wangxuming/makelore
1
0 Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

docs(makelore): record platform auth rollback

Browse Source
This commit is contained in:
brother7 committed 2026-10-11 12:29:48 +08:00
1 parent 45198aeccb
commit 9949328bcd
6 files changed
+110 -12
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.project-docs/10-decisions/adr-004-square-auth-lifecycle-boundary.md
+4 -6
View File
@@ -2,27 +2,25 @@
## Status
Accepted and implemented on 2026-08-19; amended on 2026-10-10.
Accepted and implemented on 2026-08-19.
## Context
The desktop client obtained tokens from Works Square but refreshed them directly against the custom identity service with an embedded OAuth client secret. That mixed issuer/client boundary made rotation dependent on two independently configured clients and could turn an otherwise valid persisted session into `invalid_grant`, returning the user to the login page hours later. The platform account system now exposes a standard OIDC issuer for the public platform identity while the existing Works Square password/mobile facade remains available for its legacy path.
The desktop client obtained tokens from Works Square but refreshed them directly against the custom identity service with an embedded OAuth client secret. That mixed issuer/client boundary made rotation dependent on two independently configured clients and could turn an otherwise valid persisted session into `invalid_grant`, returning the user to the login page hours later.
## Decision
- Renderer sends authentication operations only to Electron Main.
- Electron Main owns access/refresh tokens, encrypted persistence, refresh rotation, terminal failure cleanup, and the seven-day inactivity policy.
- Optional remembered username/password data is a separate Electron Main record. Packaged builds encrypt it with OS-protected storage; it is never Renderer-persisted or stored by Works Square.
- Platform account login uses Main-owned Authorization Code + PKCE against the configured platform OIDC issuer: system browser, exact `niancode://auth/callback`, state/nonce/S256 validation, and a registered public Makelore client without a secret. Main owns the code exchange and all resulting tokens.
- Legacy password/mobile login, refresh, and logout use fixed Works Square `/api/auth/*` endpoints.
- Desktop login, mobile login, refresh, and logout use fixed Works Square `/api/auth/*` endpoints.
- Works Square owns the confidential upstream OAuth client configuration and proxies the lifecycle to the identity service.
- The desktop bundle must not contain a confidential OAuth client secret or call the custom one-feel identity service directly; platform OIDC access remains behind the Main boundary and uses the configured standard issuer.
- The desktop bundle must not contain an OAuth client secret or call the custom identity service directly.
- Logout and mobile login preserve remembered-password data. A successful password login with the option cleared removes the previous record; unavailable secure storage disables the option.
## Consequences
- The matching Works Square server endpoints must be deployed before this client is released.
- The packaged client must receive `PLATFORM_AUTH_ISSUER` and the registered Makelore client/redirect configuration before platform login can be released; no username, email, or legacy identifier is used to rebind a platform subject.
- OAuth credential rotation or upstream endpoint changes are server-side configuration changes rather than desktop releases.
- A terminal refresh `400` or `401` still fails closed and clears the local session; transient failures preserve the established retry behavior.
- Remembered-password persistence is convenience behavior rather than session authority. Its failure must not grant authentication or move password persistence to Works Square/Renderer.