feat(oidc): kick off code+PKCE flow on /login instead of HubRedirect #50
No reviewers
Labels
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
psa-systems/mokosh-apps!50
Loading…
Reference in a new issue
No description provided.
Delete branch "feat/start-authorize-on-sign-in"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The /login route's Login component was still a pre-OIDC dev shortcut: it
HubRedirect'd straight to bunyip's /login, which is why "Sign in" on
msp.a8n.systems just looped back to bunyip's dashboard. Every other piece
of the cutover assumed the SPA would actually start a PKCE handshake here.
Replace HubRedirect with the same start_login(cfg, "/dashboard") call
AuthGuard already runs for protected routes. The browser navigates to
{issuer}/oauth2/authorize?response_type=code&client_id=...&code_challenge=...&...
and the round-trip completes via the existing /auth/callback handler
(src/pages/auth_callback.rs), which exchanges the code at the token
endpoint, parses claims, and lands the user on /dashboard.
Update the AuthGuard comment block while we're here: it called /login a
"legacy redirect stub". It's an active OIDC kickoff now.
The /login route's Login component was still a pre-OIDC dev shortcut: it HubRedirect'd straight to bunyip's /login, which is why "Sign in" on msp.a8n.systems just looped back to bunyip's dashboard. Every other piece of the cutover assumed the SPA would actually start a PKCE handshake here. Replace HubRedirect with the same start_login(cfg, "/dashboard") call AuthGuard already runs for protected routes. The browser navigates to {issuer}/oauth2/authorize?response_type=code&client_id=...&code_challenge=...&... and the round-trip completes via the existing /auth/callback handler (src/pages/auth_callback.rs), which exchanges the code at the token endpoint, parses claims, and lands the user on /dashboard. Update the AuthGuard comment block while we're here: it called /login a "legacy redirect stub". It's an active OIDC kickoff now.