for _, ck := range resp.Cookies() {
+		if ck.Name == SessionCookie && ck.Value != "" {
+			c.session = ck.Value
+			return ck.Value, nil
+		}
+	}
+	return "", fmt.Errorf("server signed us in but sent no %s cookie", SessionCookie)
+}
+
+// Logout ends the session on the server and forgets it here.
+func (c *Client) Logout() error {
+	req, err := c.newRequest(http.MethodPost, "/api/logout")
+	if err != nil {
+		return err
+	}
+	err = c.do(req, nil)
+	c.session = ""
+	return err
+}
+
+// authorize puts the session on a request.
+func (c *Client) authorize(req *http.Request) {
+	req.Header.Set("Accept", "application/json")
+	if c.session != "" {
+		req.AddCookie(&http.Cookie{Name: SessionCookie, Value: c.session})
+	}
+}
+
 func (c *Client) newRequest(method, path string) (*http.Request, error) {
 	req, err := http.NewRequest(method, c.baseURL+path, nil)
 	if err != nil {
 		return nil, err
 	}
-	req.Header.Set("Authorization", "Bearer "+c.apiKey)
-	req.Header.Set("Accept", "application/json")
+	c.authorize(req)
 	return req, nil
 }
 
@@ -51,6 +213,21 @@ func (e *StatusError) Error() string {
 	return fmt.Sprintf("server returned %d", e.Code)
 }
 
+// IsUnauthorized reports whether err is the server refusing the session: it
+// expired, was ended elsewhere, or belongs to an account since disabled.
+func IsUnauthorized(err error) bool {
+	var se *StatusError
+	return errors.As(err, &se) && se.Code == http.StatusUnauthorized
+}
+
+func statusError(resp *http.Response) error {
+	var e struct {
+		Error string `json:"error"`
+	}
+	_ = json.NewDecoder(resp.Body).Decode(&e)
+	return &StatusError{Code: resp.StatusCode, Message: e.Error}
+}
+
 func (c *Client) do(req *http.Request, out any) error {
 	resp, err := c.httpClient.Do(req)
 	if err != nil {
@@ -59,11 +236,7 @@ func (c *Client) do(req *http.Request, out any) error {
 	defer resp.Body.Close()
 
 	if resp.StatusCode >= 400 {
-		var e struct {
-			Error string `json:"error"`
-		}
-		_ = json.NewDecoder(resp.Body).Decode(&e)
-		return &StatusError{Code: resp.StatusCode, Message: e.Error}
+		return statusError(resp)
 	}
 
 	if out != nil {
@@ -125,8 +298,7 @@ func (c *Client) newRequestWithBody(method, path string, body any) (*http.Reques
 	if err != nil {
 		return nil, err
 	}
-	req.Header.Set("Authorization", "Bearer "+c.apiKey)
-	req.Header.Set("Accept", "application/json")
+	c.authorize(req)
 	req.Header.Set("Content-Type", "application/json")
 	return req, nil
 }
@@ -196,6 +368,18 @@ func (c *Client) GetIncidentTimeline(id int64) ([]IncidentEvent, error) {
 	return events, c.do(req, &events)
 }
 
+// GetSimilarIncidents lists earlier resolved incidents that look like this one
+// and have notes. Servers before the similar-incidents endpoint answer 404; the
+// caller treats any error as "nothing to show".
+func (c *Client) GetSimilarIncidents(id int64) ([]SimilarIncident, error) {
+	req, err := c.newRequest(http.MethodGet, fmt.Sprintf("/api/incidents/%d/similar", id))
+	if err != nil {
+		return nil, err
+	}
+	var similar []SimilarIncident
+	return similar, c.do(req, &similar)
+}
+
 func (c *Client) AcknowledgeIncident(id int64) (*Incident, error) {
 	req, err := c.newRequest(http.MethodPost, fmt.Sprintf("/api/incidents/%d/acknowledge", id))
 	if err != nil {
@@ -277,10 +461,11 @@ func (c *Client) UnarchiveIncident(id int64) error {
 	return c.do(req, nil)
 }
 
-// AddNote appends a note to the incident's timeline.
-func (c *Client) AddNote(incidentID int64, content string) (*IncidentEvent, error) {
+// AddNote appends a note to the incident's timeline. pinned files it as the
+// resolution note: what fixed the incident, shown on similar ones later.
+func (c *Client) AddNote(incidentID int64, content string, pinned bool) (*IncidentEvent, error) {
 	req, err := c.newRequestWithBody(http.MethodPost,
-		fmt.Sprintf("/api/incidents/%d/notes", incidentID), map[string]string{"content": content})
+		fmt.Sprintf("/api/incidents/%d/notes", incidentID), map[string]any{"content": content, "pinned": pinned})
 	if err != nil {
 		return nil, err
 	}

internal/api/client_test.go

@@ -19,7 +19,9 @@ type call struct {
 	path   string
 	query  string
 	body   string
-	auth   string
+	cookie string
+	// authz is the Authorization header, which the client no longer sends at all.
+	authz string
 }
 
 // stub serves one canned response and records the request that fetched it.
@@ -29,22 +31,107 @@ func stub(t *testing.T, status int, response string) (*Client, *call) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		body, _ := io.ReadAll(r.Body)
 		got.method, got.path, got.query = r.Method, r.URL.Path, r.URL.RawQuery
-		got.body, got.auth = string(body), r.Header.Get("Authorization")
+		got.body, got.authz = string(body), r.Header.Get("Authorization")
+		if ck, err := r.Cookie(SessionCookie); err == nil {
+			got.cookie = ck.Value
+		}
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(status)
 		io.WriteString(w, response)
 	}))
 	t.Cleanup(srv.Close)
-	return NewClient(srv.URL, "test-key"), got
+	c := NewClient(srv.URL)
+	c.SetSession("test-session")
+	return c, got
 }
 
-func TestClient_SendsBearerToken(t *testing.T) {
+func TestClient_SendsTheSessionCookie(t *testing.T) {
 	c, got := stub(t, http.StatusOK, `[]`)
 	if _, err := c.ListIncidents(0, "", false, false, 0); err != nil {
 		t.Fatalf("list: %v", err)
 	}
-	if got.auth != "Bearer test-key" {
-		t.Errorf("expected bearer token, got %q", got.auth)
+	if got.cookie != "test-session" {
+		t.Errorf("expected the session cookie, got %q", got.cookie)
+	}
+	// The server judges a request with an Authorization header on that alone and
+	// never falls back to the cookie, so sending one would defeat the session.
+	if got.authz != "" {
+		t.Errorf("expected no Authorization header, got %q", got.authz)
+	}
+}
+
+// Login has to work over plain http, where a cookie jar would discard the
+// Secure cookie a server behind https sets.
+func TestLogin_KeepsTheSessionFromTheCookie(t *testing.T) {
+	var body string
+	var sentCookie bool
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		b, _ := io.ReadAll(r.Body)
+		body = string(b)
+		_, err := r.Cookie(SessionCookie)
+		sentCookie = err == nil
+		http.SetCookie(w, &http.Cookie{Name: SessionCookie, Value: "fresh", Path: "/", HttpOnly: true, Secure: true})
+		w.WriteHeader(http.StatusOK)
+		io.WriteString(w, `{"user":{"id":1},"has_password":true}`)
+	}))
+	t.Cleanup(srv.Close)
+
+	c := NewClient(srv.URL)
+	c.SetSession("stale")
+	token, err := c.Login("niklas", "correct horse")
+	if err != nil {
+		t.Fatalf("login: %v", err)
+	}
+	if token != "fresh" || !c.HasSession() {
+		t.Errorf("expected the new token to be kept, got %q", token)
+	}
+	if body != `{"username":"niklas","password":"correct horse"}` {
+		t.Errorf("unexpected body %q", body)
+	}
+	if sentCookie {
+		t.Error("a stale session must not ride along on the login that replaces it")
+	}
+}
+
+func TestLogin_RefusalCarriesTheServersWords(t *testing.T) {
+	c, _ := stub(t, http.StatusUnauthorized, `{"error":"invalid username or password"}`)
+	_, err := c.Login("niklas", "wrong")
+	if !IsUnauthorized(err) || !strings.Contains(err.Error(), "invalid username or password") {
+		t.Errorf("expected the server's 401 message, got %v", err)
+	}
+
+	c, _ = stub(t, http.StatusTooManyRequests, `{"error":"too many attempts"}`)
+	if _, err := c.Login("niklas", "wrong"); err == nil || IsUnauthorized(err) {
+		t.Errorf("a rate limit is not an authentication failure, got %v", err)
+	}
+}
+
+func TestLogin_NoCookieIsAnError(t *testing.T) {
+	c, _ := stub(t, http.StatusOK, `{}`)
+	if _, err := c.Login("niklas", "pw"); err == nil {
+		t.Error("a 200 without a session cookie is not a sign-in")
+	}
+}
+
+func TestLogout_ForgetsTheSession(t *testing.T) {
+	c, got := stub(t, http.StatusNoContent, ``)
+	if err := c.Logout(); err != nil {
+		t.Fatalf("logout: %v", err)
+	}
+	if got.method != "POST" || got.path != "/api/logout" || got.cookie != "test-session" {
+		t.Errorf("unexpected request %s %s cookie=%q", got.method, got.path, got.cookie)
+	}
+	if c.HasSession() {
+		t.Error("the session should be gone locally")
+	}
+}
+
+func TestIsUnauthorized(t *testing.T) {
+	if !IsUnauthorized(&StatusError{Code: 401}) {
+		t.Error("a 401 is unauthorized")
+	}
+	if IsUnauthorized(&StatusError{Code: 403}) || IsUnauthorized(errors.New("x")) || IsUnauthorized(nil) {
+		t.Error("only a 401 means the session is refused; a 403 is a permission")
 	}
 }
 
