chore(dev): stub OAuth IdP tooling for local mobile SSO testing #91

wtclaude · 2026-07-21T21:32:03Z

wtclaude commented

2026-07-21 21:32:03 +00:00

Adds dev-only tooling to exercise the native mobile SSO bridge locally. No production, API, schema, or route changes — everything lives under scripts/dev/ and is never imported by the server. The M10 Android admin screens consume the existing /api/v1/admin/** routes, so no backend change was needed there either.

Why

Dev environments have no real OAuth provider configured, so GET /auth/providers returns [], the app renders no SSO buttons, and the native flow can't be tested. This stands up a stub IdP + seed + headless smoketest.

`scripts/dev/`

stub-idp.js — dependency-free stub OAuth2/OIDC IdP (authorize picker → token → userinfo); DEV ONLY, signs in anyone. Picker page carries a mobile viewport meta so it renders correctly in an Android Custom Tab.
seed-sso-provider.js — registers a devstub auth_providers row pointing at the stub and pre-links each principal's sub to a dev account (SSO is link-only).
sso-bridge-smoketest.js — drives the whole app flow headless (PKCE → /auth/mobile/sso/start → IdP → callback → deep link → /auth/mobile/sso/exchange) and asserts a bearer pair.
README.md — host + emulator usage.

Verified end-to-end against the local site (player + admin principals) and used to drive the on-device emulator QA of the Android M10 work.

Companions

App: RunicGateway/Android-app Fail fast when JWT_SECRET is missing in production (closes #14) (#21)
Docs: RunicGateway/docs [SECURITY AUDIT] Session/token revocation is a non-functional stub — logout and password change do not invalidate existing JWTs (#30)

AI disclosure (org policy): authored with Claude Code (Claude Opus); AI-authored commits carry a Co-Authored-By: Claude trailer.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr

Adds **dev-only** tooling to exercise the native mobile SSO bridge locally. No production, API, schema, or route changes — everything lives under `scripts/dev/` and is never imported by the server. The M10 Android admin screens consume the *existing* `/api/v1/admin/**` routes, so no backend change was needed there either. ## Why Dev environments have no real OAuth provider configured, so `GET /auth/providers` returns `[]`, the app renders no SSO buttons, and the native flow can't be tested. This stands up a stub IdP + seed + headless smoketest. ## `scripts/dev/` - `stub-idp.js` — dependency-free stub OAuth2/OIDC IdP (authorize picker → token → userinfo); DEV ONLY, signs in anyone. Picker page carries a mobile viewport meta so it renders correctly in an Android Custom Tab. - `seed-sso-provider.js` — registers a `devstub` `auth_providers` row pointing at the stub and pre-links each principal's `sub` to a dev account (SSO is link-only). - `sso-bridge-smoketest.js` — drives the whole app flow headless (PKCE → `/auth/mobile/sso/start` → IdP → callback → deep link → `/auth/mobile/sso/exchange`) and asserts a bearer pair. - `README.md` — host + emulator usage. Verified end-to-end against the local site (player + admin principals) and used to drive the on-device emulator QA of the Android M10 work. ## Companions - App: `RunicGateway/Android-app` #21 - Docs: `RunicGateway/docs` #30 --- **AI disclosure (org policy):** authored with Claude Code (Claude Opus); AI-authored commits carry a `Co-Authored-By: Claude` trailer. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr

wtclaude added 2 commits 2026-07-21 21:32:05 +00:00

chore(dev): add stub OAuth IdP + seed + bridge smoketest for native SSO 70849f96ee

Dev environments have no real OAuth provider configured, so GET /auth/providers
returns [] and the native mobile SSO flow cannot be exercised locally. Add
dependency-free dev tooling under scripts/dev/:

- stub-idp.js: stub OAuth2/OIDC IdP (authorize picker, token, userinfo)
- seed-sso-provider.js: registers a 'devstub' auth_providers row + pre-links
  each principal's sub to a dev account (SSO is link-only)
- sso-bridge-smoketest.js: drives the full app flow headless (PKCE → start →
  IdP → callback → deep link → exchange) and asserts a bearer pair
- README.md: host + emulator usage

Verified end-to-end against the local site: player and admin principals both
sign in and receive the correct role. DEV ONLY — never deploy the stub.

Co-Authored-By: Claude <noreply@anthropic.com>

chore(dev): add viewport meta to the stub IdP picker page

PR Checks / bot-install (pull_request) Successful in 13s

Details

PR Checks / client-build (pull_request) Successful in 9m24s

Details

PR Checks / server-tests (pull_request) Successful in 10m47s

Details

2306545574

So the dev stub IdP's account-picker renders at the correct mobile size when it
opens in an Android Custom Tab during SSO testing.

Co-Authored-By: Claude <noreply@anthropic.com>

whitlocktech approved these changes 2026-07-21 21:33:32 +00:00

whitlocktech scheduled this pull request to auto merge when all checks succeed 2026-07-21 21:33:37 +00:00

whitlocktech merged commit 4c13706958 into main

2026-07-21 21:43:01 +00:00

whitlocktech deleted branch feat/m10-native-sso-fix

2026-07-21 21:43:01 +00:00

whitlocktech referenced this issue from a commit

2026-07-21 21:43:02 +00:00

Merge pull request 'chore(dev): stub OAuth IdP tooling for local mobile SSO testing' (#91) from feat/m10-native-sso-fix into main

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: RunicGateway/website#91