Phase 2b: OIDC client registration at app install + {{ oidc.* }} template vars#149
Open
ClaydeCode wants to merge 1 commit into
Open
Phase 2b: OIDC client registration at app install + {{ oidc.* }} template vars#149ClaydeCode wants to merge 1 commit into
ClaydeCode wants to merge 1 commit into
Conversation
This was referenced Jul 10, 2026
ClaydeCode
force-pushed
the
feature/oidc-phase2a-provider
branch
from
July 11, 2026 10:58
0d462e4 to
6bd962a
Compare
ClaydeCode
force-pushed
the
feature/oidc-phase2b-install
branch
from
July 11, 2026 11:03
ce0f3ab to
61a3800
Compare
ClaydeCode
force-pushed
the
feature/oidc-phase2a-provider
branch
from
July 11, 2026 18:11
6bd962a to
7d3a362
Compare
ClaydeCode
force-pushed
the
feature/oidc-phase2b-install
branch
from
July 11, 2026 18:16
61a3800 to
88e6f79
Compare
ClaydeCode
force-pushed
the
feature/oidc-phase2a-provider
branch
from
July 11, 2026 18:43
7d3a362 to
be5293b
Compare
ClaydeCode
force-pushed
the
feature/oidc-phase2b-install
branch
from
July 11, 2026 18:45
88e6f79 to
b87d350
Compare
…} template vars
app_meta.json gains an optional oidc section (redirect_uris — may reference
{{ portal.domain }} —, public_client, scope). Compose-template rendering
registers/refreshes the app's OIDC client and passes oidc.client_id,
oidc.client_secret and oidc.issuer into the template. Registration lives in
the render step because rendering runs at install, reinstall and every
startup — redirect URIs heal automatically after a domain change with no
extra hook.
The client upsert preserves client_id/client_secret on conflict so
reinstalls and re-renders never invalidate an app's configured credentials.
Uninstalling an app removes its client row, cascading its codes and tokens.
Apps without an oidc section are unaffected (oidc=None in the context).
Phase 2b of the multi-user identity rollout; companion app-repository PR
adds the first catalog app (paperless-ngx) on this mechanism.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ClaydeCode
force-pushed
the
feature/oidc-phase2a-provider
branch
from
July 27, 2026 11:14
be5293b to
ba1ea67
Compare
ClaydeCode
force-pushed
the
feature/oidc-phase2b-install
branch
from
July 27, 2026 11:14
b87d350 to
262ad43
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase 2b of the multi-user identity rollout: apps get OIDC credentials automatically at install. Stacked on the phase-2a provider PR.
What this does
app_meta.jsongains an optionaloidcsection (redirect_uris— may reference{{ portal.domain }}—,public_client,scope).render_docker_compose_templateregisters/refreshes the app's OIDC client and passes{{ oidc.client_id }},{{ oidc.client_secret }},{{ oidc.issuer }}to the template. Because rendering runs at install, reinstall AND every startup, redirect URIs heal automatically (e.g. after a domain change) — no extra hook needed.client_id/client_secreton conflict, so reinstalls and re-renders never invalidate an app's configured client.Apps without an
oidcsection are untouched (oidc=Nonein the template context).Companion PR
app-repository: paperless-ngx catalog entry using this mechanism (allauth
openid_connectvia env, auto-signup, SSO redirect) — the admin-vs-daily-account request from freeshard#141. Ships app-by-app; more apps follow independently. Immich needs its config-file/API mechanism and is deliberately not in this pass.Tests
Three integration tests over the real install worker + Docker using a new
oidc_appin the mock store: install registers the client with domain-rendered redirect URIs and renders creds into the compose file; reinstall keeps credentials; uninstall removes the client.Recommended reading order
shard_core/data_model/app_meta.py—OidcMetashard_core/database/oidc.py— upsert preserves creds; get/remove by app_nameshard_core/service/oidc_provider.py—ensure_app_client(),issuer_for_domain()shard_core/service/app_installation/util.py— render hookshard_core/service/app_installation/worker.py— uninstall cleanuptests/mock_app_store/oidc_app/*,tests/test_oidc_app_install.py🤖 Generated with Claude Code
Test status
New install tests 3/3 green; regression run over
test_app_installation.py+test_oidc.py+test_users.py: 29 passed, 0 failed.