@@ -78,8 +165,10 @@ func TestClient_IncidentEndpoints(t *testing.T) {
 			http.MethodPost, "/api/incidents/7/archive", ""},
 		{"unarchive", func(c *Client) error { return c.UnarchiveIncident(7) },
 			http.MethodDelete, "/api/incidents/7/archive", ""},
-		{"add note", func(c *Client) error { _, err := c.AddNote(7, "hi"); return err },
+		{"add note", func(c *Client) error { _, err := c.AddNote(7, "hi", false); return err },
 			http.MethodPost, "/api/incidents/7/notes", ""},
+		{"similar", func(c *Client) error { _, err := c.GetSimilarIncidents(7); return err },
+			http.MethodGet, "/api/incidents/7/similar", `[]`},
 		{"delete note", func(c *Client) error { return c.DeleteNote(7, 12) },
 			http.MethodDelete, "/api/incidents/7/notes/12", ""},
 		{"stats", func(c *Client) error { _, err := c.GetIncidentStats(); return err },
@@ -495,3 +584,106 @@ func TestClient_StatusErrorKeepsCodeAndMessage(t *testing.T) {
 		t.Errorf("message changed: %q", err.Error())
 	}
 }
+
+func TestAuthConfig_ReadsWhatTheServerOffers(t *testing.T) {
+	c, got := stub(t, http.StatusOK,
+		`{"password_login":false,"oidc":{"enabled":true,"name":"Authentik"},"device_login":true}`)
+	cfg, err := c.AuthConfig()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.method != http.MethodGet || got.path != "/api/auth/config" {
+		t.Errorf("wrong request: %s %s", got.method, got.path)
+	}
+	if cfg.PasswordLogin || !cfg.OIDC.Enabled || cfg.OIDC.Name != "Authentik" || !cfg.DeviceLogin {
+		t.Errorf("config: %+v", cfg)
+	}
+}
+
+func TestAuthConfig_OldServerAnswers404(t *testing.T) {
+	c, _ := stub(t, http.StatusNotFound, `{"error":"not found"}`)
+	_, err := c.AuthConfig()
+	var se *StatusError
+	if !errors.As(err, &se) || se.Code != http.StatusNotFound {
+		t.Errorf("want a 404 StatusError, got %v", err)
+	}
+}
+
+func TestStartDeviceLogin_SendsNoSessionAndReturnsTheCodes(t *testing.T) {
+	c, got := stub(t, http.StatusOK, `{"device_code":"dev","user_code":"BCDF-GHJK",
+		"verification_url":"https://terdut.example.com/device?code=BCDF-GHJK","interval":5,"expires_in":600}`)
+	d, err := c.StartDeviceLogin()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.method != http.MethodPost || got.path != "/api/oidc/device" {
+		t.Errorf("wrong request: %s %s", got.method, got.path)
+	}
+	// A stale session must not ride along on a request that replaces it.
+	if got.cookie != "" {
+		t.Errorf("sent the old session %q", got.cookie)
+	}
+	if d.DeviceCode != "dev" || d.UserCode != "BCDF-GHJK" || d.Interval != 5 || d.ExpiresIn != 600 ||
+		d.VerificationURL != "https://terdut.example.com/device?code=BCDF-GHJK" {
+		t.Errorf("login: %+v", d)
+	}
+}
+
+func TestStartDeviceLogin_AReplyWithoutCodesIsAnError(t *testing.T) {
+	c, _ := stub(t, http.StatusOK, `{}`)
+	if _, err := c.StartDeviceLogin(); err == nil {
+		t.Error("an empty reply must not be taken for a started login")
+	}
+}
+
+func TestPollDeviceLogin_Outcomes(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		status int
+		body   string
+		want   error
+	}{
+		{"pending", http.StatusAccepted, `{"status":"pending"}`, ErrDevicePending},
+		{"slow down", http.StatusTooManyRequests, `{"error":"slow_down"}`, ErrDeviceSlowDown},
+		{"expired", http.StatusGone, `{"error":"expired"}`, ErrDeviceExpired},
+		{"denied", http.StatusGone, `{"error":"denied"}`, ErrDeviceDenied},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			c, got := stub(t, tc.status, tc.body)
+			tok, err := c.PollDeviceLogin("dev")
+			if !errors.Is(err, tc.want) || tok != "" {
+				t.Errorf("got %q, %v; want %v", tok, err, tc.want)
+			}
+			if got.path != "/api/oidc/device/token" || !strings.Contains(got.body, `"device_code":"dev"`) {
+				t.Errorf("wrong request: %s %s", got.path, got.body)
+			}
+			if c.HasSession() && c.session == "" {
+				t.Error("session state corrupted")
+			}
+		})
+	}
+}
+
+func TestPollDeviceLogin_ApprovalKeepsTheSessionFromTheCookie(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.SetCookie(w, &http.Cookie{Name: SessionCookie, Value: "granted"})
+		io.WriteString(w, `{"user":{}}`)
+	}))
+	t.Cleanup(srv.Close)
+	c := NewClient(srv.URL)
+	tok, err := c.PollDeviceLogin("dev")
+	if err != nil || tok != "granted" {
+		t.Fatalf("got %q, %v", tok, err)
+	}
+	if !c.HasSession() {
+		t.Error("the client must keep the session it was given")
+	}
+}
+
+func TestPollDeviceLogin_ApprovalWithoutACookieIsAnError(t *testing.T) {
+	c, _ := stub(t, http.StatusOK, `{"user":{}}`)
+	c.SetSession("")
+	if _, err := c.PollDeviceLogin("dev"); err == nil {
+		t.Error("a 200 with no session cookie is not a sign-in")
+	}
+}

internal/api/types.go

@@ -32,6 +32,35 @@ type Alert struct {
 	ResolutionSource *string `json:"resolution_source,omitempty"`
 }
 
+// AuthConfig is how the server can be signed in to, from the unauthenticated
+// GET /api/auth/config. A server too old to have the endpoint answers 404, which
+// callers treat as "passwords only".
+type AuthConfig struct {
+	PasswordLogin bool `json:"password_login"`
+	OIDC          struct {
+		Enabled bool   `json:"enabled"`
+		Name    string `json:"name"`
+	} `json:"oidc"`
+
+	// DeviceLogin is whether the server can sign in a client that has no browser,
+	// by showing a code (see StartDeviceLogin).
+	DeviceLogin bool `json:"device_login"`
+}
+
+// DeviceLogin is a sign-in the server has started for this client: the person
+// opens VerificationURL, checks UserCode, and approves; the client polls with
+// DeviceCode until the server hands over a session.
+type DeviceLogin struct {
+	DeviceCode      string `json:"device_code"`
+	UserCode        string `json:"user_code"`
+	VerificationURL string `json:"verification_url"`
+
+	// Interval is how many seconds to wait between polls, and ExpiresIn how many
+	// the person has to approve.
+	Interval  int `json:"interval"`
+	ExpiresIn int `json:"expires_in"`
+}
+
 // Incident statuses.
 const (
 	StatusTriggered    = "triggered"
@@ -108,6 +137,10 @@ const (
 	EventResolved       = "resolved"
 	EventNote           = "note"
 
+	// A note marked as what fixed the incident. The server leads similar
+	// incidents with these.
+	EventResolutionNote = "resolution_note"
+
 	// Written when a team's dead man's switch stops reporting.
 	EventDeadmanSilent = "deadman_silent"
 
@@ -249,3 +282,15 @@ type APIKey struct {
 	CreatedAt  time.Time  `json:"created_at"`
 	LastUsedAt *time.Time `json:"last_used_at"`
 }
+
+// SimilarIncident is an earlier, resolved incident with the same signature
+// (alert name plus stable group labels) as the one being viewed. ResolutionNotes
+// are its "what fixed it" notes; NoteCount counts its plain notes.
+type SimilarIncident struct {
+	ID              int64           `json:"id"`
+	Title           string          `json:"title"`
+	TriggeredAt     time.Time       `json:"triggered_at"`
+	ResolvedAt      time.Time       `json:"resolved_at"`
+	NoteCount       int             `json:"note_count"`
+	ResolutionNotes []IncidentEvent `json:"resolution_notes"`
+}

internal/config/config.go

@@ -13,21 +13,33 @@ const defaultRefreshInterval = 30 * time.Second
 
 type Config struct {
 	ServerURL       string
-	APIKey          string
+	Username        string // optional, prefills the sign-in form
 	RefreshInterval time.Duration
 	Theme           string
 
+	// LegacyAPIKey is set when the file still has an `api_key`. The TUI signs in
+	// with a user account now and ignores it; this is only so it can say so.
+	LegacyAPIKey bool
+
 	// Team is the team to start on, by name or id. Empty shows every team the
 	// key's user belongs to.
 	Team string
+
+	// Auth is how to sign in when the server offers a choice: "sso" starts a
+	// single sign-on login straight away, "password" (or empty) shows the
+	// password form. The server decides what is on offer; this only picks the
+	// default among it.
+	Auth string
 }
 
 type rawConfig struct {
 	ServerURL       string `yaml:"server_url"`
-	APIKey          string `yaml:"api_key"`
+	Username        string `yaml:"username,omitempty"`
+	APIKey          string `yaml:"api_key,omitempty"`          // no longer used; see Config.LegacyAPIKey
 	RefreshInterval int    `yaml:"refresh_interval,omitempty"` // seconds
 	Theme           string `yaml:"theme,omitempty"`
 	Team            string `yaml:"team,omitempty"`
+	Auth            string `yaml:"auth,omitempty"`
 }
 
 func Load() (*Config, error) {
@@ -40,7 +52,7 @@ func Load() (*Config, error) {
 	data, err := os.ReadFile(path)
 	if err != nil {
 		if os.IsNotExist(err) {
-			return nil, fmt.Errorf("config file not found at %s\n\nCreate it with:\n  server_url: https://terdut.example.com\n  api_key: <your-api-key>\n  theme: gruvbox-dark  # optional\n  team: Ops            # optional, team to start on", path)
+			return nil, fmt.Errorf("config file not found at %s\n\nCreate it with:\n  server_url: https://terdut.example.com\n  username: <your-username>  # optional, prefills the sign-in form\n  theme: gruvbox-dark  # optional\n  team: Ops            # optional, team to start on\n  auth: sso            # optional, sso or password: how to sign in by default", path)
 		}
 		return nil, fmt.Errorf("cannot read config file: %w", err)
 	}
@@ -53,8 +65,11 @@ func Load() (*Config, error) {
 	if raw.ServerURL == "" {
 		return nil, fmt.Errorf("config: 'server_url' is required")
 	}
-	if raw.APIKey == "" {
-		return nil, fmt.Errorf("config: 'api_key' is required")
+
+	switch raw.Auth {
+	case "", "password", "sso":
+	default:
+		return nil, fmt.Errorf("config: 'auth' must be sso or password, not %q", raw.Auth)
 	}
 
 	interval := defaultRefreshInterval
@@ -64,9 +79,11 @@ func Load() (*Config, error) {
 
 	return &Config{
 		ServerURL:       raw.ServerURL,
-		APIKey:          raw.APIKey,
+		Username:        raw.Username,
+		LegacyAPIKey:    raw.APIKey != "",
 		RefreshInterval: interval,
 		Theme:           raw.Theme,
 		Team:            raw.Team,
+		Auth:            raw.Auth,
 	}, nil
 }

internal/config/config_test.go

@@ -19,7 +19,7 @@ func writeConfig(t *testing.T, body string) {
 }
 
 func TestLoad_TeamIsOptional(t *testing.T) {
-	writeConfig(t, "server_url: https://terdut.example.com\napi_key: k\n")
+	writeConfig(t, "server_url: https://terdut.example.com\n")
 	cfg, err := Load()
 	if err != nil {
 		t.Fatalf("load: %v", err)
@@ -28,7 +28,7 @@ func TestLoad_TeamIsOptional(t *testing.T) {
 		t.Errorf("expected no default team, got %q", cfg.Team)
 	}
 
-	writeConfig(t, "server_url: https://terdut.example.com\napi_key: k\nteam: Ops\n")
+	writeConfig(t, "server_url: https://terdut.example.com\nteam: Ops\n")
 	cfg, err = Load()
 	if err != nil {
 		t.Fatalf("load: %v", err)
@@ -37,3 +37,48 @@ func TestLoad_TeamIsOptional(t *testing.T) {
 		t.Errorf("expected team Ops, got %q", cfg.Team)
 	}
 }
+
+// Signing in replaced the API key, so a config that has only a server URL is
+// complete, and one that still carries an api_key is noted rather than refused.
+func TestLoad_NoAPIKeyNeeded(t *testing.T) {
+	writeConfig(t, "server_url: https://terdut.example.com\nusername: niklas\n")
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if cfg.Username != "niklas" || cfg.LegacyAPIKey {
+		t.Errorf("unexpected config %+v", cfg)
+	}
+
+	writeConfig(t, "server_url: https://terdut.example.com\napi_key: old\n")
+	cfg, err = Load()
+	if err != nil {
+		t.Fatalf("a leftover api_key must not stop the TUI starting: %v", err)
+	}
+	if !cfg.LegacyAPIKey {
+		t.Error("expected the leftover api_key to be noted")
+	}
+}
+
+func TestLoad_AuthIsOptionalAndChecked(t *testing.T) {
+	for _, tc := range []struct {
+		yaml, want string
+		bad        bool
+	}{
+		{"", "", false},
+		{"auth: password\n", "password", false},
+		{"auth: sso\n", "sso", false},
+		{"auth: oidc\n", "", true},
+	} {
+		writeConfig(t, "server_url: https://terdut.example.com\n"+tc.yaml)
+		cfg, err := Load()
+		switch {
+		case tc.bad && err == nil:
+			t.Errorf("%q: expected an error", tc.yaml)
+		case !tc.bad && err != nil:
+			t.Errorf("%q: %v", tc.yaml, err)
+		case !tc.bad && cfg.Auth != tc.want:
+			t.Errorf("%q: auth %q, want %q", tc.yaml, cfg.Auth, tc.want)
+		}
+	}
+}

