[QA] §N OIDC / next-gen auth (MSC3861): login, persistence, refresh, logout revoke, account deep-link, password regression #183

New Issue

2026-09-17T23:24:09-04:00

jared commented

2026-09-17 23:24:09 -04:00

Migrated from LOTUS_TESTING.md §N on 2026-09-17 — the file is now reference-only.

How to report: tick each item as it passes; on FAIL comment with what you saw vs expected, browser/OS, web (chat.lotusguild.org) vs desktop (Tauri), theme, and any browser-console errors. Screenshots for anything visual.

Checklist

N1. OIDC login flow (the core test) — needs a MAS homeserver
N2. Session persists across reload (token storage)
N3. Token refresh (long-lived session)
N4. Logout revokes at the issuer
N5. Account-management deep-link
N6. Non-OIDC regression — password login unchanged

The Lotus client can now sign into OIDC-native homeservers (ones that delegate
auth to a Matrix Authentication Service / MAS), e.g. mozilla.org. lotusguild's
own server is not MSC3861, so test EITHER against a local MAS dev loop
(full setup in dev/oidc-test/README.md — docker-compose + Synapse msc3861
delta + a config.json override) OR against mozilla.org with a real account.

N1. OIDC login flow (the core test) — needs a MAS homeserver

On the login screen, select the OIDC homeserver (local localhost:8008, or mozilla.org).
Expected: instead of the username/password form, a single "Continue with single sign-on" button appears (password + legacy-SSO are suppressed for that server).
Click it → redirected to the provider's login page (MAS / chat.mozilla.org).
Authenticate there → redirected back to …/auth/oidc/callback → a brief "Signing you in…" spinner → you land in the app, logged in.

Expected: no console CSP violations; you reach the room list as the OIDC user.

N2. Session persists across reload (token storage)

After N1, hard-refresh the page.
Expected: you stay logged in — the OIDC session (access + refresh token + issuer/clientId/claims) was persisted (cinny_refresh_token, cinny_oidc_* keys in localStorage).

N3. Token refresh (long-lived session)

Leave the session past the access-token lifetime (MAS default is short — or revoke the access token in the MAS admin UI to force a 401).
Expected: the client refreshes transparently (no logout); the stored access token rotates (reactive 401 refresh via the wired OidcTokenRefresher).

N4. Logout revokes at the issuer

Log out from Settings.
Expected: back to login; OIDC tokens are revoked at the issuer's revocation_endpoint (best-effort) and all cinny_* / cinny_oidc_* keys are cleared. Logging back in works.

N5. Account-management deep-link

Settings → Account.
Expected: on an OIDC server a "Manage account" card appears (opens the provider's account page in a new tab). On a non-OIDC server (lotusguild) the card is absent.

N6. Non-OIDC regression — password login unchanged

Log into matrix.lotusguild.org (password) and matrix.org.
Expected: identical to before — username/password form (+ SSO button where offered). The OIDC path only activates when discovery advertises an issuer, so nothing changes for these servers.

_Migrated from `LOTUS_TESTING.md` §N on 2026-09-17 — the file is now reference-only._ **How to report:** tick each item as it passes; on FAIL comment with what you saw vs expected, browser/OS, web (chat.lotusguild.org) vs desktop (Tauri), theme, and any browser-console errors. Screenshots for anything visual. **Checklist** - [ ] N1. OIDC login flow (the core test) — needs a MAS homeserver - [ ] N2. Session persists across reload (token storage) - [ ] N3. Token refresh (long-lived session) - [ ] N4. Logout revokes at the issuer - [ ] N5. Account-management deep-link - [ ] N6. Non-OIDC regression — password login unchanged --- The Lotus client can now sign into OIDC-native homeservers (ones that delegate auth to a Matrix Authentication Service / MAS), e.g. mozilla.org. lotusguild's own server is **not** MSC3861, so test EITHER against a **local MAS dev loop** (full setup in `dev/oidc-test/README.md` — docker-compose + Synapse `msc3861` delta + a `config.json` override) OR against **mozilla.org** with a real account. ### N1. OIDC login flow (the core test) — needs a MAS homeserver 1. On the login screen, select the OIDC homeserver (local `localhost:8008`, or `mozilla.org`). 2. **Expected:** instead of the username/password form, a single **"Continue with single sign-on"** button appears (password + legacy-SSO are suppressed for that server). 3. Click it → redirected to the provider's login page (MAS / `chat.mozilla.org`). 4. Authenticate there → redirected back to `…/auth/oidc/callback` → a brief "Signing you in…" spinner → you land in the app, logged in. **Expected:** no console CSP violations; you reach the room list as the OIDC user. ### N2. Session persists across reload (token storage) After N1, hard-refresh the page. **Expected:** you stay logged in — the OIDC session (access + refresh token + issuer/clientId/claims) was persisted (`cinny_refresh_token`, `cinny_oidc_*` keys in localStorage). ### N3. Token refresh (long-lived session) Leave the session past the access-token lifetime (MAS default is short — or revoke the access token in the MAS admin UI to force a 401). **Expected:** the client refreshes transparently (no logout); the stored access token rotates (reactive 401 refresh via the wired `OidcTokenRefresher`). ### N4. Logout revokes at the issuer Log out from Settings. **Expected:** back to login; OIDC tokens are revoked at the issuer's `revocation_endpoint` (best-effort) and all `cinny_*` / `cinny_oidc_*` keys are cleared. Logging back in works. ### N5. Account-management deep-link Settings → Account. **Expected:** on an OIDC server a **"Manage account"** card appears (opens the provider's account page in a new tab). On a non-OIDC server (lotusguild) the card is **absent**. ### N6. Non-OIDC regression — password login unchanged Log into **matrix.lotusguild.org** (password) and **matrix.org**. **Expected:** identical to before — username/password form (+ SSO button where offered). The OIDC path only activates when discovery advertises an issuer, so nothing changes for these servers. ---

jared added this to the Manual QA backlog milestone 2026-09-17 23:24:09 -04:00

jared added the security area: auth-session qa labels 2026-09-17 23:24:09 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/cinny#183