Changeset 32cc601 in Klonkt for package-lock.json

Timestamp:

06/14/2026 06:55:51 AM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

9e27d64

Parents:

ae924a2

Message:

auth: route Google login via central Klonkt broker (no credentials per instance)

The instance no longer talks directly to Google but delegates to the central
broker (license.klonkt.com): it performs the OAuth dance with one Google client
and returns a signed, audience-bound identity token, which we verify offline
against the broker's pubkey. This way no self-hoster needs to create their own
Google client.

• config/google.js: broker client (brokerStartUrl + verifyIdentityToken against /pubkey: issuer + EdDSA + audience==SITE_ORIGIN + typ; consumeJti against replay).
• routes/auth.js: /auth/google sets state in session -> broker; callback checks state (CSRF) + token + replay, finds-or-creates user on email.
• god only via ADMIN_EMAIL; the "first user becomes god" bootstrap only applies when NO ADMIN_EMAIL is set (otherwise a stranger on a fresh install could become owner).
• Reject login if the email address is already linked to a different google_sub.
• jose added to dependencies (verifier; otherwise npm ci crashes the app).
• .env: KLONKT_BROKER_URL + SITE_ORIGIN instead of GOOGLE_CLIENT_ID/SECRET.

Co-Authored-By: Claude <noreply@…>

File:

• package-lock.json (modified) (2 diffs)

package-lock.json

@@ -21 +21 @@
         "helmet": "^7.1.0",
         "htmx.org": "1.9.12",
+        "jose": "^5.10.0",
         "marked": "^11.1.1",
         "multer": "^1.4.5-lts.1",
@@ -1165 +1166 @@
       }
     },
+    "node_modules/jose": {
+      "version": "5.10.0",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-5.10.0.tgz",
+      "integrity": "sha512-s+3Al/p9g32Iq+oqXxkW//7jk2Vig6FF1CFqzVXoTUXt2qz89YWbL+OwS17NFYEvxC35n0FKeGO2LGYSxeM2Gg==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/panva"
+      }
+    },
     "node_modules/marked": {
       "version": "11.2.0",