Platform-mode door signs in through /_plat/login and out through /_plat/logout #20

New issue

Closed

opened 2026-08-24 21:56:03 +00:00 by plat · 0 comments

plat commented

2026-08-24 21:56:03 +00:00

Owner

plat-auth 0.45.2 answers two entry points on every app host, before the app: /_plat/login?rd=<same-host path> (start the edge sign-in, return to the path; BYOD hosts get their nonce planted) and /_plat/logout?rd=<path> (end the host-only session, then the shared one).

They exist because a public app (app.yaml public: true — anonymous readers allowed through so link crawlers can fetch share cards) never triggers the edge login on its own, so its door had no way to sign a customer in; and a BYOD host's session is a host-only cookie only that host can clear.

Template: in platform mode (forwardAuth in the boot payload), the door's Sign in → /_plat/login?rd=<current path> and Sign out → /_plat/logout?rd=/; the SPA's 401 handling offers the same link. App mode unchanged. Tests + the wiki's auth page. (First app wired by hand: otavert/gretchy-stretchy PR #12.)

plat-auth 0.45.2 answers two entry points on every app host, before the app: `/_plat/login?rd=<same-host path>` (start the edge sign-in, return to the path; BYOD hosts get their nonce planted) and `/_plat/logout?rd=<path>` (end the host-only session, then the shared one). They exist because a **public** app (`app.yaml public: true` — anonymous readers allowed through so link crawlers can fetch share cards) never triggers the edge login on its own, so its door had no way to sign a customer in; and a BYOD host's session is a host-only cookie only that host can clear. **Template:** in platform mode (`forwardAuth` in the boot payload), the door's Sign in → `/_plat/login?rd=<current path>` and Sign out → `/_plat/logout?rd=/`; the SPA's 401 handling offers the same link. App mode unchanged. Tests + the wiki's auth page. (First app wired by hand: otavert/gretchy-stretchy PR #12.)

plat referenced this issue from a pull request that will close it,

2026-08-25 19:17:16 +00:00

template 0.8.0: anon, user, admin — three tiers decided in Forgejo, carried by the edge; the door, hardened #21

plat closed this issue

2026-08-25 19:23:12 +00:00