feat: modern auth (SCRAM-SHA-256, 2FA, WebAuthn) + tic-tac-toe

BUILD.md

@@ -30,8 +30,76 @@ VITE_HIDE_SERVER_LIST=true
 # Optional comma-separated list of trusted media URLs
 # Useful for chat bridges like Matterbridge or Matrix bridges that host media
 VITE_TRUSTED_MEDIA_URLS="https://matterbridge.example.com,https://matrix-media.example.com"
+
+# Optional OAuth2 / OIDC defaults. Only surfaced when VITE_HIDE_SERVER_LIST=true,
+# i.e. single-server lock-mode. Users see a "Sign in with <label>" button
+# instead of having to enter the issuer/client_id themselves. Requires the
+# IRC server to support SASL IRCV3BEARER (e.g. obbyircd's oauth-provider).
+VITE_DEFAULT_OAUTH_PROVIDER_LABEL="Logto"
+VITE_DEFAULT_OAUTH_ISSUER="https://my-tenant.logto.app/oidc"
+VITE_DEFAULT_OAUTH_CLIENT_ID="m0obbyircd1234"
+# Optional, defaults to "openid"
+VITE_DEFAULT_OAUTH_SCOPES="openid"
+# Optional, defaults to <origin>/oauth/callback. Must be registered with the IdP.
+VITE_DEFAULT_OAUTH_REDIRECT_URI="https://chat.example.com/oauth/callback"
+# "jwt" (default) for Logto/Auth0/Keycloak/Google id_token.
+# "opaque" for GitHub/Discord/Slack -- IRC server hits userinfo endpoint.
+VITE_DEFAULT_OAUTH_TOKEN_KIND="jwt"
+# Opaque only: name of the matching oauth-provider {} on the IRC server,
+# so the server knows which userinfo URL to hit.
+VITE_DEFAULT_OAUTH_SERVER_PROVIDER="github"
+# Non-OIDC providers (GitHub) need explicit endpoints since they don't
+# publish /.well-known/openid-configuration.
+VITE_DEFAULT_OAUTH_AUTHORIZE_URL="https://github.com/login/oauth/authorize"
+VITE_DEFAULT_OAUTH_TOKEN_URL="https://github.com/login/oauth/access_token"
+```
+
+#### Provider quick-reference
+
+**Sign in with Google**
+
+```sh
+VITE_DEFAULT_OAUTH_PROVIDER_LABEL=Google
+VITE_DEFAULT_OAUTH_ISSUER=https://accounts.google.com
+VITE_DEFAULT_OAUTH_CLIENT_ID=<your_client_id>.apps.googleusercontent.com
+VITE_DEFAULT_OAUTH_SCOPES="openid email profile"
+VITE_DEFAULT_OAUTH_TOKEN_KIND=jwt
+```
+
+obbyircd side:
+
+```
+oauth-provider "google" {
+    issuer        'https://accounts.google.com';
+    audience      '<your_client_id>.apps.googleusercontent.com';
+    jwks-file     "/etc/obbyircd/google-jwks.json";  # curl from https://www.googleapis.com/oauth2/v3/certs
+    subject-claim "sub";
+};
 ```
 
+**Sign in with GitHub**
+
+```sh
+VITE_DEFAULT_OAUTH_PROVIDER_LABEL=GitHub
+VITE_DEFAULT_OAUTH_ISSUER=https://github.com
+VITE_DEFAULT_OAUTH_CLIENT_ID=<your_client_id>
+VITE_DEFAULT_OAUTH_SCOPES="read:user user:email"
+VITE_DEFAULT_OAUTH_TOKEN_KIND=opaque
+VITE_DEFAULT_OAUTH_SERVER_PROVIDER=github
+VITE_DEFAULT_OAUTH_AUTHORIZE_URL=https://github.com/login/oauth/authorize
+VITE_DEFAULT_OAUTH_TOKEN_URL=https://github.com/login/oauth/access_token
+```
+
+obbyircd side:
+
+```
+oauth-provider "github" {
+    userinfo-url   'https://api.github.com/user';
+    subject-claim  "login";    # or "id" for GitHub's stable user id
+};
+```
+
+
 ### Docker
 ```sh
 docker build -t obsidianirc .
