feat(auth): add generic OpenID Connect login - #354

Open

obelix58143 wants to merge 20 commits into

trypostit:mainfrom

obelix58143:feat/generic-oidc-login

Commits on Sep 14, 2026

feat(auth): add generic OpenID Connect login

obelix58143
and
claude
committed
12bbdf7
fix(auth): cache the raw JWKS instead of the parsed key set

obelix58143
and
claude
committed
605ae52
fix(auth): only block account adoption on an unverified email, not sign-in

obelix58143
and
claude
committed
6a694c4
feat(auth): allow email + password sign-in to be switched off

obelix58143
and
claude
committed
24c4435
fix(auth): only send a post-logout redirect when one is configured

obelix58143
and
claude
committed
a3b458f
fix(auth): leave the provider through an Inertia location visit

obelix58143
and
claude
committed
6bce2ec
feat(auth): derive the workspace role from provider groups

obelix58143
and
claude
committed
a7c02da
fix(auth): accept a groups claim sent as a string

obelix58143
and
claude
committed
a97ab99
fix(auth): give the first OIDC user a workspace on a fresh instance

obelix58143
and
claude
committed
86e61a2
fix(auth): leave the account owner out of the group role sync

obelix58143
and
claude
committed
211233f
fix(lang): use proper umlauts in the German strings

obelix58143
and
claude
committed
baab458
feat(auth): let an instance hand account ownership to the groups

obelix58143
and
claude
committed
86a96d0
test(auth): attack the ID token validation instead of only using it

obelix58143
and
claude
committed
45ae376
test(auth): cover the round-trip, the log and add throttling

obelix58143
and
claude
committed
7949b37
fix(auth): stop promising a password field the login page does not show

obelix58143
and
claude
committed
18601f1
style: apply pint to the rebase resolutions

obelix58143
and
claude
committed
1de4c6d
Merge branch 'main' into feat/generic-oidc-login
paulocastellano
authored
7b7a9b6
i18n(auth): translate the OIDC strings into every language

obelix58143
and
claude
committed
2eeac4e
build: require firebase/php-jwt v7 only

obelix58143
and
claude
committed
7806e2d
test(auth): cover the OIDC paths that were still untested

obelix58143
and
claude
committed
61b1e17

Navigation Menu

Uh oh!

feat(auth): add generic OpenID Connect login - #354

feat(auth): add generic OpenID Connect login#354
obelix58143 wants to merge 20 commits into
trypostit:mainfrom
obelix58143:feat/generic-oidc-login

Commits on Sep 14, 2026

feat(auth): add generic OpenID Connect login

fix(auth): cache the raw JWKS instead of the parsed key set

fix(auth): only block account adoption on an unverified email, not sign-in

feat(auth): allow email + password sign-in to be switched off

fix(auth): only send a post-logout redirect when one is configured

fix(auth): leave the provider through an Inertia location visit

feat(auth): derive the workspace role from provider groups

fix(auth): accept a groups claim sent as a string

fix(auth): give the first OIDC user a workspace on a fresh instance

fix(auth): leave the account owner out of the group role sync

fix(lang): use proper umlauts in the German strings

feat(auth): let an instance hand account ownership to the groups

test(auth): attack the ID token validation instead of only using it

test(auth): cover the round-trip, the log and add throttling

fix(auth): stop promising a password field the login page does not show

style: apply pint to the rebase resolutions

Merge branch 'main' into feat/generic-oidc-login

i18n(auth): translate the OIDC strings into every language

build: require firebase/php-jwt v7 only

test(auth): cover the OIDC paths that were still untested