feat(auth): SASL IRCV3BEARER + per-server OAuth2/OIDC sign-in

BUILD.md

@@ -30,8 +30,76 @@ VITE_HIDE_SERVER_LIST=true
 # Optional comma-separated list of trusted media URLs
 # Useful for chat bridges like Matterbridge or Matrix bridges that host media
 VITE_TRUSTED_MEDIA_URLS="https://matterbridge.example.com,https://matrix-media.example.com"
+
+# Optional OAuth2 / OIDC defaults. Only surfaced when VITE_HIDE_SERVER_LIST=true,
+# i.e. single-server lock-mode. Users see a "Sign in with <label>" button
+# instead of having to enter the issuer/client_id themselves. Requires the
+# IRC server to support SASL IRCV3BEARER (e.g. obbyircd's oauth-provider).
+VITE_DEFAULT_OAUTH_PROVIDER_LABEL="Logto"
+VITE_DEFAULT_OAUTH_ISSUER="https://my-tenant.logto.app/oidc"
+VITE_DEFAULT_OAUTH_CLIENT_ID="m0obbyircd1234"
+# Optional, defaults to "openid"
+VITE_DEFAULT_OAUTH_SCOPES="openid"
+# Optional, defaults to <origin>/oauth/callback. Must be registered with the IdP.
+VITE_DEFAULT_OAUTH_REDIRECT_URI="https://chat.example.com/oauth/callback"
+# "jwt" (default) for Logto/Auth0/Keycloak/Google id_token.
+# "opaque" for GitHub/Discord/Slack -- IRC server hits userinfo endpoint.
+VITE_DEFAULT_OAUTH_TOKEN_KIND="jwt"
+# Opaque only: name of the matching oauth-provider {} on the IRC server,
+# so the server knows which userinfo URL to hit.
+VITE_DEFAULT_OAUTH_SERVER_PROVIDER="github"
+# Non-OIDC providers (GitHub) need explicit endpoints since they don't
+# publish /.well-known/openid-configuration.
+VITE_DEFAULT_OAUTH_AUTHORIZE_URL="https://github.com/login/oauth/authorize"
+VITE_DEFAULT_OAUTH_TOKEN_URL="https://github.com/login/oauth/access_token"
+```
+
+#### Provider quick-reference
+
+**Sign in with Google**
+
+```sh
+VITE_DEFAULT_OAUTH_PROVIDER_LABEL=Google
+VITE_DEFAULT_OAUTH_ISSUER=https://accounts.google.com
+VITE_DEFAULT_OAUTH_CLIENT_ID=<your_client_id>.apps.googleusercontent.com
+VITE_DEFAULT_OAUTH_SCOPES="openid email profile"
+VITE_DEFAULT_OAUTH_TOKEN_KIND=jwt
+```
+
+obbyircd side:
+
+```
+oauth-provider "google" {
+    issuer        'https://accounts.google.com';
+    audience      '<your_client_id>.apps.googleusercontent.com';
+    jwks-file     "/etc/obbyircd/google-jwks.json";  # curl from https://www.googleapis.com/oauth2/v3/certs
+    subject-claim "sub";
+};
 ```
 
+**Sign in with GitHub**
+
+```sh
+VITE_DEFAULT_OAUTH_PROVIDER_LABEL=GitHub
+VITE_DEFAULT_OAUTH_ISSUER=https://github.com
+VITE_DEFAULT_OAUTH_CLIENT_ID=<your_client_id>
+VITE_DEFAULT_OAUTH_SCOPES="read:user user:email"
+VITE_DEFAULT_OAUTH_TOKEN_KIND=opaque
+VITE_DEFAULT_OAUTH_SERVER_PROVIDER=github
+VITE_DEFAULT_OAUTH_AUTHORIZE_URL=https://github.com/login/oauth/authorize
+VITE_DEFAULT_OAUTH_TOKEN_URL=https://github.com/login/oauth/access_token
+```
+
+obbyircd side:
+
+```
+oauth-provider "github" {
+    userinfo-url   'https://api.github.com/user';
+    subject-claim  "login";    # or "id" for GitHub's stable user id
+};
+```
+
+
 ### Docker
 ```sh
 docker build -t obsidianirc .
@@ -47,6 +115,9 @@ docker build \
   --build-arg VITE_DEFAULT_IRC_CHANNELS="#general,#random" \
   --build-arg VITE_HIDE_SERVER_LIST=false \
   --build-arg VITE_TRUSTED_MEDIA_URLS="https://matterbridge.example.com,https://matrix-media.example.com" \
+  --build-arg VITE_DEFAULT_OAUTH_PROVIDER_LABEL="Logto" \
+  --build-arg VITE_DEFAULT_OAUTH_ISSUER="https://my-tenant.logto.app/oidc" \
+  --build-arg VITE_DEFAULT_OAUTH_CLIENT_ID="m0obbyircd1234" \
   -t obsidianirc .