internal/session/session.go

@@ -0,0 +1,98 @@
+// Package session keeps the signed-in session between runs, so the TUI does not
+// ask for a password every time it starts.
+//
+// What is stored is the server's session token, not the password: it is what the
+// web UI keeps in a cookie, it expires on the server's schedule (30 days, sliding
+// with use) and signing out or a password change ends it. It is still a
+// credential, so the file is readable by its owner only.
+package session
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+type file struct {
+	ServerURL string `json:"server_url"`
+	Token     string `json:"token"`
+}
+
+func path() (string, error) {
+	dir, err := os.UserConfigDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(dir, "terdut-tui", "session.json"), nil
+}
+
+// normalise makes two spellings of one server compare equal.
+func normalise(serverURL string) string {
+	return strings.TrimRight(serverURL, "/")
+}
+
+// Load returns the saved token for serverURL, or "" when there is none. A session
+// saved for a different server is not offered to this one, and an unreadable file
+// is the same as no file: the worst outcome is being asked to sign in.
+func Load(serverURL string) string {
+	p, err := path()
+	if err != nil {
+		return ""
+	}
+	data, err := os.ReadFile(p)
+	if err != nil {
+		return ""
+	}
+	var f file
+	if json.Unmarshal(data, &f) != nil || normalise(f.ServerURL) != normalise(serverURL) {
+		return ""
+	}
+	return f.Token
+}
+
+// Save stores the token for serverURL, replacing whatever was there.
+func Save(serverURL, token string) error {
+	p, err := path()
+	if err != nil {
+		return err
+	}
+	if err := os.MkdirAll(filepath.Dir(p), 0o700); err != nil {
+		return err
+	}
+	data, err := json.Marshal(file{ServerURL: normalise(serverURL), Token: token})
+	if err != nil {
+		return err
+	}
+	// Written beside the target and renamed over it, so a crash cannot leave a
+	// half-written token, and created 0600 so it is never briefly world-readable.
+	tmp, err := os.CreateTemp(filepath.Dir(p), ".session-*")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(tmp.Name())
+	if err := os.Chmod(tmp.Name(), 0o600); err != nil {
+		tmp.Close()
+		return err
+	}
+	if _, err := tmp.Write(data); err != nil {
+		tmp.Close()
+		return err
+	}
+	if err := tmp.Close(); err != nil {
+		return err
+	}
+	return os.Rename(tmp.Name(), p)
+}
+
+// Clear forgets the saved session. Having none to forget is not an error.
+func Clear() error {
+	p, err := path()
+	if err != nil {
+		return err
+	}
+	if err := os.Remove(p); err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	return nil
+}

internal/session/session_test.go

@@ -0,0 +1,92 @@
+package session
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func isolate(t *testing.T) {
+	t.Helper()
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+}
+
+func TestSaveThenLoad(t *testing.T) {
+	isolate(t)
+	if got := Load("https://terdut.example.com"); got != "" {
+		t.Fatalf("expected no session yet, got %q", got)
+	}
+	if err := Save("https://terdut.example.com", "tok"); err != nil {
+		t.Fatalf("save: %v", err)
+	}
+	if got := Load("https://terdut.example.com"); got != "tok" {
+		t.Errorf("expected tok, got %q", got)
+	}
+	// A trailing slash is the same server.
+	if got := Load("https://terdut.example.com/"); got != "tok" {
+		t.Errorf("a trailing slash should not lose the session, got %q", got)
+	}
+}
+
+// A token is only ever valid for the server that issued it; offering it to a
+// different one would send a credential to somebody it was never meant for.
+func TestLoadIgnoresAnotherServersSession(t *testing.T) {
+	isolate(t)
+	if err := Save("https://a.example.com", "tok"); err != nil {
+		t.Fatal(err)
+	}
+	if got := Load("https://b.example.com"); got != "" {
+		t.Errorf("a session for another server must not be reused, got %q", got)
+	}
+}
+
+func TestSaveIsOwnerOnly(t *testing.T) {
+	isolate(t)
+	if err := Save("https://a.example.com", "tok"); err != nil {
+		t.Fatal(err)
+	}
+	p, _ := path()
+	info, err := os.Stat(p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if perm := info.Mode().Perm(); perm != 0o600 {
+		t.Errorf("the session file holds a credential and must be 0600, got %o", perm)
+	}
+	entries, _ := os.ReadDir(filepath.Dir(p))
+	for _, e := range entries {
+		if e.Name() != "session.json" {
+			t.Errorf("a temporary file was left behind: %s", e.Name())
+		}
+	}
+}
+
+func TestClear(t *testing.T) {
+	isolate(t)
+	if err := Clear(); err != nil {
+		t.Errorf("clearing nothing is not an error, got %v", err)
+	}
+	if err := Save("https://a.example.com", "tok"); err != nil {
+		t.Fatal(err)
+	}
+	if err := Clear(); err != nil {
+		t.Fatalf("clear: %v", err)
+	}
+	if got := Load("https://a.example.com"); got != "" {
+		t.Errorf("expected the session gone, got %q", got)
+	}
+}
+
+func TestLoadToleratesGarbage(t *testing.T) {
+	isolate(t)
+	p, _ := path()
+	if err := os.MkdirAll(filepath.Dir(p), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(p, []byte("{not json"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if got := Load("https://a.example.com"); got != "" {
+		t.Errorf("an unreadable file means no session, got %q", got)
+	}
+}

internal/tui/login_test.go

@@ -0,0 +1,255 @@
+package tui
+
+import (
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	"git.ryuvia.com/niklas/terdut-tui/internal/session"
+	"git.ryuvia.com/niklas/terdut-tui/internal/theme"
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+// signedOut is a model with no session, so it starts on the sign-in form.
+func signedOut(serverURL string) Model {
+	m := NewModel(api.NewClient(serverURL), serverURL, time.Minute, theme.GruvboxDark)
+	m.width, m.height = 120, 40
+	return m
+}
+
+func TestStartsOnTheFormWithoutASession(t *testing.T) {
+	m := signedOut("http://test")
+	if m.mode != modeLogin {
+		t.Fatalf("expected the sign-in form, got mode %v", m.mode)
+	}
+	// Nothing is connected without a session. The one thing started is asking
+	// how the server can be signed in to, and a server too old to be asked (404)
+	// must leave the password form as it was.
+	srv := httptest.NewServer(http.NotFoundHandler())
+	t.Cleanup(srv.Close)
+	cmd := signedOut(srv.URL).Init()
+	if cmd == nil {
+		t.Fatal("expected the form to ask the server how it can be signed in to")
+	}
+	msg, ok := cmd().(authConfigMsg)
+	if !ok {
+		t.Fatalf("expected authConfigMsg, got %#v", cmd())
+	}
+	if !msg.cfg.PasswordLogin || msg.cfg.DeviceLogin {
+		t.Errorf("an old server offers passwords only, got %+v", msg.cfg)
+	}
+}
+
+func TestStartsConnectedWithASavedSession(t *testing.T) {
+	c := api.NewClient("http://test")
+	c.SetSession("saved")
+	m := NewModel(c, "http://test", time.Minute, theme.GruvboxDark)
+	if m.mode == modeLogin {
+		t.Fatal("a saved session should be tried before asking for a password")
+	}
+	if m.Init() == nil {
+		t.Error("expected the saved session to be tried on start")
+	}
+}
+
+func TestLoginForm_ChecksBothFieldsBeforeSending(t *testing.T) {
+	m := signedOut("http://test")
+	m, cmd := press(t, m, "enter")
+	if cmd != nil || m.loggingIn || !strings.Contains(m.loginErr, "username") {
+		t.Errorf("an empty form must not be sent, got err %q", m.loginErr)
+	}
+
+	m = typeInto(t, m, "niklas")
+	m, cmd = press(t, m, "enter")
+	if cmd != nil || m.loggingIn || !strings.Contains(m.loginErr, "password") {
+		t.Errorf("a missing password must not be sent, got err %q", m.loginErr)
+	}
+}
+
+func TestLoginForm_QIsTypedNotQuit(t *testing.T) {
+	m := signedOut("http://test")
+	m = typeInto(t, m, "quentin")
+	if got := m.loginInputs[loginUsername].Value(); got != "quentin" {
+		t.Errorf("q is a letter in a username, got %q", got)
+	}
+}
+
+// The whole flow against a server: type both fields, submit, and the session is
+// kept for the next run.
+func TestLogin_SignsInAndSavesTheSession(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		b, _ := io.ReadAll(r.Body)
+		if r.URL.Path != "/api/login" || string(b) != `{"username":"niklas","password":"secret-pass"}` {
+			t.Errorf("unexpected request %s %s", r.URL.Path, b)
+		}
+		http.SetCookie(w, &http.Cookie{Name: api.SessionCookie, Value: "tok-1", Path: "/"})
+		io.WriteString(w, `{}`)
+	}))
+	t.Cleanup(srv.Close)
+
+	m := signedOut(srv.URL)
+	m = typeInto(t, m, "niklas")
+	m, _ = press(t, m, "tab")
+	m = typeInto(t, m, "secret-pass")
+	m, cmd := press(t, m, "enter")
+	if !m.loggingIn || cmd == nil {
+		t.Fatal("expected the sign-in to be under way")
+	}
+
+	msg := cmd()
+	if _, ok := msg.(loginDoneMsg); !ok {
+		t.Fatalf("expected loginDoneMsg, got %#v", msg)
+	}
+	if got := session.Load(srv.URL); got != "tok-1" {
+		t.Errorf("expected the session saved for next time, got %q", got)
+	}
+
+	next, connect := m.Update(msg)
+	m = next.(Model)
+	if m.mode != modeDashboard || m.loggingIn || connect == nil {
+		t.Errorf("expected to move on and connect, got mode %v", m.mode)
+	}
+	if m.loginInputs[loginPassword].Value() != "" {
+		t.Error("the password must not be kept once it has been used")
+	}
+}
+
+func TestLogin_WrongPasswordStaysOnTheForm(t *testing.T) {
+	m := signedOut("http://test")
+	m.loggingIn = true
+	next, _ := m.Update(loginErrMsg{&api.StatusError{Code: 401, Message: "invalid username or password"}})
+	m = next.(Model)
+	if m.mode != modeLogin || m.loggingIn {
+		t.Fatalf("expected to be back on the form, got mode %v", m.mode)
+	}
+	// The server gives the same 401 for an account with no password, so the
+	// message has to say so or it reads as a typo.
+	if !strings.Contains(m.loginErr, "no password") {
+		t.Errorf("expected the no-password hint, got %q", m.loginErr)
+	}
+	if m.loginFocus != loginPassword {
+		t.Error("focus should return to the password to retry")
+	}
+
+	next, _ = m.Update(loginErrMsg{&api.StatusError{Code: 429, Message: "slow down"}})
+	if got := next.(Model).loginErr; !strings.Contains(got, "too many") {
+		t.Errorf("expected the rate limit explained, got %q", got)
+	}
+	next, _ = m.Update(loginErrMsg{errors.New("dial tcp: refused")})
+	if got := next.(Model).loginErr; !strings.Contains(got, "refused") {
+		t.Errorf("other errors should show as they are, got %q", got)
+	}
+}
+
+// A 401 anywhere means the session is gone. Every action would fail the same
+// way, so it goes back to the form instead, without keeping the old data.
+func TestUnauthorized_ReturnsToTheFormAndDropsTheData(t *testing.T) {
+	for name, msg := range map[string]tea.Msg{
+		"refresh":  fetchDataErrMsg{&api.StatusError{Code: 401}},
+		"action":   actionErrMsg{&api.StatusError{Code: 401}},
+		"schedule": scheduleActionErrMsg{&api.StatusError{Code: 401}},
+		"connect":  connectErrMsg{&api.StatusError{Code: 401}},
+	} {
+		t.Run(name, func(t *testing.T) {
+			m := sized()
+			m.incidents = []api.Incident{{ID: 1, Title: "secret incident"}}
+			m.teams = twoTeams()
+			m.isAdmin = true
+			m.loginInputs[loginUsername].SetValue("niklas")
+
+			next, cmd := m.Update(msg)
+			m = next.(Model)
+			if m.mode != modeLogin || m.connected {
+				t.Fatalf("expected the sign-in form, got mode %v connected=%v", m.mode, m.connected)
+			}
+			if len(m.incidents) != 0 || len(m.teams) != 0 || m.isAdmin {
+				t.Error("the previous session's data must not survive into the next sign-in")
+			}
+			if cmd == nil {
+				t.Error("the dead session should be forgotten on disk")
+			}
+			if !strings.Contains(m.loginNote, "session") {
+				t.Errorf("expected the reason, got %q", m.loginNote)
+			}
+			if m.loginInputs[loginUsername].Value() != "niklas" || m.loginFocus != loginPassword {
+				t.Error("the username should be kept so only the password is retyped")
+			}
+			if strings.Contains(m.View(), "secret incident") {
+				t.Error("nothing from the old session may still be on screen")
+			}
+		})
+	}
+}
+
+// A 403 is a permission, not a lost session: it must not sign anybody out.
+func TestForbidden_DoesNotSignOut(t *testing.T) {
+	m := sized()
+	next, _ := m.Update(actionErrMsg{&api.StatusError{Code: 403, Message: "administrator access required"}})
+	if got := next.(Model); got.mode == modeLogin || !got.connected {
+		t.Error("a 403 must leave the session alone")
+	}
+}
+
+func TestLogout(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+	m := sized()
+	m.teams = twoTeams()
+	m.incidents = []api.Incident{{ID: 1}}
+	m, cmd := press(t, m, "L")
+	if cmd == nil {
+		t.Fatal("L should sign out")
+	}
+	next, _ := m.Update(logoutDoneMsg{})
+	m = next.(Model)
+	if m.mode != modeLogin || m.connected || len(m.incidents) != 0 {
+		t.Errorf("expected the form with nothing loaded, got mode %v", m.mode)
+	}
+	if !strings.Contains(m.loginNote, "signed out") {
+		t.Errorf("expected it to say so, got %q", m.loginNote)
+	}
+}
+
+// Signing out and in again must not leave two refresh timers running, each
+// re-arming itself for ever.
+func TestSigningInAgainStartsNoSecondTimer(t *testing.T) {
+	m := sized()
+	next, _ := m.Update(connectedMsg{})
+	m = next.(Model)
+	if !m.ticking {
+		t.Fatal("the first connect starts the refresh timer")
+	}
+	m = m.requireLogin("x")
+	if !m.ticking {
+		t.Fatal("the timer is still running while signed out")
+	}
+	// Ticks while signed out must do nothing rather than fetch.
+	if _, cmd := m.Update(tickMsg(time.Now())); cmd == nil {
+		t.Error("the timer keeps ticking")
+	}
+	if cmd := m.refreshActiveSection(); cmd != nil {
+		t.Error("no refresh should be attempted while signed out")
+	}
+}
+
+func TestLoginView_HidesThePasswordAndShowsTheNote(t *testing.T) {
+	m := signedOut("https://terdut.example.com").WithLogin("niklas", "api_key in config.yaml is no longer used")
+	if m.loginFocus != loginPassword {
+		t.Error("with the username known the cursor should start on the password")
+	}
+	m = typeInto(t, m, "hunter2-hunter2")
+	view := m.View()
+	for _, want := range []string{"Sign in to https://terdut.example.com", "niklas", "api_key in config.yaml is no longer used"} {
+		if !strings.Contains(view, want) {
+			t.Errorf("expected %q on the form:\n%s", want, view)
+		}
+	}
+	if strings.Contains(view, "hunter2") {
+		t.Error("the password must be masked")
+	}
+}

