linus/KC-APP
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: OIDC PKCE login, LT admin screens, backend-served Flutter build

Browse Source 
Plan + both READMEs updated for the Authentik Authorization-Code + PKCE
flow, the Leitungsteam admin screen, the widened LT-admin guards, the
issuer trailing-slash normalisation, and the backend now serving the
Flutter web build (SPA fallback for /v1/auth/callback). Verification
section records the local-Postgres E2E for LT admin + onboarding approval,
and notes the OIDC browser round-trip still needs a test account.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
linus
2026-09-10 09:37:10 +02:00
co-authored by Claude Sonnet 5
parent df11d8492d
commit 40b623dd79
3 changed files with 53 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+12 -9
View File
@@ -61,14 +61,17 @@ in (`backend/prisma/migrations/`); the backend has been run end to end
against a local PostgreSQL 16. `npm test` covers the assignment algorithm
and the new auth/onboarding services (56 tests).
Phase 7 (Flutter client) started: `client/app/` is a single Flutter
codebase with the **web** target enabled — login (guest / local Teamer /
invite redemption), role-aware home, guest Workshop-Wahl, file list,
read-only chat. `flutter build web` and `flutter test` pass. Mobile/desktop
targets, the Authentik Authorization-Code flow, WebSocket chat send, and LT
admin screens are still to come.
Phase 7 (Flutter client) in progress: `client/app/` is a single Flutter
codebase with the **web** target enabled — guest / local-Teamer / invite
login, the Authentik Authorization-Code + PKCE flow (`lib/oidc.dart`) for
Leitungsteam/Verantwortliche, role-aware home, guest Workshop-Wahl (wishes +
result), file list, live WebSocket chat, and a Leitungsteam admin screen
(KCs, Gemeinden, onboarding approvals). `flutter build web` / `flutter test`
pass; the backend serves the build at `/` (SPA fallback covers the OIDC
redirect `/v1/auth/callback`). Still to do: a live browser test of the OIDC
round-trip, the Teamer-management and Verantwortlichen-self-registration
screens, LT Wahl administration, mobile/desktop targets, and push.
The backend also serves the interim `client/web/` placeholder at `/` (API
under `/api`). Running end to end still needs a real Authentik instance and
Nextcloud/S3 credentials (see `backend/.env.example`).
Running end to end needs the Authentik redirect registered + a test account,
plus Nextcloud/S3 credentials (see `backend/.env.example`).