feat(dev-sso): point the SPA OIDC issuer at bunyip-api #67

Merged

longjacksonle merged 1 commit from feat/dev-sso-bunyip-issuer into main

2026-06-05 19:40:41 +02:00

longjacksonle commented

2026-06-05 19:36:21 +02:00

Owner

What

After the bunyip-as-OP cutover the OIDC issuer is bunyip-api, not mokosh-server. Bake MOKOSH_OIDC_ISSUER=https://${USER}-bunyip-api.a8n.run so the SPA runs its PKCE flow against bunyip-api's /oauth2/*; mokosh-server is only a Resource Server for the resulting at+jwt. Mirrors staging, where msp.<tld> derives issuer api.<tld> (bunyip-api).

Changes

compose.dev-sso.yml: MOKOSH_OIDC_ISSUER -> bunyip-api; refresh the client-id comment to point at just register-dev-clients (bunyip repo). The SPA's API calls stay on the same-origin /api/v1 dev proxy (fetch.rs::api_base returns /api/v1 for any non-msp. host), so no cross-origin change is needed. MOKOSH_OIDC_CLIENT_ID is set per-developer in .env.

Companion PRs

bunyip feat/dev-sso-bunyip-as-op (the OP).
mokosh-server feat/dev-sso-rs-trust-bunyip (Resource Server env).

Verification

Browser flow: SPA authenticates at bunyip-api (reachable on nebula-secure), then calls same-origin /api/v1/* proxied to mokosh-server, which validates the bunyip token. The scripted login -> token -> create-company chain returns 200 end to end.

🤖 Generated with Claude Code

## What After the bunyip-as-OP cutover the OIDC issuer is bunyip-api, not mokosh-server. Bake `MOKOSH_OIDC_ISSUER=https://${USER}-bunyip-api.a8n.run` so the SPA runs its PKCE flow against bunyip-api's `/oauth2/*`; mokosh-server is only a Resource Server for the resulting `at+jwt`. Mirrors staging, where `msp.<tld>` derives issuer `api.<tld>` (bunyip-api). ## Changes - `compose.dev-sso.yml`: `MOKOSH_OIDC_ISSUER` -> bunyip-api; refresh the client-id comment to point at `just register-dev-clients` (bunyip repo). The SPA's API calls stay on the same-origin `/api/v1` dev proxy (`fetch.rs::api_base` returns `/api/v1` for any non-`msp.` host), so no cross-origin change is needed. `MOKOSH_OIDC_CLIENT_ID` is set per-developer in `.env`. ## Companion PRs - bunyip `feat/dev-sso-bunyip-as-op` (the OP). - mokosh-server `feat/dev-sso-rs-trust-bunyip` (Resource Server env). ## Verification Browser flow: SPA authenticates at bunyip-api (reachable on nebula-secure), then calls same-origin `/api/v1/*` proxied to mokosh-server, which validates the bunyip token. The scripted login -> token -> create-company chain returns 200 end to end. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

longjacksonle added 1 commit

2026-06-05 19:36:21 +02:00

feat(dev-sso): point the SPA OIDC issuer at bunyip-api

Check / clippy + fmt + tests (pull_request) Successful in 1m55s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

0b5a9d0081

After the bunyip-as-OP cutover the issuer is bunyip-api, not mokosh-server. Bake MOKOSH_OIDC_ISSUER=https://${USER}-bunyip-api.a8n.run so the SPA runs its PKCE flow against bunyip-api's /oauth2/*; mokosh-server is only a Resource Server for the resulting at+jwt. Mirrors staging, where msp.<tld> derives issuer api.<tld> (bunyip-api). The SPA's API calls stay on the same-origin /api/v1 dev proxy, so no cross-origin change is needed. The client_id (registered in bunyip-api by `just register-dev-clients`) is set per-developer in .env.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>