internal/tui/model.go

@@ -10,6 +10,7 @@ import (
 	"time"
 
 	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	"git.ryuvia.com/niklas/terdut-tui/internal/session"
 	"git.ryuvia.com/niklas/terdut-tui/internal/theme"
 	"github.com/charmbracelet/bubbles/help"
 	"github.com/charmbracelet/bubbles/key"
@@ -52,6 +53,14 @@ const (
 	modeAPIKeyReveal
 	modeAPIKeyRevokeByID
 	modePasswordSet
+	modeLogin
+)
+
+// Fields of the sign-in form, in tab order.
+const (
+	loginUsername = iota
+	loginPassword
+	loginFieldCount
 )
 
 // Fields of the set-password form, in tab order.
@@ -115,6 +124,51 @@ type connectedMsg struct {
 	me    api.Me
 }
 type connectErrMsg struct{ err error }
+type loginDoneMsg struct{}
+type loginErrMsg struct{ err error }
+
+// Single sign-on. A device login is a chain: the server hands out a code
+// (deviceStartedMsg), the client waits out the interval (devicePollMsg), asks
+// (devicePendingMsg, or loginDoneMsg on approval), and waits again. Every message
+// carries the attempt it belongs to, so the late answers of an attempt that was
+// cancelled or replaced are dropped rather than acted on.
+type authConfigMsg struct{ cfg api.AuthConfig }
+type deviceStartedMsg struct {
+	attempt int
+	login   api.DeviceLogin
+}
+type devicePollMsg struct{ attempt int }
+type devicePendingMsg struct {
+	attempt int
+	slower  bool  // the server asked for fewer polls
+	err     error // a poll that failed in a way worth retrying (network, 5xx)
+}
+type deviceFailedMsg struct {
+	attempt int
+	err     error
+}
+
+// ssoLogin is a device login in progress; the zero value is none. attempt only
+// ever goes up: starting, cancelling and finishing all bump it, which is what
+// makes the messages of an earlier attempt stale.
+type ssoLogin struct {
+	attempt int
+	active  bool             // started, and not yet cancelled, failed or finished
+	login   *api.DeviceLogin // nil until the server has answered
+	// interval is the wait between polls: the server's, lengthened when it says
+	// it is being asked too often.
+	interval time.Duration
+	// failures counts polls in a row that failed for a reason other than "not
+	// yet", so a dead connection ends the wait instead of spinning forever.
+	failures int
+}
+
+const (
+	defaultDevicePoll = 5 * time.Second
+	maxPollFailures   = 3
+)
+
+type logoutDoneMsg struct{}
 type incidentsFetchedMsg struct{ incidents []api.Incident }
 type archivedIncidentsFetchedMsg struct{ incidents []api.Incident }
 type incidentActionDoneMsg struct {
@@ -134,6 +188,7 @@ type clearStatusMsg struct{}
 type incidentDetailFetchedMsg struct {
 	incident api.Incident
 	timeline []api.IncidentEvent
+	similar  []api.SimilarIncident
 }
 type alertDetailFetchedMsg struct{ alert api.Alert }
 type detailErrMsg struct{ err error }
@@ -188,6 +243,7 @@ type Model struct {
 	client          *api.Client
 	serverURL       string
 	refreshInterval time.Duration
+	theme           theme.Theme // kept to build a fresh model when signing out
 
 	activeSection section
 	mode          mode
@@ -203,6 +259,23 @@ type Model struct {
 	meID         int64
 	isAdmin      bool
 
+	// Sign-in. Until the server accepts a session the TUI is in modeLogin;
+	// loginNote is a line the form shows above the fields (why we are here), and
+	// ticking says the refresh timer is already running, so signing in again
+	// after signing out does not start a second one.
+	loginInputs [loginFieldCount]textinput.Model
+	loginFocus  int
+	loggingIn   bool
+	loginErr    string
+	loginNote   string
+	ticking     bool
+
+	// How the server can be signed in to, nil until it has answered. authPref is
+	// the config's `auth`, which only chooses among what the server offers.
+	authInfo *api.AuthConfig
+	authPref string
+	sso      ssoLogin
+
 	// Connection & dashboard
 	connected     bool
 	loading       bool
@@ -229,7 +302,9 @@ type Model struct {
 	// Incident detail
 	selectedIncident api.Incident
 	timeline         []api.IncidentEvent
+	similar          []api.SimilarIncident
 	noteCursor       int
+	notePinned       bool // the note being typed is the resolution note
 	detailLoading    bool
 	detailViewport   viewport.Model
 
@@ -365,6 +440,18 @@ func NewModel(client *api.Client, serverURL string, refreshInterval time.Duratio
 		pwIn[i].CharLimit = 72 // bcrypt's limit; the server refuses longer
 	}
 
+	var loginIn [loginFieldCount]textinput.Model
+	for i, placeholder := range [loginFieldCount]string{"username", "password"} {
+		loginIn[i] = textinput.New()
+		loginIn[i].Placeholder = placeholder
+		loginIn[i].CharLimit = 72 // bcrypt's limit, and the server refuses longer passwords
+	}
+	loginIn[loginPassword].EchoMode = textinput.EchoPassword
+	loginIn[loginPassword].EchoCharacter = '•'
+	for i := range loginIn {
+		loginIn[i] = st.Input(loginIn[i])
+	}
+
 	for _, in := range []*textinput.Model{
 		&noteIn, &snoozeIn, &usernameIn, &emailIn, &topicIn, &keyNameIn, &revokeIn,
 	} {
@@ -385,12 +472,20 @@ func NewModel(client *api.Client, serverURL string, refreshInterval time.Duratio
 	}
 	window := today.AddDate(0, 0, -(weekday - 1))
 
+	startMode := modeDashboard
+	if client != nil && !client.HasSession() {
+		startMode = modeLogin
+		loginIn[loginUsername].Focus()
+	}
+
 	return Model{
 		client:            client,
 		serverURL:         serverURL,
 		refreshInterval:   refreshInterval,
+		theme:             th,
 		activeSection:     sectionIncidents,
-		mode:              modeDashboard,
+		mode:              startMode,
+		loginInputs:       loginIn,
 		loading:           true,
 		incidentFilter:    "",
 		alertFilter:       "firing",
@@ -424,7 +519,35 @@ func (m Model) WithDefaultTeam(team string) Model {
 	return m
 }
 
+// WithAuth sets the default way to sign in, from the config's `auth`: "sso"
+// starts a single sign-on login by itself when the server offers one.
+func (m Model) WithAuth(pref string) Model {
+	m.authPref = pref
+	return m
+}
+
+// WithLogin prefills the sign-in form's username and sets a note shown above it.
+func (m Model) WithLogin(username, note string) Model {
+	m.loginInputs[loginUsername].SetValue(username)
+	m.loginNote = note
+	if username != "" && m.mode == modeLogin {
+		// The name is known, so the only thing left to type is the password.
+		m.loginInputs[loginUsername].Blur()
+		m.loginFocus = loginPassword
+		m.loginInputs[loginPassword].Focus()
+	}
+	return m
+}
+
+// Init tries the saved session, if there is one; otherwise the sign-in form is
+// already showing and there is nothing to do until it is submitted.
 func (m Model) Init() tea.Cmd {
+	if m.mode == modeLogin {
+		// Ask how the server can be signed in to, so the form offers the right
+		// thing. Nothing depends on the answer arriving: the password form is
+		// already usable.
+		return authConfigCmd(m.client)
+	}
 	return connectCmd(m.client)
 }
 
@@ -552,7 +675,7 @@ func (m *Model) refreshDetailContent() {
 		return
 	}
 	m.detailViewport.SetContent(
-		buildIncidentDetailContent(m.styles, m.selectedIncident, m.timeline, m.noteCursor, m.width))
+		buildIncidentDetailContent(m.styles, m.selectedIncident, m.timeline, m.similar, m.noteCursor, m.width))
 }
 
 func (m *Model) refreshStatsContent() {
@@ -684,7 +807,7 @@ func userFlags(u api.User) string {
 func noteEvents(timeline []api.IncidentEvent) []api.IncidentEvent {
 	notes := make([]api.IncidentEvent, 0, len(timeline))
 	for _, e := range timeline {
-		if e.Type == api.EventNote {
+		if e.Type == api.EventNote || e.Type == api.EventResolutionNote {
 			notes = append(notes, e)
 		}
 	}
@@ -975,6 +1098,90 @@ func connectCmd(client *api.Client) tea.Cmd {
 	}
 }
 
+// loginCmd signs in and saves the session, so the next run can resume it. Failing
+// to save is not failing to sign in: the session works for this run either way.
+func loginCmd(client *api.Client, serverURL, username, password string) tea.Cmd {
+	return func() tea.Msg {
+		token, err := client.Login(username, password)
+		if err != nil {
+			return loginErrMsg{err}
+		}
+		_ = session.Save(serverURL, token)
+		return loginDoneMsg{}
+	}
+}
+
+// authConfigCmd asks how the server can be signed in to. A server too old to be
+// asked, or one that cannot be reached, is treated as offering passwords only: the
+// form that always existed is the safe fallback, and it reports a real connection
+// problem itself when it is submitted.
+func authConfigCmd(client *api.Client) tea.Cmd {
+	return func() tea.Msg {
+		cfg, err := client.AuthConfig()
+		if err != nil {
+			cfg = api.AuthConfig{PasswordLogin: true}
+		}
+		return authConfigMsg{cfg}
+	}
+}
+
+// startDeviceCmd asks the server to begin a device login.
+func startDeviceCmd(client *api.Client, attempt int) tea.Cmd {
+	return func() tea.Msg {
+		login, err := client.StartDeviceLogin()
+		if err != nil {
+			return deviceFailedMsg{attempt, err}
+		}
+		return deviceStartedMsg{attempt, *login}
+	}
+}
+
+// devicePollAfter waits out the interval before the next poll.
+func devicePollAfter(attempt int, interval time.Duration) tea.Cmd {
+	return tea.Tick(interval, func(time.Time) tea.Msg { return devicePollMsg{attempt} })
+}
+
+// pollDeviceCmd asks whether the login has been approved. Approval saves the
+// session the way a password sign-in does, and ends in the same loginDoneMsg.
+func pollDeviceCmd(client *api.Client, serverURL string, attempt int, deviceCode string) tea.Cmd {
+	return func() tea.Msg {
+		token, err := client.PollDeviceLogin(deviceCode)
+		switch {
+		case err == nil:
+			_ = session.Save(serverURL, token)
+			return loginDoneMsg{}
+		case errors.Is(err, api.ErrDevicePending):
+			return devicePendingMsg{attempt: attempt}
+		case errors.Is(err, api.ErrDeviceSlowDown):
+			return devicePendingMsg{attempt: attempt, slower: true}
+		case errors.Is(err, api.ErrDeviceExpired), errors.Is(err, api.ErrDeviceDenied):
+			return deviceFailedMsg{attempt, err}
+		}
+		// Anything else is the network or the server having a moment, which a
+		// person waiting on a browser should not have to start over for.
+		return devicePendingMsg{attempt: attempt, err: err}
+	}
+}
+
+// logoutCmd ends the session on the server and deletes the saved one. The saved
+// copy goes even when the server cannot be reached, because the person asked to
+// be signed out and a token left on disk would say otherwise.
+func logoutCmd(client *api.Client) tea.Cmd {
+	return func() tea.Msg {
+		_ = client.Logout()
+		_ = session.Clear()
+		return logoutDoneMsg{}
+	}
+}
+
+// forgetSessionCmd drops a saved session the server no longer honours.
+func forgetSessionCmd() tea.Cmd {
+	return func() tea.Msg {
+		_ = session.Clear()
+		return nil
+	}
+}
+
 func fetchIncidentsCmd(client *api.Client, teamID int64, filter string) tea.Cmd {
 	return func() tea.Msg {
 		status, snoozed := incidentQuery(filter)
@@ -1037,7 +1244,10 @@ func incidentDetail(client *api.Client, id int64) tea.Msg {
 	if err != nil {
 		return detailErrMsg{err}
 	}
-	return incidentDetailFetchedMsg{incident: *incident, timeline: timeline}
+	// Best effort: an older server has no such endpoint, and the incident is
+	// still worth showing without it.
+	similar, _ := client.GetSimilarIncidents(id)
+	return incidentDetailFetchedMsg{incident: *incident, timeline: timeline, similar: similar}
 }
 