@@ -47,6 +115,9 @@ docker build \
   --build-arg VITE_DEFAULT_IRC_CHANNELS="#general,#random" \
   --build-arg VITE_HIDE_SERVER_LIST=false \
   --build-arg VITE_TRUSTED_MEDIA_URLS="https://matterbridge.example.com,https://matrix-media.example.com" \
+  --build-arg VITE_DEFAULT_OAUTH_PROVIDER_LABEL="Logto" \
+  --build-arg VITE_DEFAULT_OAUTH_ISSUER="https://my-tenant.logto.app/oidc" \
+  --build-arg VITE_DEFAULT_OAUTH_CLIENT_ID="m0obbyircd1234" \
   -t obsidianirc .
 ```
 

Dockerfile

@@ -5,12 +5,30 @@ ARG VITE_DEFAULT_IRC_SERVER_NAME
 ARG VITE_DEFAULT_IRC_CHANNELS
 ARG VITE_HIDE_SERVER_LIST
 ARG VITE_TRUSTED_MEDIA_URLS
+ARG VITE_DEFAULT_OAUTH_PROVIDER_LABEL
+ARG VITE_DEFAULT_OAUTH_ISSUER
+ARG VITE_DEFAULT_OAUTH_CLIENT_ID
+ARG VITE_DEFAULT_OAUTH_SCOPES
+ARG VITE_DEFAULT_OAUTH_REDIRECT_URI
+ARG VITE_DEFAULT_OAUTH_TOKEN_KIND
+ARG VITE_DEFAULT_OAUTH_SERVER_PROVIDER
+ARG VITE_DEFAULT_OAUTH_AUTHORIZE_URL
+ARG VITE_DEFAULT_OAUTH_TOKEN_URL
 
 ENV VITE_DEFAULT_IRC_SERVER=$VITE_DEFAULT_IRC_SERVER
 ENV VITE_DEFAULT_IRC_SERVER_NAME=$VITE_DEFAULT_IRC_SERVER_NAME
 ENV VITE_DEFAULT_IRC_CHANNELS=$VITE_DEFAULT_IRC_CHANNELS
 ENV VITE_HIDE_SERVER_LIST=$VITE_HIDE_SERVER_LIST
 ENV VITE_TRUSTED_MEDIA_URLS=$VITE_TRUSTED_MEDIA_URLS
+ENV VITE_DEFAULT_OAUTH_PROVIDER_LABEL=$VITE_DEFAULT_OAUTH_PROVIDER_LABEL
+ENV VITE_DEFAULT_OAUTH_ISSUER=$VITE_DEFAULT_OAUTH_ISSUER
+ENV VITE_DEFAULT_OAUTH_CLIENT_ID=$VITE_DEFAULT_OAUTH_CLIENT_ID
+ENV VITE_DEFAULT_OAUTH_SCOPES=$VITE_DEFAULT_OAUTH_SCOPES
+ENV VITE_DEFAULT_OAUTH_REDIRECT_URI=$VITE_DEFAULT_OAUTH_REDIRECT_URI
+ENV VITE_DEFAULT_OAUTH_TOKEN_KIND=$VITE_DEFAULT_OAUTH_TOKEN_KIND
+ENV VITE_DEFAULT_OAUTH_SERVER_PROVIDER=$VITE_DEFAULT_OAUTH_SERVER_PROVIDER
+ENV VITE_DEFAULT_OAUTH_AUTHORIZE_URL=$VITE_DEFAULT_OAUTH_AUTHORIZE_URL
+ENV VITE_DEFAULT_OAUTH_TOKEN_URL=$VITE_DEFAULT_OAUTH_TOKEN_URL
 
 WORKDIR /app
 COPY package*.json ./