Migrations/bookorbit
1
0
Fork 0
mirror of https://github.com/bookorbit/bookorbit.git synced 2026-11-03 00:11:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

feat(auth): add SSO-only authentication mode

Browse Source 
Require an enabled OIDC-linked superuser before disabling password flows. Track session authentication methods and fail closed across the API, web client, WebSockets, and administrative mutations.

Closes #1002
This commit is contained in:
neon
2026-09-02 05:04:18 +00:00
parent 6edde6c64d
commit 9165dbed1d
69 changed files with 19353 additions and 156 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+4
View File
@@ -64,6 +64,10 @@ NODE_MAX_OLD_SPACE_SIZE=2048
# Default false. Enable only in trusted self-hosted networks.
# OIDC_ALLOW_LOCAL_ISSUERS=false
# Disable username/password sign-in after at least one active administrator has linked an enabled
# OIDC provider. Set false and restart to recover access if the identity provider is unavailable.
# DISABLE_LOCAL_AUTH=false
# Optional: allow Cloudflare Web Analytics beacon when using automatic setup.
# Keep unset/false to preserve strict CSP (`script-src 'self'`).
# CSP_ALLOW_CLOUDFLARE_INSIGHTS=false