 func fetchIncidentDetailCmd(client *api.Client, id int64) tea.Cmd {
@@ -1091,9 +1301,9 @@ func unsnoozeIncidentCmd(client *api.Client, id int64) tea.Cmd {
 	return incidentActionCmd(client, id, func() error { return client.UnsnoozeIncident(id) })
 }
 
-func addNoteCmd(client *api.Client, id int64, content string) tea.Cmd {
+func addNoteCmd(client *api.Client, id int64, content string, pinned bool) tea.Cmd {
 	return incidentActionCmd(client, id, func() error {
-		_, err := client.AddNote(id, content)
+		_, err := client.AddNote(id, content, pinned)
 		return err
 	})
 }

internal/tui/sso_test.go

@@ -0,0 +1,378 @@
+package tui
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	"git.ryuvia.com/niklas/terdut-tui/internal/session"
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+// fakeServer is the device-login half of terdut-server: it starts a login,
+// answers polls with whatever poll says, and records what it was asked.
+type fakeServer struct {
+	*httptest.Server
+	mu    sync.Mutex
+	polls int
+	// poll is called for each poll and writes the response.
+	poll func(w http.ResponseWriter, n int)
+}
+
+func newFakeServer(t *testing.T) *fakeServer {
+	t.Helper()
+	f := &fakeServer{}
+	f.Server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		switch r.URL.Path {
+		case "/api/oidc/device":
+			io.WriteString(w, `{"device_code":"dev-1","user_code":"BCDF-GHJK",
+				"verification_url":"https://terdut.example.com/device?code=BCDF-GHJK","interval":5,"expires_in":600}`)
+		case "/api/oidc/device/token":
+			f.mu.Lock()
+			f.polls++
+			n := f.polls
+			f.mu.Unlock()
+			var body struct {
+				DeviceCode string `json:"device_code"`
+			}
+			json.NewDecoder(r.Body).Decode(&body)
+			if body.DeviceCode != "dev-1" {
+				t.Errorf("polled with %q", body.DeviceCode)
+			}
+			f.poll(w, n)
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	t.Cleanup(f.Close)
+	return f
+}
+
+func pending(w http.ResponseWriter, _ int) {
+	w.WriteHeader(http.StatusAccepted)
+	io.WriteString(w, `{"status":"pending"}`)
+}
+
+// offering is a signed-out model that has been told what the server offers.
+func offering(t *testing.T, url string, cfg api.AuthConfig, pref string) (Model, tea.Cmd) {
+	t.Helper()
+	m := signedOut(url).WithAuth(pref)
+	next, cmd := m.Update(authConfigMsg{cfg})
+	return next.(Model), cmd
+}
+
+func both() api.AuthConfig {
+	c := api.AuthConfig{PasswordLogin: true, DeviceLogin: true}
+	c.OIDC.Enabled, c.OIDC.Name = true, "Authentik"
+	return c
+}
+
+func ssoOnly() api.AuthConfig {
+	c := both()
+	c.PasswordLogin = false
+	return c
+}
+
+func update(t *testing.T, m Model, msg tea.Msg) (Model, tea.Cmd) {
+	t.Helper()
+	next, cmd := m.Update(msg)
+	return next.(Model), cmd
+}
+
+func ctrlO() tea.KeyMsg { return tea.KeyMsg{Type: tea.KeyCtrlO} }
+
+func TestSSO_OfferedAlongsidePasswordsIsNotStartedByItself(t *testing.T) {
+	m, cmd := offering(t, "http://test", both(), "")
+	if cmd != nil || m.sso.active {
+		t.Fatal("with passwords on offer nothing should start until asked")
+	}
+	view := m.View()
+	for _, want := range []string{"Username:", "Password:", "ctrl+o to sign in with Authentik"} {
+		if !strings.Contains(view, want) {
+			t.Errorf("expected %q on the form:\n%s", want, view)
+		}
+	}
+}
+
+func TestSSO_NotOfferedShowsNoSuchHint(t *testing.T) {
+	m, _ := offering(t, "http://test", api.AuthConfig{PasswordLogin: true}, "")
+	if strings.Contains(m.View(), "ctrl+o") {
+		t.Error("a server with no SSO must not advertise it")
+	}
+	if m, cmd := update(t, m, ctrlO()); cmd != nil || m.sso.active {
+		t.Error("ctrl+o must do nothing when the server has no SSO")
+	}
+}
+
+func TestSSO_FullFlow(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+	f := newFakeServer(t)
+	f.poll = func(w http.ResponseWriter, n int) {
+		if n < 3 {
+			pending(w, n)
+			return
+		}
+		http.SetCookie(w, &http.Cookie{Name: api.SessionCookie, Value: "tok-sso", Path: "/"})
+		io.WriteString(w, `{"user":{}}`)
+	}
+	m, _ := offering(t, f.URL, both(), "")
+
+	// ctrl+o asks the server for a login.
+	m, cmd := update(t, m, ctrlO())
+	if !m.sso.active || cmd == nil {
+		t.Fatal("ctrl+o should start a single sign-on login")
+	}
+	if !strings.Contains(m.View(), "Contacting the server") {
+		t.Errorf("before the server answers:\n%s", m.View())
+	}
+	started, ok := cmd().(deviceStartedMsg)
+	if !ok {
+		t.Fatalf("expected deviceStartedMsg, got %#v", cmd())
+	}
+
+	// The link and the code are shown, and a poll is scheduled.
+	m, cmd = update(t, m, started)
+	if cmd == nil || m.sso.interval != 5*time.Second {
+		t.Fatalf("expected a poll to be scheduled every 5s, got cmd %v interval %v", cmd != nil, m.sso.interval)
+	}
+	view := m.View()
+	for _, want := range []string{"Sign in with Authentik", "https://terdut.example.com/device?code=BCDF-GHJK",
+		"BCDF-GHJK", "Waiting for approval", "10 minutes", "esc·cancel"} {
+		if !strings.Contains(view, want) {
+			t.Errorf("expected %q while waiting:\n%s", want, view)
+		}
+	}
+	if strings.Contains(view, "Username:") {
+		t.Error("the password form must be out of the way while waiting")
+	}
+
+	// Two polls that find nothing, each scheduling the next.
+	for i := 1; i <= 2; i++ {
+		m, cmd = update(t, m, devicePollMsg{m.sso.attempt})
+		if cmd == nil {
+			t.Fatalf("poll %d: expected a request", i)
+		}
+		pend, ok := cmd().(devicePendingMsg)
+		if !ok {
+			t.Fatalf("poll %d: expected devicePendingMsg", i)
+		}
+		if m, cmd = update(t, m, pend); cmd == nil || !m.sso.active {
+			t.Fatalf("poll %d: expected to keep waiting", i)
+		}
+	}
+
+	// The third is approved: the session is saved and it moves on and connects.
+	m, cmd = update(t, m, devicePollMsg{m.sso.attempt})
+	done := cmd()
+	if _, ok := done.(loginDoneMsg); !ok {
+		t.Fatalf("expected loginDoneMsg, got %#v", done)
+	}
+	if got := session.Load(f.URL); got != "tok-sso" {
+		t.Errorf("session saved for next time: %q", got)
+	}
+	m, connect := update(t, m, done)
+	if m.mode != modeDashboard || m.sso.active || connect == nil {
+		t.Errorf("expected to move on and connect: mode %v active %v", m.mode, m.sso.active)
+	}
+	if f.polls != 3 {
+		t.Errorf("%d polls, want 3", f.polls)
+	}
+}
+
+func TestSSO_EscCancelsBeforeItQuits(t *testing.T) {
+	m, _ := offering(t, "http://test", both(), "")
+	m, _ = update(t, m, ctrlO())
+	m, _ = update(t, m, deviceStartedMsg{m.sso.attempt, api.DeviceLogin{DeviceCode: "d", UserCode: "AAAA-BBBB", VerificationURL: "u", Interval: 5, ExpiresIn: 600}})
+
+	m, cmd := update(t, m, tea.KeyMsg{Type: tea.KeyEsc})
+	if cmd != nil {
+		t.Fatal("the first esc backs out of the wait; it must not quit")
+	}
+	if m.sso.active || m.mode != modeLogin || !strings.Contains(m.View(), "Username:") {
+		t.Errorf("expected the password form back, active %v", m.sso.active)
+	}
+	if _, cmd := update(t, m, tea.KeyMsg{Type: tea.KeyEsc}); cmd == nil {
+		t.Error("esc on the form quits, as it always did")
+	} else if _, ok := cmd().(tea.QuitMsg); !ok {
+		t.Errorf("expected a quit, got %#v", cmd())
+	}
+}
+
+// The answers of an attempt that was cancelled arrive late and must change nothing.
+func TestSSO_StaleMessagesAreIgnored(t *testing.T) {
+	m, _ := offering(t, "http://test", both(), "")
+	m, _ = update(t, m, ctrlO())
+	old := m.sso.attempt
+	m = m.cancelSSO()
+
+	for name, msg := range map[string]tea.Msg{
+		"started": deviceStartedMsg{old, api.DeviceLogin{DeviceCode: "d", UserCode: "X", Interval: 5}},
+		"poll":    devicePollMsg{old},
+		"pending": devicePendingMsg{attempt: old},
+		"failed":  deviceFailedMsg{old, api.ErrDeviceExpired},
+	} {
+		next, cmd := update(t, m, msg)
+		if cmd != nil || next.sso.active || next.sso.login != nil || next.loginErr != "" {
+			t.Errorf("%s from a cancelled attempt was acted on: %+v err %q", name, next.sso, next.loginErr)
+		}
+	}
+
+	// A new attempt is not confused by the old one's messages either.
+	m, _ = update(t, m, ctrlO())
+	if m.sso.attempt == old {
+		t.Fatal("a new attempt must have a new number")
+	}
+	if _, cmd := update(t, m, devicePollMsg{old}); cmd != nil {
+		t.Error("the old attempt's poll must not run in the new one")
+	}
+}
+
+func TestSSO_NoPasswordsStartsByItselfAndEnterRestarts(t *testing.T) {
+	m, cmd := offering(t, "http://test", ssoOnly(), "")
+	if !m.sso.active || cmd == nil {
+		t.Fatal("a server with no passwords should start signing in with SSO straight away")
+	}
+	m = m.cancelSSO()
+	view := m.View()
+	if strings.Contains(view, "Username:") || !strings.Contains(view, "This server signs in with Authentik") {
+		t.Errorf("no password form on an SSO-only server:\n%s", view)
+	}
+	if !strings.Contains(view, "enter·sign in with Authentik") {
+		t.Errorf("the footer should say what enter does:\n%s", view)
+	}
+	if m, cmd = update(t, m, tea.KeyMsg{Type: tea.KeyEnter}); !m.sso.active || cmd == nil {
+		t.Error("enter should start it again")
+	}
+}
+
+func TestSSO_ConfigPrefersItWhenOffered(t *testing.T) {
+	if m, cmd := offering(t, "http://test", both(), "sso"); !m.sso.active || cmd == nil {
+		t.Error("auth: sso should start by itself when the server offers it")
+	}
+	// ...and shows the password form when it does not, rather than a dead end.
+	m, cmd := offering(t, "http://test", api.AuthConfig{PasswordLogin: true}, "sso")
+	if m.sso.active || cmd != nil || !strings.Contains(m.View(), "Username:") {
+		t.Error("auth: sso against a server without SSO must fall back to the form")
+	}
+	if m, cmd := offering(t, "http://test", both(), "password"); m.sso.active || cmd != nil {
+		t.Error("auth: password must not start SSO")
+	}
+}
+
+func TestSSO_ExpiredAndRefusedReturnToTheFormWithAReason(t *testing.T) {
+	for name, tc := range map[string]struct {
+		err  error
+		want string
+	}{
+		"expired": {api.ErrDeviceExpired, "expired"},
+		"refused": {api.ErrDeviceDenied, "refused"},
+		"no sso":  {&api.StatusError{Code: 404}, "does not offer"},
+		"limited": {&api.StatusError{Code: 429}, "too many"},
+		"other":   {errors.New("dial tcp: refused"), "Authentik failed"},
+	} {
+		m, _ := offering(t, "http://test", both(), "")
+		m, _ = update(t, m, ctrlO())
+		m, cmd := update(t, m, deviceFailedMsg{m.sso.attempt, tc.err})
+		if cmd != nil || m.sso.active || !strings.Contains(m.loginErr, tc.want) {
+			t.Errorf("%s: active %v err %q, want it to contain %q", name, m.sso.active, m.loginErr, tc.want)
+		}
+		if !strings.Contains(m.View(), tc.want) {
+			t.Errorf("%s: the reason is not shown:\n%s", name, m.View())
+		}
+	}
+}
+
+func TestSSO_SlowDownLengthensTheInterval(t *testing.T) {
+	m, _ := offering(t, "http://test", both(), "")
+	m, _ = update(t, m, ctrlO())
+	m, _ = update(t, m, deviceStartedMsg{m.sso.attempt, api.DeviceLogin{DeviceCode: "d", UserCode: "A", VerificationURL: "u", Interval: 5, ExpiresIn: 60}})
+	m, cmd := update(t, m, devicePendingMsg{attempt: m.sso.attempt, slower: true})
+	if m.sso.interval != 10*time.Second || cmd == nil {
+		t.Errorf("interval %v, cmd %v; want 10s and another poll", m.sso.interval, cmd != nil)
+	}
+}
+
+func TestSSO_ADeadConnectionEndsTheWaitButABlipDoesNot(t *testing.T) {
+	m, _ := offering(t, "http://test", both(), "")
+	m, _ = update(t, m, ctrlO())
+	m, _ = update(t, m, deviceStartedMsg{m.sso.attempt, api.DeviceLogin{DeviceCode: "d", UserCode: "A", VerificationURL: "u", Interval: 5, ExpiresIn: 60}})
+	blip := errors.New("connection reset")
+
+	// Two failures, then a good answer: the count starts over.
+	for range 2 {
+		m, _ = update(t, m, devicePendingMsg{attempt: m.sso.attempt, err: blip})
+	}
+	m, _ = update(t, m, devicePendingMsg{attempt: m.sso.attempt})
+	if !m.sso.active || m.sso.failures != 0 {
+		t.Fatalf("a good answer should reset the failures: %+v", m.sso)
+	}
+
+	// Three in a row is a dead connection.
+	var cmd tea.Cmd
+	for range maxPollFailures {
+		m, cmd = update(t, m, devicePendingMsg{attempt: m.sso.attempt, err: blip})
+	}
+	if m.sso.active || cmd != nil || !strings.Contains(m.loginErr, "connection reset") {
+		t.Errorf("expected to give up with the reason: active %v err %q", m.sso.active, m.loginErr)
+	}
+}
+
+func TestSSO_TypingGoesNowhereWhileWaiting(t *testing.T) {
+	m, _ := offering(t, "http://test", both(), "")
+	m, _ = update(t, m, ctrlO())
+	m = typeInto(t, m, "hunter2")
+	if got := m.loginInputs[m.loginFocus].Value(); got != "" {
+		t.Errorf("keys typed during the wait ended up in a field: %q", got)
+	}
+	if _, cmd := update(t, m, tea.KeyMsg{Type: tea.KeyEnter}); cmd != nil {
+		t.Error("enter during the wait must not start anything")
+	}
+}
+
+// After the session ends the form comes back; it must still know what the
+// server offers, and follow the config's preference without a second question.
+func TestSSO_SessionEndingReturnsToSSOWhenPreferred(t *testing.T) {
+	m, _ := offering(t, "http://test", both(), "sso")
+	m = m.cancelSSO()
+	m.mode = modeDashboard // signed in, as loginDoneMsg leaves it
+	m, _ = update(t, m, connectedMsg{})
+	m, cmd := update(t, m, fetchDataErrMsg{&api.StatusError{Code: 401}})
+	if m.mode != modeLogin || m.authInfo == nil {
+		t.Fatalf("expected the form with what the server offers kept: mode %v info %v", m.mode, m.authInfo)
+	}
+	if !m.sso.active || cmd == nil {
+		t.Error("with auth: sso an ended session should go straight to SSO")
+	}
+}
+
+func TestSSO_SigningOutDoesNotSignStraightBackIn(t *testing.T) {
+	m, _ := offering(t, "http://test", both(), "sso")
+	m = m.cancelSSO()
+	m.mode = modeDashboard
+	m, _ = update(t, m, connectedMsg{})
+	m, cmd := update(t, m, logoutDoneMsg{})
+	if m.mode != modeLogin || m.sso.active || cmd != nil {
+		t.Errorf("a deliberate sign-out must wait: mode %v active %v", m.mode, m.sso.active)
+	}
+}
+
+// A session that ends before the server was ever asked (the TUI started on a
+// saved session) still has to learn what to offer.
+func TestSSO_LearnsWhatIsOfferedWhenTheSessionEndsFirst(t *testing.T) {
+	c := api.NewClient("http://test")
+	c.SetSession("saved")
+	m := NewModel(c, "http://test", time.Minute, signedOut("x").theme)
+	m.width, m.height = 120, 40
+	m, cmd := update(t, m, fetchDataErrMsg{&api.StatusError{Code: 401}})
+	if m.mode != modeLogin || m.authInfo != nil || cmd == nil {
+		t.Errorf("expected the form and a question to the server: mode %v info %v cmd %v", m.mode, m.authInfo, cmd != nil)
+	}
+}

