oidc

Overview ¶

Package oidc runs an in-process yauth-backed OIDC provider for local dev. It is seeded from oidc config and binds on its own port; no Postgres is required — the backend is the yauth "memory" driver.

yauth v0.39+ is API-first: its /oauth/authorize endpoint speaks JSON, not HTML. To keep a browser OIDC flow working (so SPAs and Playwright can drive a real login), this package mounts the yauth API under /api/auth and serves two small server-rendered pages at the root:

• GET /login — email/password form (#email/#password/#submit) that POSTs to yauth's JSON login, then returns to the flow.
• GET /authorize — the consent page the discovery doc's authorization_endpoint points at (via mcpauth.Mount). It drives yauth's JSON authorize+consent and redirects the browser back to the client with the code, auto-approving consent for this local dev provider.

This restores the server-rendered login that the pre-Go (Rust) devrig served from src/oidc/ui.rs, which downstream apps' E2E tests rely on.