inbuxa/inbuxa-admin
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 22 Wiki Activity Sponsor

Rewrite sign-in, the callback and the API wrapper #124

Merged
jcoffey-dev merged 1 commits from phase3/auth into main 2026-10-19 02:10:50 +00:00
Conversation 0 Commits 1 Files Changed 10
+920 -699
1 Commits
Author SHA1 Message Date
jcoffey-dev 8f01e828ac Rewrite sign-in, the callback and the API wrapper
ci / build (pull_request) Skipped
Details
ci / publish (pull_request) Skipped
Details
github/ci (branch) GitHub Actions
Details
ci / notices (pull_request) Successful in 1m39s
Details
ci / github (pull_request) Successful in 1m50s
Details 
OAuth (discovery, PKCE with S256, the redirect, the code trade, the
end-session URL), the client id, the login page, the callback and the API
wrapper are rewritten from what they do, with new tests: RFC 7636's worked
example for the challenge, the state check, refusal versus no answer on
refresh, a shared refresh, the retry after a 401.

The callback's checks move out of the page into services/auth/callback.ts,
where they are tested directly. Storage keys, the sign-in parameters,
strings and behavior are unchanged. Checked on a local server: a deep link
through sign-in, a refresh, sign-out and a forged callback.
 2026-10-18 18:46:46 -07:00