internal/tui/update.go

@@ -1,10 +1,13 @@
 package tui
 
 import (
+	"errors"
 	"fmt"
+	"net/http"
 	"slices"
 	"strconv"
 	"strings"
+	"time"
 
 	"git.ryuvia.com/niklas/terdut-tui/internal/api"
 	"github.com/atotto/clipboard"
@@ -13,6 +16,15 @@ import (
 )
 
 func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	// A 401 from anything means the server no longer honours the session: it
+	// expired, was ended from the web UI, or the account was disabled. Whatever
+	// was being done cannot succeed, so go back to the sign-in form and say why,
+	// rather than leaving every action to fail with "server returned 401".
+	if err := msgError(msg); api.IsUnauthorized(err) && m.mode != modeLogin {
+		m, entry := m.requireLogin("your session has ended — sign in again").enterLogin(true)
+		return m, tea.Batch(forgetSessionCmd(), entry)
+	}
+
 	switch msg := msg.(type) {
 	case tea.WindowSizeMsg:
 		m.width = msg.Width
@@ -33,6 +45,77 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 
 	// ── Dashboard messages ────────────────────────────────────────────────
 
+	case loginDoneMsg:
+		m.loggingIn = false
+		m.sso = ssoLogin{attempt: m.sso.attempt + 1}
+		m.loginErr = ""
+		m.loginNote = ""
+		m.loginInputs[loginPassword].Reset()
+		m.blurLoginForm()
+		m.mode = modeDashboard
+		m.err = nil
+		return m, connectCmd(m.client)
+
+	case loginErrMsg:
+		m.loggingIn = false
+		m.loginErr = loginErrorText(msg.err)
+		m.loginInputs[loginPassword].Reset()
+		m.focusLogin(loginPassword)
+		return m, nil
+
+	case logoutDoneMsg:
+		// Not auto-started even with auth: sso: somebody who has just signed out
+		// did not ask to be signed straight back in.
+		return m.requireLogin("you have signed out").enterLogin(false)
+
+	case authConfigMsg:
+		cfg := msg.cfg
+		m.authInfo = &cfg
+		if m.mode == modeLogin && m.autoStartsSSO() {
+			return m.startSSO()
+		}
+		return m, nil
+
+	case deviceStartedMsg:
+		if !m.sso.current(msg.attempt) {
+			return m, nil
+		}
+		login := msg.login
+		m.sso.login = &login
+		m.sso.interval = time.Duration(login.Interval) * time.Second
+		if m.sso.interval <= 0 {
+			m.sso.interval = defaultDevicePoll
+		}
+		return m, devicePollAfter(m.sso.attempt, m.sso.interval)
+
+	case devicePollMsg:
+		if !m.sso.current(msg.attempt) || m.sso.login == nil {
+			return m, nil
+		}
+		return m, pollDeviceCmd(m.client, m.serverURL, m.sso.attempt, m.sso.login.DeviceCode)
+
+	case devicePendingMsg:
+		if !m.sso.current(msg.attempt) {
+			return m, nil
+		}
+		if msg.err != nil {
+			if m.sso.failures++; m.sso.failures >= maxPollFailures {
+				return m.failSSO(msg.err), nil
+			}
+		} else {
+			m.sso.failures = 0
+		}
+		if msg.slower {
+			m.sso.interval += defaultDevicePoll
+		}
+		return m, devicePollAfter(m.sso.attempt, m.sso.interval)
+
+	case deviceFailedMsg:
+		if !m.sso.current(msg.attempt) {
+			return m, nil
+		}
+		return m.failSSO(msg.err), nil
+
 	case connectedMsg:
 		firstConnect := len(m.teams) == 0
 		m.connected = true
@@ -52,8 +135,13 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.rebuildIncidentTable()
 		m.rebuildTable()
 		m.rebuildArchivedTable()
+		var tick tea.Cmd
+		if !m.ticking {
+			m.ticking = true
+			tick = tickCmd(m.refreshInterval)
+		}
 		return m, tea.Batch(
-			tickCmd(m.refreshInterval),
+			tick,
 			fetchIncidentsCmd(m.client, m.activeTeamID, m.incidentFilter),
 			fetchStatsCmd(m.client),
 			statusCmd,
@@ -110,6 +198,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	case incidentDetailFetchedMsg:
 		m.selectedIncident = msg.incident
 		m.timeline = msg.timeline
+		m.similar = msg.similar
 		m.detailLoading = false
 		if m.noteCursor >= len(noteEvents(m.timeline)) {
 			m.noteCursor = -1
@@ -338,6 +427,14 @@ func (m Model) routeKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 	case modeAPIKeyMenu, modeAPIKeyReveal:
 		return m.handleKey(msg)
 
+	case modeLogin:
+		var inputCmd tea.Cmd
+		if !m.loggingIn && !m.sso.active && m.offersPasswords() {
+			m.loginInputs[m.loginFocus], inputCmd = m.loginInputs[m.loginFocus].Update(msg)
+		}
+		m2, ourCmd := m.handleKey(msg)
+		return m2, tea.Batch(inputCmd, ourCmd)
+
 	case modePasswordSet:
 		var inputCmd tea.Cmd
 		if !m.pwLoading {
@@ -407,6 +504,8 @@ func (m Model) handleKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		return m.handleAPIKeyMenuKey(msg)
 	case modePasswordSet:
 		return m.handlePasswordKey(msg)
+	case modeLogin:
+		return m.handleLoginKey(msg)
 	case modeAPIKeyCreate:
 		return m.handleAPIKeyCreateKey(msg)
 	case modeAPIKeyReveal:
@@ -456,6 +555,13 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		}
 		return m, nil
 
