mosaicstack/stack
25
0 Fork 1
Code Issues 388 Pull Requests 13 Packages Projects Releases 15 Wiki Activity

Require verified OIDC for Console human writes #1836

Closed
mos wants to merge 0 commits from work/vikunja-19-385-q284-complete into refactor
pull from: work/vikunja-19-385-q284-complete
merge into: mosaicstack:refactor
Conversation 1 Commits - Files Changed -
mos commented 2026-10-29 05:22:38 +00:00
First-time contributor
Copy link
Copy source

Header-preview mode accepted caller-asserted identity with --send. CLI, service rendering and programmatic startup now require --sso for that writer. Readonly preview and private tester behavior remain. Writer tests use real createSso and a fixture OIDC login/callback instead of header identity. This mitigates #385's HIGH write path; header-preview read exposure remains tracked separately.

Validation so far: focused startup regression5/5, selected service4/4 (author); parent observed send12/12 after fixing a loop-variable TDZ, with the exact lock-pinned OAuth dependency verified by SHA512. Other migrated writer/browser files and full CI are not run. Do not label this green CI or merge until admitted checks and cross-family review are complete.

Local commit: 9936a1be1a on work/vikunja-19-385-q284-complete, base 09a847edaa25b609bac7728ff83f224708a29399. Mos2248: Mos owns publication; full #660 runner and independent cross-family review remain merge gates.

Vikunja #385. Author: Sage seat (Codex, Daybreak Blue review lane, Q284). Pushed and opened by Mos (mos-2248) because seats hold no Gitea account before #436b (Q190). Base refactor 09a847ed. Merge waits for an independent Claude review plus the #660 gate runner (Q264).

Header-preview mode accepted caller-asserted identity with --send. CLI, service rendering and programmatic startup now require --sso for that writer. Readonly preview and private tester behavior remain. Writer tests use real createSso and a fixture OIDC login/callback instead of header identity. This mitigates #385's HIGH write path; header-preview read exposure remains tracked separately. Validation so far: focused startup regression5/5, selected service4/4 (author); parent observed send12/12 after fixing a loop-variable TDZ, with the exact lock-pinned OAuth dependency verified by SHA512. Other migrated writer/browser files and full CI are not run. Do not label this green CI or merge until admitted checks and cross-family review are complete. Local commit: 9936a1be1a37fdb30ba53cf2f14b7897225c3e4a on `work/vikunja-19-385-q284-complete`, base `09a847edaa25b609bac7728ff83f224708a29399`. Mos2248: Mos owns publication; full #660 runner and independent cross-family review remain merge gates. Vikunja #385. Author: Sage seat (Codex, Daybreak Blue review lane, Q284). Pushed and opened by Mos (mos-2248) because seats hold no Gitea account before #436b (Q190). Base refactor 09a847ed. Merge waits for an independent Claude review plus the #660 gate runner (Q264).
mos added 1 commit 2026-10-29 05:22:39 +00:00
fix(webui): require verified OIDC for human writes (#385) 9936a1be1a
mos added 1 commit 2026-10-29 05:57:07 +00:00
fix(console): keep preview deployment profiles read-only (#385) ab2bc23c7f
jason.woltje added 1 commit 2026-11-02 18:05:08 +00:00
fix(upgrade): refuse legacy library --send before units stop (#385) d0ddfa8de2
jason.woltje added 1 commit 2026-11-02 18:26:19 +00:00
fix(upgrade): refuse a pre-#385 library Console unit before units stop (#385) 484aef7e2a
jason.woltje commented 2026-11-02 19:57:10 +00:00
Owner
Copy link
Copy source

Landed on refactor by the Mosaic Stack lead: merge 418f00bce and c1e9841d3 (this PR's head fbf8d61a4). refactor fast-forwarded 09a847eda..c1e9841d3. Gate: all package suites plus every scripts/test-*.sh green on c1e9841d3, GATE_PASSED 2026-11-02T19:55:06Z. This repo has manual-merge marking and autodetect turned off, so Gitea cannot show the PR as merged; closing it with this record. Vikunja #385 closed. Live state: dragon-lin still runs its pinned copy until a re-pin.

Landed on refactor by the Mosaic Stack lead: merge 418f00bce and c1e9841d3 (this PR's head fbf8d61a4). refactor fast-forwarded 09a847eda..c1e9841d3. Gate: all package suites plus every scripts/test-*.sh green on c1e9841d3, GATE_PASSED 2026-11-02T19:55:06Z. This repo has manual-merge marking and autodetect turned off, so Gitea cannot show the PR as merged; closing it with this record. Vikunja #385 closed. Live state: dragon-lin still runs its pinned copy until a re-pin.
jason.woltje closed this pull request 2026-11-02 19:57:11 +00:00

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-dogfood-01 (Mosaic fleet seat code-dogfood-01) code-infra-01 (Mosaic fleet seat code-infra-01) darkwing (Mosaic fleet seat darkwing) dewey (Mosaic fleet seat dewey) fargo filbert (Mosaic fleet seat filbert) fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) marcie merge-gate mosaic-stack-coder-bot (mosaic-stack coder bot) mosaic-stack-cto-bot (mosaic-stack cto bot) mosaic-stack-pm-bot (mosaic-stack pm bot) ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) orch-01 (Mosaic fleet seat orch-01) pepper resume rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) rocko (Mosaic fleet seat rocko) sanity scooby (Scooby) scrappy shaggy tiny topher (Mosaic fleet seat topher) velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1836