Changeset 32cc601 in Klonkt for package.json

Timestamp:

06/14/2026 06:55:51 AM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

9e27d64

Parents:

ae924a2

Message:

auth: route Google login via central Klonkt broker (no credentials per instance)

The instance no longer talks directly to Google but delegates to the central
broker (license.klonkt.com): it performs the OAuth dance with one Google client
and returns a signed, audience-bound identity token, which we verify offline
against the broker's pubkey. This way no self-hoster needs to create their own
Google client.

• config/google.js: broker client (brokerStartUrl + verifyIdentityToken against /pubkey: issuer + EdDSA + audience==SITE_ORIGIN + typ; consumeJti against replay).
• routes/auth.js: /auth/google sets state in session -> broker; callback checks state (CSRF) + token + replay, finds-or-creates user on email.
• god only via ADMIN_EMAIL; the "first user becomes god" bootstrap only applies when NO ADMIN_EMAIL is set (otherwise a stranger on a fresh install could become owner).
• Reject login if the email address is already linked to a different google_sub.
• jose added to dependencies (verifier; otherwise npm ci crashes the app).
• .env: KLONKT_BROKER_URL + SITE_ORIGIN instead of GOOGLE_CLIENT_ID/SECRET.

Co-Authored-By: Claude <noreply@…>

File:

• package.json (modified) (1 diff)

package.json

@@ -23 +23 @@
     "helmet": "^7.1.0",
     "htmx.org": "1.9.12",
+    "jose": "^5.10.0",
     "marked": "^11.1.1",
     "multer": "^1.4.5-lts.1",