+	case "L":
+		if !m.connected {
+			return m, nil
+		}
+		m.statusMsg = "Signing out…"
+		return m, logoutCmd(m.client)
+
 	case "T":
 		if !m.connected || len(m.teams) == 0 {
 			return m, nil
@@ -886,8 +992,9 @@ func (m Model) handleIncidentDetailKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		m.mode = modeDashboard
 		return m, archiveIncidentCmd(m.client, inc.ID, m.activeTeamID, m.incidentFilter)
 
-	case "c":
+	case "c", "C":
 		m.mode = modeNote
+		m.notePinned = msg.String() == "C"
 		m.noteInput.Reset()
 		m.noteInput.Focus()
 		m.detailViewport.Height = m.detailViewportHeight()
@@ -980,7 +1087,7 @@ func (m Model) handleNoteKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		m.mode = modeIncidentDetail
 		m.noteInput.Blur()
 		m.detailViewport.Height = m.detailViewportHeight()
-		return m, addNoteCmd(m.client, m.selectedIncident.ID, content)
+		return m, addNoteCmd(m.client, m.selectedIncident.ID, content, m.notePinned)
 	}
 
 	return m, nil
@@ -1397,3 +1504,216 @@ func (m Model) handlePasswordKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 	}
 	return m, nil
 }
+
+// ── Sign in ───────────────────────────────────────────────────────────────────
+
+// msgError digs the error out of the messages that carry one, so the 401 check
+// in Update covers them all in one place.
+func msgError(msg tea.Msg) error {
+	switch msg := msg.(type) {
+	case connectErrMsg:
+		return msg.err
+	case fetchDataErrMsg:
+		return msg.err
+	case detailErrMsg:
+		return msg.err
+	case actionErrMsg:
+		return msg.err
+	case detailStatsErrMsg:
+		return msg.err
+	case scheduleFetchErrMsg:
+		return msg.err
+	case scheduleActionErrMsg:
+		return msg.err
+	case userActionErrMsg:
+		return msg.err
+	}
+	return nil
+}
+
+// requireLogin returns to the sign-in form with everything the previous session
+// loaded dropped, so a different account never sees the last one's incidents.
+func (m Model) requireLogin(note string) Model {
+	name := m.loginInputs[loginUsername].Value()
+	fresh := NewModel(m.client, m.serverURL, m.refreshInterval, m.theme)
+	fresh.width, fresh.height = m.width, m.height
+	fresh.defaultTeam = m.defaultTeam
+	fresh.authInfo, fresh.authPref = m.authInfo, m.authPref
+	fresh.ticking = m.ticking
+	fresh.mode = modeLogin
+	fresh.loginInputs[loginUsername].SetValue(name)
+	fresh.loginNote = note
+	fresh.focusLogin(loginUsername)
+	if name != "" {
+		fresh.focusLogin(loginPassword)
+	}
+	fresh.rebuildIncidentTable()
+	fresh.rebuildTable()
+	fresh.rebuildArchivedTable()
+	fresh.rebuildScheduleTable()
+	fresh.rebuildUserPickerTable()
+	fresh.rebuildUserManageTable()
+	return fresh
+}
+
+func (m *Model) blurLoginForm() {
+	for i := range m.loginInputs {
+		m.loginInputs[i].Blur()
+	}
+}
+
+func (m *Model) focusLogin(field int) {
+	m.blurLoginForm()
+	m.loginFocus = field
+	m.loginInputs[field].Focus()
+}
+
+// loginErrorText turns a failed sign-in into something to act on. The server
+// answers a wrong password, an unknown user and an account with no password with
+// the same 401, so the last one has to be named here or it reads as a typo.
+func loginErrorText(err error) string {
+	var se *api.StatusError
+	if errors.As(err, &se) {
+		switch se.Code {
+		case http.StatusUnauthorized:
+			return "invalid username or password — an account with no password cannot sign in; set one in the web UI first"
+		case http.StatusTooManyRequests:
+			return "too many attempts — wait a few minutes and try again"
+		}
+	}
+	return err.Error()
+}
+
+// ── Single sign-on ────────────────────────────────────────────────────────────
+
+// current reports whether a message belongs to the attempt in progress. Anything
+// else is the late answer of one that was cancelled, replaced or finished.
+func (s ssoLogin) current(attempt int) bool { return s.active && attempt == s.attempt }
+
+// canSSO is whether the server can sign in a client with no browser.
+func (m Model) canSSO() bool { return m.authInfo != nil && m.authInfo.DeviceLogin }
+
+// offersPasswords is whether the password form is worth showing. Until the
+// server has answered it is: the form is what a server too old to be asked has.
+func (m Model) offersPasswords() bool { return m.authInfo == nil || m.authInfo.PasswordLogin }
+
+// autoStartsSSO is whether the form should start a single sign-on login by
+// itself: when the config asks for it, and when the server has no passwords, so
+// that there is nothing else to show.
+func (m Model) autoStartsSSO() bool {
+	return m.canSSO() && !m.sso.active && (m.authPref == "sso" || !m.offersPasswords())
+}
+
+// ssoName is what the provider is called on screen.
+func (m Model) ssoName() string {
+	if m.authInfo != nil && m.authInfo.OIDC.Name != "" {
+		return m.authInfo.OIDC.Name
+	}
+	return "single sign-on"
+}
+
+// enterLogin is what to do on arriving at the sign-in form other than by
+// starting up: learn how the server can be signed in to if that is not known,
+// and, when auto is set, start a single sign-on login if the config or the
+// server's lack of passwords calls for one.
+func (m Model) enterLogin(auto bool) (Model, tea.Cmd) {
+	if m.authInfo == nil {
+		return m, authConfigCmd(m.client)
+	}
+	if auto && m.autoStartsSSO() {
+		return m.startSSO()
+	}
+	return m, nil
+}
+
+// startSSO begins a device login, replacing any earlier attempt.
+func (m Model) startSSO() (Model, tea.Cmd) {
+	m.sso = ssoLogin{attempt: m.sso.attempt + 1, active: true}
+	m.loginErr = ""
+	return m, startDeviceCmd(m.client, m.sso.attempt)
+}
+
+// cancelSSO abandons the attempt in progress. The server forgets the login when
+// it expires; there is nothing to tell it.
+func (m Model) cancelSSO() Model {
+	m.sso = ssoLogin{attempt: m.sso.attempt + 1}
+	return m
+}
+
+// failSSO ends the attempt and says why on the form.
+func (m Model) failSSO(err error) Model {
+	m = m.cancelSSO()
+	m.loginErr = ssoErrorText(err, m.ssoName())
+	return m
+}
+
+// ssoErrorText turns a failed single sign-on into something to act on.
+func ssoErrorText(err error, name string) string {
+	var se *api.StatusError
+	switch {
+	case errors.Is(err, api.ErrDeviceExpired):
+		return "the sign-in expired before it was approved — start it again"
+	case errors.Is(err, api.ErrDeviceDenied):
+		return "the sign-in was refused in the browser"
+	case errors.As(err, &se) && se.Code == http.StatusNotFound:
+		return "this server does not offer sign-in with " + name
+	case errors.As(err, &se) && se.Code == http.StatusTooManyRequests:
+		return "too many attempts — wait a few minutes and try again"
+	}
+	return "sign-in with " + name + " failed: " + err.Error()
+}
+
+func (m Model) handleLoginKey(msg tea.KeyMsg) (Model, tea.Cmd) {
+	switch msg.String() {
+	case "ctrl+c":
+		return m, tea.Quit
+	case "esc":
+		// Backs out of a single sign-on wait before it quits the program, so a
+		// wrong turn does not cost the session.
+		if m.sso.active {
+			return m.cancelSSO(), nil
+		}
+		return m, tea.Quit
+	}
+	if m.loggingIn || m.sso.active {
+		return m, nil
+	}
+	if msg.String() == "ctrl+o" && m.canSSO() {
+		return m.startSSO()
+	}
+	// With no password form there is one thing to do, and enter does it.
+	if msg.String() == "enter" && !m.offersPasswords() {
+		if m.canSSO() {
+			return m.startSSO()
+		}
+		return m, nil
+	}
+
+	switch msg.String() {
+	case "tab", "shift+tab", "down", "up":
+		next := loginPassword
+		if m.loginFocus == loginPassword {
+			next = loginUsername
+		}
+		m.focusLogin(next)
+		return m, nil
+
+	case "enter":
+		username := strings.TrimSpace(m.loginInputs[loginUsername].Value())
+		password := m.loginInputs[loginPassword].Value()
+		switch {
+		case username == "":
+			m.loginErr = "enter your username"
+			m.focusLogin(loginUsername)
+			return m, nil
+		case password == "":
+			m.loginErr = "enter your password"
+			m.focusLogin(loginPassword)
+			return m, nil
+		}
+		m.loggingIn = true
+		m.loginErr = ""
+		return m, loginCmd(m.client, m.serverURL, username, password)
+	}
+	return m, nil
+}

internal/tui/view.go

@@ -34,6 +34,70 @@ func (m Model) renderHeader() string {
 	return spread(title, right, m.width)
 }
 
+// renderLogin is the sign-in form. It is the whole body: nothing else is shown
+// until the server has accepted a session.
+func (m Model) renderLogin() string {
+	var b strings.Builder
+	b.WriteString("\n  " + m.styles.Bold.Render("Sign in to "+m.serverURL) + "\n\n")
+	if m.loginNote != "" {
+		b.WriteString(m.styles.Status.Render("  "+m.loginNote) + "\n\n")
+	}
+	if m.sso.active {
+		b.WriteString(m.renderSSOWait())
+		return b.String()
+	}
+	if m.offersPasswords() {
+		b.WriteString("  " + m.styles.Header.Render("Username: ") + m.loginInputs[loginUsername].View() + "\n")
+		b.WriteString("  " + m.styles.Header.Render("Password: ") + m.loginInputs[loginPassword].View() + "\n\n")
+	} else {
+		b.WriteString(m.styles.Muted.Render("  This server signs in with "+m.ssoName()+".") + "\n\n")
+	}
+	switch {
+	case m.loggingIn:
+		b.WriteString(m.styles.Muted.Render("  Signing in…") + "\n")
+	case m.loginErr != "":
+		b.WriteString(m.styles.Error.Render("  "+m.loginErr) + "\n")
+	}
+	if m.canSSO() && m.offersPasswords() {
+		b.WriteString("\n" + m.styles.Muted.Render("  or press ctrl+o to sign in with "+m.ssoName()) + "\n")
+	}
+	return b.String()
+}
+
+// renderSSOWait is the single sign-on screen: the link to open and the code to
+// check against it, while the client waits for the approval.
+func (m Model) renderSSOWait() string {
+	var b strings.Builder
+	l := m.sso.login
+	if l == nil {
+		b.WriteString(m.styles.Muted.Render("  Contacting the server…") + "\n")
+		return b.String()
+	}
+	b.WriteString("  " + m.styles.Header.Render("Sign in with "+m.ssoName()) + "\n\n")
+	b.WriteString("  Open this link in a browser, on any device, and approve the sign-in:\n\n")
+	b.WriteString("    " + m.styles.Accent.Render(l.VerificationURL) + "\n\n")
+	b.WriteString("  " + m.styles.Header.Render("Code: ") + m.styles.Bold.Render(l.UserCode) +
+		m.styles.Muted.Render("   it should match the code on that page") + "\n\n")
+	b.WriteString(m.styles.Muted.Render(fmt.Sprintf("  Waiting for approval… good for %d minutes", (l.ExpiresIn+59)/60)) + "\n")
+	return b.String()
+}
+
+// loginHelp is the sign-in footer, which depends on what the server offers.
+func (m Model) loginHelp() string {
+	switch {
+	case m.sso.active:
+		return "  esc·cancel"
+	case !m.offersPasswords():
+		if m.canSSO() {
+			return "  enter·sign in with " + m.ssoName() + "  esc·quit"
+		}
+		return "  esc·quit"
+	case m.canSSO():
+		return "  tab·next field  enter·sign in  ctrl+o·" + m.ssoName() + "  esc·quit"
+	}
+	return "  tab·next field  enter·sign in  esc·quit"
+}
+
 // activeTeamLabel names what the lists are narrowed to.
 func (m Model) activeTeamLabel() string {
 	if t, ok := m.activeTeam(); ok {
@@ -56,6 +120,9 @@ func (m Model) renderTabs() string {
 }
 
 func (m Model) renderBody() string {
+	if m.mode == modeLogin {
+		return m.renderLogin()
+	}
 	if m.err != nil {
 		return "\n" + m.styles.Error.Render(fmt.Sprintf("  Error: %v", m.err)) +
 			"\n" + m.styles.Muted.Render("  Press r to retry.")
@@ -68,7 +135,11 @@ func (m Model) renderBody() string {
 	case modeIncidentDetail, modeAlertDetail:
 		return m.renderDetail()
 	case modeNote:
-		return m.renderPrompt(m.styles.Header.Render("Note: ") + m.noteInput.View())
+		label := "Note: "
+		if m.notePinned {
+			label = "What fixed it: "
+		}
+		return m.renderPrompt(m.styles.Header.Render(label) + m.noteInput.View())
 	case modeSnooze:
 		return m.renderPrompt(m.styles.Header.Render("Snooze for: ") + m.snoozeInput.View())
 	case modeConfirm:
@@ -113,7 +184,7 @@ func (m Model) renderFooter() string {
 	switch m.mode {
 	case modeIncidentDetail:
 		if !m.selectedIncident.IsOpen() {
-			return withStatus("  x·archive  c·note  [/]·select  d·del  esc·back")
+			return withStatus("  x·archive  c·note  C·fix note  [/]·select  d·del  esc·back")
 		}
 		return withStatus("  a·ack  A·unack  R·resolve  s·assign  z·snooze  Z·unsnooze  c·note  [/]·select  d·del  esc·back")
 
