Replace Zitadel authentication with oauth-kit#4
Open
domenkozar wants to merge 11 commits intomainfrom
Open
Conversation
domenkozar
force-pushed
the
replace-zitadel-with-oauth-kit
branch
3 times, most recently
from
e7e822c to
eb51a29
Compare
Switch from Zitadel OIDC to session-based OAuth using oauth-kit library with GitHub as the provider. This significantly simplifies the auth flow. Backend changes: - Add oauth-kit and tower-sessions-cookie-store dependencies - Use encrypted cookie sessions (private feature) instead of memory store - Create PostgresUserStore for user management with transactional account creation - Replace token introspection with session-based BetaUser extractor - Add OAuth account and role tables migration - Remove entire zitadel module Frontend changes: - Remove OIDC/PKCE flow handling (Oidc.elm, Oidc/Model.elm, Oidc/Msg.elm) - Simplify Shared.elm to use /api/v1/account/me endpoint - SignIn/SignOut now just redirect to /auth/signin/github and /auth/signout - Remove crypto operations from interop.ts Infrastructure: - Remove nix/zitadel service and packages - Remove terraform/zitadel configuration - Update devenv.nix with nix-main-c dependency - Update secretspec for GitHub OAuth credentials and SESSION_SECRET Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Auto-generate SESSION_SECRET via secretspec, improve secret descriptions to guide users through prompts, and simplify README to rely on secretspec prompts during devenv up. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
domenkozar
force-pushed
the
replace-zitadel-with-oauth-kit
branch
from
eb51a29 to
f1dbdb2
Compare
Switch devenv-backend and devenv-driver to crate2nix (buildRustCrate per-crate) so only changed crates rebuild, fixing the issue where devenv-driver recompiled on every `devenv up`. devenv-init stays on buildRustPackage with a custom musl cross-compilation setup for its fully static VM init binary. Key changes: - Add crate2nix and rust-overlay inputs to devenv.yaml - Create crate-config.nix with per-crate overrides for native deps, nix C/C++ libs, bindgen, secretspec proc macro, and various buildRustCrate workarounds - Rewrite package.nix to use crate2nix for backend/driver, custom musl build for init - Add required-features to runner binaries so crate2nix skips them when the client feature is disabled - Add crate2nix generate task that runs when Cargo.lock changes Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove the bespoke mkCapWrapper shell-script approach that copied binaries and prompted for sudo setcap. Instead, set ambient capabilities directly on the runner process via processes.runner.linux.capabilities so child processes (cloud-hypervisor, virtiofsd, nft, sysctl, tuntap) inherit them automatically via execve. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace process-compose configuration with devenv native equivalents: tasks for migrations, `after` for ordering, `ready.http.get` for health checks, and `ports.*.allocate` for dynamic port allocation. Generate elm-land.json from Nix so the proxy URL uses the dynamic backend port, and remove the static file from version control. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This lets the dynamically allocated devenv port flow through to the backend server configuration. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Extract conn() and nullable_json() helpers in oauth_store to remove repeated pool-get and null-check patterns. Extract viewAvatar in Main.elm to unify duplicated avatar rendering. Remove stale OAUTH_CLIENT_ID and OAUTH_AUDIENCE env vars from elm-land config. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The frontend was using user.name (display name from OAuth) for Github_Owner_ route paths, which breaks for users whose display name differs from their GitHub login. Extract the login from oauth_account.raw_profile JSONB and thread it through as username. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…clean up imports Backend: - Extract webhook helpers (deduplicate Push/PR handlers, replace panics with errors) - Replace all .unwrap() on pool connections with proper error handling - Use read lock instead of write lock in RunnerState::try_send_to - Replace Account stub with typed AccountResponse matching actual API shape - Remove dead InternalError enum and unused digest dependency - Remove dead Runner::disconnected function - Simplify platform conversion using existing From impls and str::parse - Remove redundant inner imports in github/model.rs - Make logger port configurable via PORT env var Frontend: - Remove dead scrollToElementEffect and associated Msg variants (Repo_.elm) - Remove dead viewRevBranch from Label.elm (superseded by GitHubCommit) - Remove dead add function from Breadcrumbs.elm - Deduplicate Breadcrumbs factory functions via composition - Remove dead navButton and commented login button block - Clean up unused imports across 11 Elm files Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Changes
Backend:
Frontend:
Infrastructure:
Test plan
cargo run -p devenv-backend migratedevenv up🤖 Generated with Claude Code