Repository navigation
Add Google, GitHub and Apple login support - #136
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Extend the existing social authentication flow with GitHub OAuth/PKCE and verified primary email lookup, and Apple form POST callbacks with a 303 frontend redirect. Apple's ID token verifier accepts boolean/string email verification while checking RS256 signatures, issuer, audience, expiry and nonce. Google continues to use the existing OIDC verification flow.
Add optional named client credentials for Google, GitHub and Apple. Carry an optional browser binding through provider state and single-use exchange codes, and return the verified provider email with the ordinary login fields. Existing clients that omit the binding at both ends remain compatible. Include matching PostgreSQL/SQLite migrations and setup documentation. This supplies the backend contract for the companion Atomic PR.
Validation: 417 unit tests pass (38 existing DB/external tests ignored by the default run); all 8 focused identity tests pass on fresh PostgreSQL and SQLite databases. Required
cargo clippy -- -D warnings, formatting and database/storage boundary checks pass. The optional--all-targetsClippy run finds pre-existing warnings insrc/cache/mod.rs,src/models/enums.rsandtests/m50_entity_mutation_authorization.rs, which are outside this change. Local signed provider mocks cover invalid signature, nonce, audience, expiry and unverified email. Real provider credentials remain unset; complete a real browser signup/login per provider before production enablement.Companion Builder PR: https://github.com/absmach/atomic/pull/234