Sub-Task #256
open
Epic #3: Implement a secure user authentication system
Feature #160: User Login
User Story #176: As a user, I want to log in via OAuth/OIDC, so that I can use existing providers
Backend: OIDC endpoints (login start, callback, session)
100%
Description
Implements the actual OIDC auth flow endpoints:
- Login start: builds the authorize URL for a given provider id and redirects the user.
- Callback: handles the provider's redirect, exchanges the code, validates the token, creates/links the local user account, and creates a server-side session.
Updated by Bricklou 25 days ago
Naming for the account-linking table this ticket will need (users_id/provider_id/provider_user_id from the original ask): oidc_identities(id, user_id FK users, provider_key TEXT, subject TEXT, created_at, UNIQUE(provider_key, subject)).
provider_keymatches the YAML map key /ProviderKeyvalue object from #254 — not a DB foreign key, since providers aren't rows anywhere, they're config.subjectmatches the OIDC spec term for the IdP-side stable user identifier (thesubclaim), clearer thanprovider_user_id.
#254 hands this ticket an Arc<dyn OidcProviderRegistry> (Domain port, libs/server/domain/src/oidc/ports/oidc_provider_registry.rs) to look up the discovered client per ProviderKey — extend its OidcClient marker trait with whatever authorize-URL/token-exchange methods this ticket's flow needs (PKCE, state, nonce handling).
Updated by Bricklou 25 days ago
- Blocked by Sub-Task #254: Backend: OIDC provider configuration added
Updated by Bricklou 25 days ago
- Blocks Sub-Task #257: Frontend: OIDC login integration added