feat(auth): offer native OAuth sign-in on servers like matrix.org #449

2026-10-24T16:15:28-04:00

jared commented

2026-10-24 16:15:28 -04:00

Follow-up from #447 (owner picked it 2026-10-24).

Problem: the login page decided on native OAuth from the .well-known m.authentication issuer. matrix.org no longer publishes that key, so its users got the password/SSO compatibility forms, which /login marks oauth_aware_preferred.

Change: detect native OAuth from /_matrix/client/v1/auth_metadata, loaded alongside the login flows. That's the same source the SDK uses to refresh tokens, so sign-in is offered only where refresh will also work.

Login: "Continue with " only, as Element does. A legacy SSO loginToken returning from a redirect still completes.
Register: opens the auth server's sign-up page (prompt=create, when prompt_values_supported includes it) instead of the legacy forms.
Servers without it, including Lotus: unchanged.

Verified

Live servers (this build, without clicking through, so nothing is registered at matrix.org):
- matrix.org login and register: one "Continue with" button, no password form;
- matrix.lotusguild.org: password form as before.
e2e/oauth-sdk44.spec.ts: 3/3. The full sign-in, refresh, two-tab and logout test still passes; Register sends prompt=create, and Login sends no prompt.
Unit tests: 1,428 pass; lint is at 29.

Also verified today: the desktop nightly with SDK 44 and Element Call v0.28 passed all 13 Windows smoke checks (run 2842), including the keychain sign-in.

🤖 Generated with Claude Code

https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

Follow-up from #447 (owner picked it 2026-10-24). **Problem:** the login page decided on native OAuth from the `.well-known` `m.authentication` issuer. matrix.org no longer publishes that key, so its users got the password/SSO compatibility forms, which `/login` marks `oauth_aware_preferred`. **Change:** detect native OAuth from `/_matrix/client/v1/auth_metadata`, loaded alongside the login flows. That's the same source the SDK uses to refresh tokens, so sign-in is offered only where refresh will also work. - **Login:** "Continue with <server>" only, as Element does. A legacy SSO `loginToken` returning from a redirect still completes. - **Register:** opens the auth server's sign-up page (`prompt=create`, when `prompt_values_supported` includes it) instead of the legacy forms. - **Servers without it, including Lotus:** unchanged. **Verified** - **Live servers** (this build, without clicking through, so nothing is registered at matrix.org): - matrix.org login and register: one "Continue with" button, no password form; - matrix.lotusguild.org: password form as before. - **`e2e/oauth-sdk44.spec.ts`:** 3/3. The full sign-in, refresh, two-tab and logout test still passes; Register sends `prompt=create`, and Login sends no prompt. - **Unit tests:** 1,428 pass; lint is at 29. **Also verified today:** the desktop nightly with SDK 44 and Element Call v0.28 passed all 13 Windows smoke checks (run 2842), including the keychain sign-in. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared added 1 commit 2026-10-24 16:15:28 -04:00

feat(auth): offer native OAuth sign-in on servers like matrix.org

CI / Build & Quality Checks (push) Skipped

CI / Secret scan (gitleaks) (push) Skipped

CI / Playwright smoke (e2e) (push) Skipped

CI / Build & Quality Checks (pull_request) Successful in 3m41s

Details

CI / Trigger Desktop Build (pull_request) Skipped

Details

CI / Docker image build & smoke test (pull_request) Skipped

Details

CI / Secret scan (gitleaks) (pull_request) Successful in 10s

Details

CI / Playwright smoke (e2e) (pull_request) Successful in 16m45s

Details

3c3bb2e41c

The login page looked for an OAuth issuer in .well-known
(m.authentication), which matrix.org no longer publishes, so its users
got the password / SSO compatibility forms. Detect native OAuth the way
the SDK finds the auth server for refresh: load /auth_metadata next to
the login flows. When present:
- Login shows "Continue with <server>" only (as Element does); a legacy
  SSO loginToken coming back from a redirect still completes.
- Register opens the auth server's sign-up page (prompt=create, where
  prompt_values_supported says so) instead of the legacy forms.
Servers without it (Lotus) are unchanged.

Checked against the live servers: matrix.org login and register show
"Continue with matrix.org" and no password form; matrix.lotusguild.org
keeps its password form.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared merged commit a58684958c into lotus

2026-10-24 16:36:37 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/cinny#449