5 Commits

Include renames

Author	SHA1	Message	Date
woggioni	532cb16f94	Show the OIDC profile picture with an identicon fallback ... GET /api/me now carries the profile picture URL when the provider supplies an absolute http(s) one; the SPA shows it in the lobby navbar and draws a deterministic identicon from the sub otherwise, falling back to the identicon when the image fails to load. The identicon is a 5x5 mirrored grid seeded by an inline FNV-1a hash so it stays stable across Rust versions and is unit-testable on the host. The dev mock IdP hands alice and bob a picture claim.	2026-10-14 16:13:10 +00:00
woggioni	3fe29ba740	Stop requesting the user email from the OIDC provider ... OIDCConfig now asks for the openid and profile scopes only: kaya-oidc's default would also request email, which the platform never stores or exposes. The display-name fallback drops the email claim too (preferred_username, name, then the sub). Tests pin the configured scopes and cover an IdP that still returns an email claim: the claim is ignored and absent from /api/me.	2026-10-14 15:56:35 +00:00
woggioni	d2dae476f0	Prefer preferred_username for the displayed player name ... The free-form "name" claim can change and two accounts can share it; preferred_username is the account's stable handle. display_name() now falls back preferred_username -> name -> email -> sub, with tests pinning the claim priority.	2026-10-06 17:53:27 +08:00
woggioni	915a294dc8	Support multiple OIDC providers ... kaya-oidc 0.0.6 can run several providers in one app (OIDCProviders), each with its own login route and namespaced session state. Adopt it: providers are configured in indexed, contiguous OIDC_<n>_* blocks (0-based) with OIDC_<n>_PROVIDER naming the provider in its login URL and session keys. The old unindexed OIDC_ISSUER/OIDC_CLIENT_ID/... names are no longer read; startup fails with a rename hint when they are set. With no OIDC variables at all, the single dev mock provider named "default" is used, as before. The platform now authenticates through OIDCProviders: auth.current_user returns the session's user (sessions stay single-identity, so at most one provider is logged in) and require_auth/route handlers use it, while the websocket path keeps scanning for any provider's user. New routes expose the configuration to the SPA and keep old links working: GET /api/auth/providers lists the login URLs, GET /auth/login redirects to the first provider and GET /auth/logout to whichever provider the session is logged in with. The lobby renders one login button per provider from that endpoint. Update the env examples, compose and k8s manifests to the indexed scheme, document the multiple-provider setup and the migration, and cover it with config, auth and route tests.	2026-10-01 12:38:29 +00:00
woggioni	3abbbc6b68	Upgrade kaya to 0.0.6 ... kaya-oidc 0.0.6 namespaces its session state per provider as oidc:{provider}:user (the default provider is "default", so the key is oidc:default:user). The unprefixed oidc_user key is no longer written: left unadapted, every websocket upgrade would be rejected with 401 and traced requests would silently lose their user.id attribute. Adopt it with a session_user helper on tavolo.platform.auth that finds any provider's user, used by both get_ws_user and telemetry's session_tag_hook. Websocket and route handlers keep their signatures. kaya-otel 0.0.6 only enriches websocket spans with standard URL, network and peer attributes (plus error.type), which needs no application change. Regenerate the lock: the eight kaya pins move to 0.0.6 and, the wheels' declared metadata being unchanged, nothing else moves. tavolo-platform now floors kaya-core>=0.0.6 (it reads the new session layout) and tavolo-app floors kaya-otel>=0.0.6. As kaya documents, the session-key move signs existing logged-in users out once; they simply log in again.	2026-10-01 01:18:05 +00:00