Authentication "Log" message should be printed to STDERR instead of STDOUT, to avoid breaking shell scripts which redirect output

[vorburger]

I'm using (something more or less like) the following inside a bash script:

oauth2l curl --scope tasks.readonly --url https://tasks.googleapis.com/tasks/v1/users/@me/lists --credentials credz.json >task-lists.json

Every 15' or so, when I it launches the Web Browser login thing, to refresh the token, which is successful (!), that task-lists.json file is "broken", and I have to manually fix it, because instead of containing valid JSON, it starts with:

Your browser has been opened to visit:

 https://accounts.google.com/o/oauth2/auth?client_id=...

{
  "kind": "tasks#tasks",

This is because oauth2l writes both it's "real output" (JSON) as well as it's "diagnostics bla bla" to STDOUT.

IMHO, it would be better if "Your browser has been opened to visit:" and what not were written to STDERR instead of STDOUT?

Code to be changed from fmt.Println to fmt.Fprintln(os.Stderr, "...") is here

Would you welcome a PR fixing this?

[andyrzhao]

Hi there, thank you for your feedback! IMO, relying on a convention of writing diagnostics to STDERR and output to STDOUT will be hard to enforce longterm. In your particular case, I believe we can support a consentSettings.SilentOpenConsentPage to not print out the prompts - that would make the usage intention very clear. We could also support a "silent" setting at the top level, but that would require a complete overhaul in prompts and diagnostics (unlikely anyone will be able to get to that in the near future.) Let me know if you still need this feature. thanks!