Skip to content

Add admin-managed OAuth sign-in flow#1303

Open
Zetazzz wants to merge 19 commits into
mainfrom
feat/oauth-reorg
Open

Add admin-managed OAuth sign-in flow#1303
Zetazzz wants to merge 19 commits into
mainfrom
feat/oauth-reorg

Conversation

@Zetazzz

@Zetazzz Zetazzz commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Add OAuth/OIDC sign-in routes to the GraphQL server using database-backed provider configuration.
  • Add admin REST APIs for managing identity providers, including listing providers, updating client/config fields, and rotating client secrets.
  • Add app auth settings APIs so admins can control OAuth-related auth behavior such as identity sign-in/sign-up, verified-email requirements, cookie settings, and OAuth error redirects.
  • Add module loaders needed by the OAuth flow to discover identity provider, connected account, user auth, and auth settings metadata at runtime.
  • Update @constructive-io/oauth with reusable signed state handling and provider/client support used by the server flow.

Behavior

  • OAuth providers are read from admin-managed identity provider config.
  • New OAuth identities can be gated on verified provider email.
  • Existing identities are detected before choosing sign-in vs sign-up.
  • OAuth state is signed and time-bound.
  • Redirects are constrained to same-origin callback targets.

Follow-ups

  • Loader cache invalidation and TTL policy.
  • App settings interval parsing.
  • App-settings-auth loader refactor.
  • API service cache snapshots.
  • Env config consolidation for CAPTCHA/upload settings.

Testing

  • Not run in this pass.

@blacksmith-sh

This comment has been minimized.

* GET /app-settings-auth
* Get current auth settings
*/
router.get('/app-settings-auth', async (req: Request, res: Response) => {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why are we making REST routes for things the user can query for via our APIs?

ip.scopes,
ip.pkce_enabled
FROM ${providersTable} ip
LEFT JOIN "constructive_store_private"."platform_secrets" secrets

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is hardcoding a schema... probably not the right path here, either.

// ─── SQL ────────────────────────────────────────────────────────────────────

const USER_AUTH_MODULE_SQL = `
SELECT

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is the right solution, because it queries for the schema

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants