auth-oidc
OpenID Connect login. A provider arrives as data plus whatever quirk it insists on, rather than as a second copy of the flow.
As a git dependency
cargo add cratefield-auth-oidc --git https://github.com/Cratefield/harnessIn the repository, not on crates.io yet.
What it is
auth-oidc.
The authorization code flow with PKCE, sealed into a signed cookie at /start and spent at the callback. The flow is written once against a provider descriptor, so adding a provider is a row of data and the quirk it insists on, not a fork of the flow. An unknown provider is a 404; a known one whose credentials are not configured says exactly that rather than failing obscurely.
Apple posts its callback back to you. A form_post callback is a cross-site POST, so a SameSite=Lax session cookie does not arrive on it — which means the person who was signed in at /start looks like a stranger by the time the callback runs, and the linking rules quietly make them a second account. Who was signed in is therefore carried across inside the payload we signed, having been read and validated at /start, which is same-site.
Ports
Database · Clock · IdGen · Signer · HttpClient
Routes
/v1/auth-oidc
- GET
/v1/auth-oidc/{provider}/ start ?return_to=/path - GET
/v1/auth-oidc/{provider}/ callback ?code&state - POST
/v1/auth-oidc/{provider}/ callback
History
Changelog.
Not released on its own: it is taken from the repository as a git dependency, and has no CHANGELOG.md yet.
Account linking happens in auth-core, and only ever on an email both sides say they verified.