2 Commits

Include renames

Author	SHA1	Message	Date
woggioni	a89bd06010	Support multiple OIDC providers ... kaya-oidc 0.0.6 can run several providers in one app (OIDCProviders), each with its own login route and namespaced session state. Adopt it: providers are configured in indexed, contiguous OIDC_<n>_* blocks (0-based) with OIDC_<n>_PROVIDER naming the provider in its login URL and session keys. The old unindexed OIDC_ISSUER/OIDC_CLIENT_ID/... names are no longer read; startup fails with a rename hint when they are set. With no OIDC variables at all, the single dev mock provider named "default" is used, as before. The platform now authenticates through OIDCProviders: auth.current_user returns the session's user (sessions stay single-identity, so at most one provider is logged in) and require_auth/route handlers use it, while the websocket path keeps scanning for any provider's user. New routes expose the configuration to the SPA and keep old links working: GET /api/auth/providers lists the login URLs, GET /auth/login redirects to the first provider and GET /auth/logout to whichever provider the session is logged in with. The lobby renders one login button per provider from that endpoint. Update the env examples, compose and k8s manifests to the indexed scheme, document the multiple-provider setup and the migration, and cover it with config, auth and route tests.	2026-10-01 20:38:51 +08:00
woggioni	5eccaafadc	Upgrade kaya to 0.0.6 ... kaya-oidc 0.0.6 namespaces its session state per provider as oidc:{provider}:user (the default provider is "default", so the key is oidc:default:user). The unprefixed oidc_user key is no longer written: left unadapted, every websocket upgrade would be rejected with 401 and traced requests would silently lose their user.id attribute. Adopt it with a session_user helper on tavolo.platform.auth that finds any provider's user, used by both get_ws_user and telemetry's session_tag_hook. Websocket and route handlers keep their signatures. kaya-otel 0.0.6 only enriches websocket spans with standard URL, network and peer attributes (plus error.type), which needs no application change. Regenerate the lock: the eight kaya pins move to 0.0.6 and, the wheels' declared metadata being unchanged, nothing else moves. tavolo-platform now floors kaya-core>=0.0.6 (it reads the new session layout) and tavolo-app floors kaya-otel>=0.0.6. As kaya documents, the session-key move signs existing logged-in users out once; they simply log in again.	2026-10-01 20:38:21 +08:00