LotusGuild/cinny
3
0
Fork 0
Code Issues 27 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

feat(auth): offer native OAuth sign-in on servers like matrix.org #449

Merged
jared merged 1 commits from feat/oauth-detect into lotus 2026-10-24 16:36:37 -04:00
Conversation 0 Commits 1 Files Changed 7
+92 -16
1 Commits
Author SHA1 Message Date
Lotus CIandClaude Opus 5.5 3c3bb2e41c feat(auth): offer native OAuth sign-in on servers like matrix.org
CI / Build & Quality Checks (push) Skipped
CI / Secret scan (gitleaks) (push) Skipped
CI / Playwright smoke (e2e) (push) Skipped
CI / Build & Quality Checks (pull_request) Successful in 3m41s
Details
CI / Trigger Desktop Build (pull_request) Skipped
Details
CI / Docker image build & smoke test (pull_request) Skipped
Details
CI / Secret scan (gitleaks) (pull_request) Successful in 10s
Details
CI / Playwright smoke (e2e) (pull_request) Successful in 16m45s
Details 
The login page looked for an OAuth issuer in .well-known
(m.authentication), which matrix.org no longer publishes, so its users
got the password / SSO compatibility forms. Detect native OAuth the way
the SDK finds the auth server for refresh: load /auth_metadata next to
the login flows. When present:
- Login shows "Continue with <server>" only (as Element does); a legacy
  SSO loginToken coming back from a redirect still completes.
- Register opens the auth server's sign-up page (prompt=create, where
  prompt_values_supported says so) instead of the legacy forms.
Servers without it (Lotus) are unchanged.

Checked against the live servers: matrix.org login and register show
"Continue with matrix.org" and no password form; matrix.lotusguild.org
keeps its password form.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
 2026-10-24 16:15:24 -04:00