Phase 2b: OIDC client registration at app install + {{ oidc.* }} template vars - #149
Open
ClaydeCode wants to merge 5 commits into
Open
Phase 2b: OIDC client registration at app install + {{ oidc.* }} template vars#149ClaydeCode wants to merge 5 commits into
ClaydeCode wants to merge 5 commits into
Conversation
This was referenced Jul 10, 2026
ClaydeCode
force-pushed
the
feature/oidc-phase2b-install
branch
from
July 11, 2026 11:03
ce0f3ab to
61a3800
Compare
ClaydeCode
force-pushed
the
feature/oidc-phase2b-install
branch
from
July 11, 2026 18:16
61a3800 to
88e6f79
Compare
ClaydeCode
force-pushed
the
feature/oidc-phase2b-install
branch
from
July 11, 2026 18:45
88e6f79 to
b87d350
Compare
ClaydeCode
force-pushed
the
feature/oidc-phase2b-install
branch
2 times, most recently
from
July 27, 2026 19:33
262ad43 to
67b8081
Compare
…} template vars
app_meta.json gains an optional oidc section (redirect_uris — may reference
{{ portal.domain }} —, public_client, scope). Compose-template rendering
registers/refreshes the app's OIDC client and passes oidc.client_id,
oidc.client_secret and oidc.issuer into the template. Registration lives in
the render step because rendering runs at install, reinstall and every
startup — redirect URIs heal automatically after a domain change with no
extra hook.
The client upsert preserves client_id/client_secret on conflict so
reinstalls and re-renders never invalidate an app's configured credentials.
Uninstalling an app removes its client row, cascading its codes and tokens.
Apps without an oidc section are unaffected (oidc=None in the context).
Phase 2b of the multi-user identity rollout; companion app-repository PR
adds the first catalog app (paperless-ngx) on this mechanism.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A shard that is not in the OIDC rollout answers 404 on every provider endpoint, so registering a client for an installed app would write credentials pointing at an IdP that does not respond. Gate the registration on the same flag and log a warning, since the app's template then renders with empty OIDC_* values — a state worth finding in the logs rather than in the app's own error output. The blank-credential path is what makes this the flag's boundary: the flag gates shard_core, not the app store, so an app whose app_meta.json declares an oidc section stays installable on a shard where the provider is off. Do not publish such an app to shards outside the rollout. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Apps that implement OIDC Back-Channel Logout 1.0 can now advertise the endpoint in their app_meta oidc block, so the shard can sign that device out of the app when its terminal is un-paired. Rendered and stored at client registration alongside redirect_uris. Optional by design: an app that omits it cannot be signed out from our side, only from its own UI. Making that visible in metadata is what lets us say which apps are fully revocable. Delivery itself is not built here — see the follow-up issue. Refs #189
Renders backchannel_logout_uri from app_meta the same way redirect_uris are rendered and stores it on the client row, so the shard knows where to send a logout token when a device is un-paired. The mock app's zip is rebuilt because the app store serves the committed zip, not the loose app_meta.json beside it -- editing only the loose file is a silent no-op. Delivery is not implemented here; see #192. Refs #189
ClaydeCode
force-pushed
the
feature/oidc-phase2b-install
branch
from
July 31, 2026 11:44
67b8081 to
fd4266f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase 2b of the multi-user identity rollout: apps get OIDC credentials automatically at install. Stacked on the phase-2a provider PR.
What this does
app_meta.jsongains an optionaloidcsection (redirect_uris— may reference{{ portal.domain }}—,public_client,scope).render_docker_compose_templateregisters/refreshes the app's OIDC client and passes{{ oidc.client_id }},{{ oidc.client_secret }},{{ oidc.issuer }}to the template. Because rendering runs at install, reinstall AND every startup, redirect URIs heal automatically (e.g. after a domain change) — no extra hook needed.client_id/client_secreton conflict, so reinstalls and re-renders never invalidate an app's configured client.Apps without an
oidcsection are untouched (oidc=Nonein the template context).Companion PR
app-repository: paperless-ngx catalog entry using this mechanism (allauth
openid_connectvia env, auto-signup, SSO redirect) — the admin-vs-daily-account request from freeshard#141. Ships app-by-app; more apps follow independently. Immich needs its config-file/API mechanism and is deliberately not in this pass.Tests
Three integration tests over the real install worker + Docker using a new
oidc_appin the mock store: install registers the client with domain-rendered redirect URIs and renders creds into the compose file; reinstall keeps credentials; uninstall removes the client.Recommended reading order
shard_core/data_model/app_meta.py—OidcMetashard_core/database/oidc.py— upsert preserves creds; get/remove by app_nameshard_core/service/oidc_provider.py—ensure_app_client(),issuer_for_domain()shard_core/service/app_installation/util.py— render hookshard_core/service/app_installation/worker.py— uninstall cleanuptests/mock_app_store/oidc_app/*,tests/test_oidc_app_install.py🤖 Generated with Claude Code
Test status
New install tests 3/3 green; regression run over
test_app_installation.py+test_oidc.py+test_users.py: 29 passed, 0 failed.