Skip to content

Releases

v0.2.1-alpha.0 — Bundled sign-in page (tested with DSH 0.2.0-rc.2)

v0.2.1-alpha.0 — Bundled sign-in page (tested with DSH 0.2.0-rc.2) Pre-release
Pre-release

Choose a tag to compare

View all tags
@Senti100 Senti100 released this 06 Oct 21:41
v0.2.1-alpha.0
63c7c3b

@senti100/dsh-oidc 0.2.1-alpha.0

Provider-neutral OpenID Connect admission for the DeepSeek Harness (DSH) Web profile. Authorization Code + PKCE via openid-client, then DSH's unchanged native Connection mints its own cookie.

Tested with DSH 0.2.0-rc.2 (the current DSH release): full-profile acceptance against a real 0.2.0-rc.2 Web profile with Caddy 2.10.2, the separate public-install gate, and a live HTTPS deployment behind Caddy 2.11.3.

What's new

Bundled sign-in page

  • New /auth/signin route: self-contained inline HTML (strict CSP, no external assets), so a human visiting a protected path lands on a real sign-in page instead of a bare 401.
  • /auth/check is now navigation-aware: browser navigations (sec-fetch-mode: navigate, or an HTML-only Accept) receive 303 -> /auth/signin, which Caddy's forward_auth subrequest copies through verbatim. fetch/XHR/WebSocket subrequests keep the plain 401.
  • Zero reverse-proxy configuration change required for existing deployments using the shipped Caddy recipe: the matcher simply names five exact /auth routes now (/auth/login, /auth/callback, /auth/check, /auth/signin, /auth/logout); unmatched /auth/* is still rejected.

Documentation

  • README, deployment guide, and examples/Caddyfile document the sign-in flow and the five-route matcher.

Compatibility & tested-with

  • Compatibility pin unchanged: DSH 0.2.0-rc.2 package interfaces (Cordis 4.0.4, pnpm 10.34.5). DSH APIs are pre-stable; later upstream releases are a future compatibility lane, not implied supported versions.
  • Verified end-to-end: full-profile acceptance (synthetic OIDC, native-cookie Secure flag, WebSocket, uploads), web-oidc public-install gate (no bearer bootstrap URL printed), and a live deployment (sign-in redirect, login chain to the provider with PKCE S256, API-client 401 preservation).

Upgrading

No proxy change needed if you already use the shipped Caddy recipe pattern with a five-route matcher. If your matcher lists only four routes, add /auth/signin (or adopt the updated examples/Caddyfile). The plugin ID and package scope are unchanged.

Security

See SECURITY.md. A reverse proxy remains a mandatory part of the security boundary; the sign-in page introduces no new trust surface (it is gated like /auth/login and starts the same OIDC flow).

Loading