v0.0.8

Configurable OIDC sign-in

"Sign in with an outside account" used to mean Google, and only Google. Now you can point Pug at your own identity provider — Okta, Keycloak, Microsoft Entra, Auth0, your company's self-hosted login — and your team signs in with the accounts they already have. List the providers in a JSON file and each one becomes a button on the sign-in page. (#65)

Sign-in also moved to the server: the browser hands Pug a one-time code and Pug trades it for the user's identity, so your provider's client secret never reaches the browser. Returning users match on their verified email; new ones get an account with its default org and project, exactly as magic-link sign-in already did.

Setting it up

Point PUG_CONFIG_FILE at a JSON file mounted in the server container. config.example.json is a working example to copy, and docs/authentication.md covers the rest, including the redirect URL to register with your provider. If anything in the file is wrong, Pug refuses to start and names the entry at fault.

Each provider needs a short id, and it is permanent — Pug stores it against every account that signs in through that provider, so renaming it later disconnects them. Change displayName if you just want different wording on the button.

Upgrading — please read

• Upgrade the dashboard at the same time as the server. The sign-in request changed shape, so an older dashboard's Google button will fail against this server. Password and magic-link sign-in are unaffected.
• PUG_OAUTH_GOOGLE_CLIENT_ID no longer does anything. Upgrade without setting up the new config file and Pug starts normally with no outside sign-in buttons at all — Google disappears until you configure it. The startup logs warn about this.
• Name the Google entry "id": "google". That is the id your existing Google users are stored under, so they carry over with nothing to do. Any other id still signs them in, by matching their verified email, but leaves a duplicate record behind.

No database migration, and nothing to run before or after deploying.

Also in this release

• More honest monitoring. A ClickHouse query that failed partway through reading its results, or an insert that failed while sending, was recorded as successful in our traces. Both now show up as the failures they are. (#67)
• Updates to 20 Go dependencies, including the ClickHouse driver. (#67)

Compatibility

Nothing to change in your SDKs or tracking code. This release is all on the sign-in side — event collection and existing data are untouched.

Contributors

• @boramuyar built generic OIDC sign-in in #65 — thank you!

Full Changelog: v0.0.7...v0.0.8