@@ -160,10 +231,13 @@ func (m Model) renderFooter() string {
 	case modePasswordSet:
 		return withStatus("  tab·next field  enter·set password  esc·cancel")
 
+	case modeLogin:
+		return "\n" + m.styles.Footer.Render(m.loginHelp())
+
 	default:
 		switch m.activeSection {
 		case sectionIncidents:
-			return withStatus("  enter·detail  x·archive  f·filter  " + m.teamHint() + "r·refresh  tab·section  q·quit")
+			return withStatus("  enter·detail  x·archive  f·filter  " + m.teamHint() + "r·refresh  tab·section  L·sign out  q·quit")
 		case sectionAlerts:
 			return withStatus("  enter·detail  f·filter  " + m.teamHint() + "r·refresh  tab·section  q·quit")
 		case sectionStats:
@@ -173,7 +247,7 @@ func (m Model) renderFooter() string {
 		case sectionSchedule:
 			return withStatus("  +·assign day  W·assign week  d·del  ←/→·shift week  " + m.teamHint() + "tab·section  r·refresh  q·quit")
 		case sectionUsers:
-			return withStatus("  n·new user  t·topic  d·delete  k·API keys  p·password  r·refresh  tab·section  q·quit")
+			return withStatus("  n·new user  t·topic  d·delete  k·API keys  p·password  r·refresh  L·sign out  q·quit")
 		}
 		return "\n" + m.styles.Footer.Render(m.help.ShortHelpView(m.keys.ShortHelp()))
 	}
@@ -460,7 +534,7 @@ func line(style lipgloss.Style, s string) string {
 
 // ── Content builders ───────────────────────────────────────────────────────
 
-func buildIncidentDetailContent(s Styles, inc api.Incident, timeline []api.IncidentEvent, cursor, width int) string {
+func buildIncidentDetailContent(s Styles, inc api.Incident, timeline []api.IncidentEvent, similar []api.SimilarIncident, cursor, width int) string {
 	now := time.Now()
 	var b strings.Builder
 	contentW := width - 4
@@ -554,6 +628,22 @@ func buildIncidentDetailContent(s Styles, inc api.Incident, timeline []api.Incid
 	}
 	b.WriteString("\n")
 
+	// Seen before: earlier incidents of the same kind that someone left notes on.
+	if len(similar) > 0 {
+		b.WriteString(divider(s, "Seen before", width))
+		for _, sim := range similar {
+			b.WriteString(fmt.Sprintf("  #%-6d %-44s %s\n", sim.ID, truncate(sim.Title, 44),
+				s.Muted.Render("resolved "+humanAgo(now, sim.ResolvedAt))))
+			for _, n := range sim.ResolutionNotes {
+				b.WriteString("    " + s.Resolved.Render("fixed: ") + n.Detail + "\n")
+			}
+			if len(sim.ResolutionNotes) == 0 {
+				b.WriteString(line(s.Muted, fmt.Sprintf("    %d note(s), no resolution note", sim.NoteCount)))
+			}
+		}
+		b.WriteString("\n")
+	}
+
 	// Timeline — the only history the server keeps.
 	notes := noteEvents(timeline)
 	b.WriteString(divider(s, fmt.Sprintf("Timeline (%d events, %d notes)", len(timeline), len(notes)), width))
@@ -563,7 +653,7 @@ func buildIncidentDetailContent(s Styles, inc api.Incident, timeline []api.Incid
 		noteIndex := 0
 		for _, e := range timeline {
 			when := s.Muted.Render(humanAgo(now, e.CreatedAt))
-			if e.Type != api.EventNote {
+			if e.Type != api.EventNote && e.Type != api.EventResolutionNote {
 				b.WriteString(fmt.Sprintf("  %-52s %s\n", eventLabel(e), when))
 				continue
 			}
@@ -573,7 +663,11 @@ func buildIncidentDetailContent(s Styles, inc api.Incident, timeline []api.Incid
 				marker = s.Selected.Render("> ")
 				author = s.Selected.Render(e.Username)
 			}
-			b.WriteString(fmt.Sprintf("%s%-50s %s\n", marker, author+" wrote", when))
+			verb := " wrote"
+			if e.Type == api.EventResolutionNote {
+				verb = " noted the fix"
+			}
+			b.WriteString(fmt.Sprintf("%s%-50s %s\n", marker, author+verb, when))
 			b.WriteString("    " + e.Detail + "\n")
 			noteIndex++
 		}

internal/tui/view_test.go

@@ -57,7 +57,7 @@ func TestIncidentDetail_RendersTheWholeStory(t *testing.T) {
 		{Type: api.EventNote, Username: "admin", Detail: "draining node-2", CreatedAt: now},
 	}
 
-	out := buildIncidentDetailContent(testStyles(), inc, timeline, -1, 110)
+	out := buildIncidentDetailContent(testStyles(), inc, timeline, nil, -1, 110)
 	mustContain(t, out,
 		"DiskFull (namespace=prod)", "ACKNOWLEDGED", "CRITICAL",
 		"Assigned:", "admin",
@@ -77,7 +77,7 @@ func TestIncidentDetail_ShowsSnooze(t *testing.T) {
 	}
 	// The exact remaining time is humanUntil's business, not this test's — a few
 	// microseconds of elapsed clock turn "in 2h" into "in 1h 59m".
-	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, -1, 110),
+	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, nil, -1, 110),
 		"TRIGGERED (snoozed)", "Snoozed:", "until", "in 1h")
 }
 
@@ -88,7 +88,7 @@ func TestIncidentDetail_HidesExpiredSnooze(t *testing.T) {
 		Title: "Noisy", Status: api.StatusTriggered,
 		TriggeredAt: time.Now(), SnoozedUntil: &past,
 	}
-	if strings.Contains(plain(buildIncidentDetailContent(testStyles(), inc, nil, -1, 110)), "Snoozed:") {
+	if strings.Contains(plain(buildIncidentDetailContent(testStyles(), inc, nil, nil, -1, 110)), "Snoozed:") {
 		t.Error("an expired snooze should not be rendered")
 	}
 }
@@ -100,18 +100,18 @@ func TestIncidentDetail_ShowsResolutionSource(t *testing.T) {
 		Title: "Done", Status: api.StatusResolved, TriggeredAt: now.Add(-time.Hour),
 		ResolvedAt: &now, ResolutionSource: &source,
 	}
-	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, -1, 110),
+	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, nil, -1, 110),
 		"RESOLVED", "Resolved:", "manual")
 }
 
 func TestIncidentDetail_UnassignedAndUnacknowledged(t *testing.T) {
 	inc := api.Incident{Title: "Fresh", Status: api.StatusTriggered, TriggeredAt: time.Now()}
-	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, -1, 110), "nobody", "not acknowledged")
+	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, nil, -1, 110), "nobody", "not acknowledged")
 }
 
 func TestIncidentDetail_EmptyTimeline(t *testing.T) {
 	inc := api.Incident{Title: "Fresh", Status: api.StatusTriggered, TriggeredAt: time.Now()}
-	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, -1, 110), "Nothing recorded yet")
+	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, nil, -1, 110), "Nothing recorded yet")
 }
 
 func TestIncidentDetail_MarksSelectedNote(t *testing.T) {
@@ -122,7 +122,7 @@ func TestIncidentDetail_MarksSelectedNote(t *testing.T) {
 	}
 	inc := api.Incident{Title: "X", Status: api.StatusTriggered, TriggeredAt: now}
 
-	out := plain(buildIncidentDetailContent(testStyles(), inc, timeline, 1, 110))
+	out := plain(buildIncidentDetailContent(testStyles(), inc, timeline, nil, 1, 110))
 	for _, line := range strings.Split(out, "\n") {
 		if strings.Contains(line, "alice") && !strings.HasPrefix(line, "> ") {
 			t.Errorf("expected the selected note marked, got %q", line)
@@ -212,7 +212,7 @@ func TestIncidentDetail_RendersNotifications(t *testing.T) {
 			Detail: "reminder: ntfy returned 502", CreatedAt: now},
 	}
 
-	got := buildIncidentDetailContent(testStyles(), inc, timeline, -1, 120)
+	got := buildIncidentDetailContent(testStyles(), inc, timeline, nil, -1, 120)
 	mustContain(t, got, "Notified niklas (triggered)", "Notification to niklas failed")
 }
 
@@ -349,3 +349,20 @@ func TestView_ZeroWidthRendersNothing(t *testing.T) {
 type errFixture struct{}
 
 func (errFixture) Error() string { return "connection refused" }
+
+func TestIncidentDetail_ShowsSimilarWithResolutionNotes(t *testing.T) {
+	now := time.Now()
+	inc := api.Incident{Title: "DiskFull", Status: api.StatusTriggered, TriggeredAt: now}
+	similar := []api.SimilarIncident{
+		{ID: 4, Title: "DiskFull (job=node)", ResolvedAt: now.Add(-48 * time.Hour),
+			ResolutionNotes: []api.IncidentEvent{{Type: api.EventResolutionNote, Detail: "rotated the logs"}}},
+		{ID: 2, Title: "DiskFull (job=node)", ResolvedAt: now.Add(-96 * time.Hour), NoteCount: 3},
+	}
+	out := plain(buildIncidentDetailContent(testStyles(), inc, nil, similar, -1, 110))
+	mustContain(t, out, "Seen before", "#4", "fixed: rotated the logs", "3 note(s), no resolution note")
+
+	// Nothing similar, no section.
+	if strings.Contains(plain(buildIncidentDetailContent(testStyles(), inc, nil, nil, -1, 110)), "Seen before") {
+		t.Error("expected no Seen before section without similar incidents")
+	}
+}

main.go

@@ -7,6 +7,7 @@ import (
 
 	"git.ryuvia.com/niklas/terdut-tui/internal/api"
 	"git.ryuvia.com/niklas/terdut-tui/internal/config"
+	"git.ryuvia.com/niklas/terdut-tui/internal/session"
 	"git.ryuvia.com/niklas/terdut-tui/internal/theme"
 	"git.ryuvia.com/niklas/terdut-tui/internal/tui"
 	"git.ryuvia.com/niklas/terdut-tui/internal/updater"
@@ -45,8 +46,18 @@ func main() {
 		os.Exit(1)
 	}
 
-	client := api.NewClient(cfg.ServerURL, cfg.APIKey)
-	model := tui.NewModel(client, cfg.ServerURL, cfg.RefreshInterval, th).WithDefaultTeam(cfg.Team)
+	client := api.NewClient(cfg.ServerURL)
+	if token := session.Load(cfg.ServerURL); token != "" {
+		client.SetSession(token)
+	}
+	note := ""
+	if cfg.LegacyAPIKey {
+		note = "api_key in config.yaml is no longer used: sign in with your username and password"
+	}
+	model := tui.NewModel(client, cfg.ServerURL, cfg.RefreshInterval, th).
+		WithDefaultTeam(cfg.Team).
+		WithAuth(cfg.Auth).
+		WithLogin(cfg.Username, note)
 
 	p := tea.NewProgram(model, tea.WithAltScreen())
 	if _, err := p.Run(); err != nil {