Why
The Mendys datasets marketplace currently redirects users straight to Authentik's stock pages for OIDC login. Product decision (2026-07-13, datasets-enablement session): consumer products should reuse FuzeFront's themed sign-in/up UI (fuse-seam design system, security-service flow — the one fixed end-to-end today in #223/#229/#235) and then hand the session off to the product's origin, instead of each product re-developing a sign-in UX over the security-service API.
Proposed shape (to be frozen by contract-designer)
FuzeFront acts as the auth broker for family products:
- Product redirects to
app.fuzefront.com/sign-in?client=<product-key>&redirect_uri=<product-callback> (allowlisted per product, e.g. https://marketplace.mendysrobotics.com/api/dsm/auth/callback).
- User authenticates in the themed UI (password + Google), with optional per-product brand overrides (logo/name/accent) keyed off
client.
- security-service completes the Authentik OIDC dance and redirects back to the product callback with a one-time authorization code; the product backend exchanges it server-to-server for the identity token/session (no tokens in URLs/fragments).
Scope notes
- Contract-first: freeze the broker endpoints (authorize/callback/token-exchange + error surface) as an OpenAPI contract before any implementation; generate the client package.
- frontend-engineer owns the themed UI work (design-system-first; per-product theming = DS tokens, not one-offs).
- Consumer-side integration for the marketplace is tracked in the companion MendysRobotics issue (linked below).
- Sequencing: blocked on the release.yml repair (images can't ship until the build+bump pipeline is green — being fixed in a separate session).
Acceptance criteria
- Marketplace
/api/dsm/auth/oidc/login (or successor) lands on the fuse-seam themed sign-in with marketplace branding; password AND Google sign-in both complete.
- After auth,
/api/dsm/auth/me at the marketplace origin returns authenticated: true; logout works; no token ever appears in a URL fragment or query param that gets logged.
- a11y + RTL per design-system gates; e2e (Playwright) covering the full broker round-trip pre-merge.
🤖 Generated with Claude Code
Why
The Mendys datasets marketplace currently redirects users straight to Authentik's stock pages for OIDC login. Product decision (2026-07-13, datasets-enablement session): consumer products should reuse FuzeFront's themed sign-in/up UI (fuse-seam design system, security-service flow — the one fixed end-to-end today in #223/#229/#235) and then hand the session off to the product's origin, instead of each product re-developing a sign-in UX over the security-service API.
Proposed shape (to be frozen by contract-designer)
FuzeFront acts as the auth broker for family products:
app.fuzefront.com/sign-in?client=<product-key>&redirect_uri=<product-callback>(allowlisted per product, e.g.https://marketplace.mendysrobotics.com/api/dsm/auth/callback).client.Scope notes
Acceptance criteria
/api/dsm/auth/oidc/login(or successor) lands on the fuse-seam themed sign-in with marketplace branding; password AND Google sign-in both complete./api/dsm/auth/meat the marketplace origin returnsauthenticated: true; logout works; no token ever appears in a URL fragment or query param that gets logged.🤖 Generated with Claude Code