 ```
 

Dockerfile

@@ -5,12 +5,30 @@ ARG VITE_DEFAULT_IRC_SERVER_NAME
 ARG VITE_DEFAULT_IRC_CHANNELS
 ARG VITE_HIDE_SERVER_LIST
 ARG VITE_TRUSTED_MEDIA_URLS
+ARG VITE_DEFAULT_OAUTH_PROVIDER_LABEL
+ARG VITE_DEFAULT_OAUTH_ISSUER
+ARG VITE_DEFAULT_OAUTH_CLIENT_ID
+ARG VITE_DEFAULT_OAUTH_SCOPES
+ARG VITE_DEFAULT_OAUTH_REDIRECT_URI
+ARG VITE_DEFAULT_OAUTH_TOKEN_KIND
+ARG VITE_DEFAULT_OAUTH_SERVER_PROVIDER
+ARG VITE_DEFAULT_OAUTH_AUTHORIZE_URL
+ARG VITE_DEFAULT_OAUTH_TOKEN_URL
 
 ENV VITE_DEFAULT_IRC_SERVER=$VITE_DEFAULT_IRC_SERVER
 ENV VITE_DEFAULT_IRC_SERVER_NAME=$VITE_DEFAULT_IRC_SERVER_NAME
 ENV VITE_DEFAULT_IRC_CHANNELS=$VITE_DEFAULT_IRC_CHANNELS
 ENV VITE_HIDE_SERVER_LIST=$VITE_HIDE_SERVER_LIST
 ENV VITE_TRUSTED_MEDIA_URLS=$VITE_TRUSTED_MEDIA_URLS
+ENV VITE_DEFAULT_OAUTH_PROVIDER_LABEL=$VITE_DEFAULT_OAUTH_PROVIDER_LABEL
+ENV VITE_DEFAULT_OAUTH_ISSUER=$VITE_DEFAULT_OAUTH_ISSUER
+ENV VITE_DEFAULT_OAUTH_CLIENT_ID=$VITE_DEFAULT_OAUTH_CLIENT_ID
+ENV VITE_DEFAULT_OAUTH_SCOPES=$VITE_DEFAULT_OAUTH_SCOPES
+ENV VITE_DEFAULT_OAUTH_REDIRECT_URI=$VITE_DEFAULT_OAUTH_REDIRECT_URI
+ENV VITE_DEFAULT_OAUTH_TOKEN_KIND=$VITE_DEFAULT_OAUTH_TOKEN_KIND
+ENV VITE_DEFAULT_OAUTH_SERVER_PROVIDER=$VITE_DEFAULT_OAUTH_SERVER_PROVIDER
+ENV VITE_DEFAULT_OAUTH_AUTHORIZE_URL=$VITE_DEFAULT_OAUTH_AUTHORIZE_URL
+ENV VITE_DEFAULT_OAUTH_TOKEN_URL=$VITE_DEFAULT_OAUTH_TOKEN_URL
 
 WORKDIR /app
 COPY package*.json ./

src/App.tsx

@@ -8,6 +8,7 @@ import { useEffect, useRef, useState } from "react";
 import { Route, Routes } from "react-router-dom";
 import AppLayout from "./components/layout/AppLayout";
 import { ServerNoticesPopup } from "./components/message/ServerNoticesPopup";
+import OAuthCallback from "./components/OAuthCallback";
 import PrivacyPolicy from "./components/PrivacyPolicy";
 import AddServerModal from "./components/ui/AddServerModal";
 import ChannelListModal from "./components/ui/ChannelListModal";
@@ -294,6 +295,7 @@ const App: React.FC = () => {
     <div className="h-screen overflow-hidden">
       <Routes>
         <Route path="/privacy" element={<PrivacyPolicy />} />
+        <Route path="/oauth/callback" element={<OAuthCallback />} />
         <Route
           path="/*"
           element={

src/components/OAuthCallback.tsx

@@ -0,0 +1,60 @@
+import type React from "react";
+import { useEffect, useState } from "react";
+import type { OAuthCallbackMessage } from "../lib/oauth";
+
+// Loaded at /oauth/callback inside the popup window the OAuth flow opened.
+// Pulls `code` and `state` (or `error`) from the query string, sends them
+// back to the opener via postMessage, then closes itself.
+export const OAuthCallback: React.FC = () => {
+  const [message, setMessage] = useState("Completing sign-in...");
+
+  useEffect(() => {
+    const params = new URLSearchParams(window.location.search);
+    const code = params.get("code") ?? undefined;
+    const state = params.get("state") ?? "";
+    const error = params.get("error") ?? undefined;
+    const errorDescription = params.get("error_description") ?? undefined;
+
+    const payload: OAuthCallbackMessage = {
+      type: "obsidianirc:oauth-callback",
+      state,
+      code,
+      error,
+      errorDescription,
+    };
+
+    if (window.opener && window.opener !== window) {
+      try {
+        window.opener.postMessage(payload, window.location.origin);
+        setMessage("Sign-in complete. You can close this window.");
+        setTimeout(() => {
+          try {
+            window.close();
+          } catch {}
+        }, 300);
+        return;
+      } catch (err) {
+        setMessage(
+          `Could not return tokens to the main window: ${
+            err instanceof Error ? err.message : String(err)
+          }`,
+        );
+        return;
+      }
+    }
+    setMessage(
+      "OAuth callback was loaded outside its popup. You can close this tab.",
+    );
+  }, []);
+
+  return (
+    <div className="flex h-screen items-center justify-center bg-discord-dark-200 text-discord-text-normal">
+      <div className="max-w-md p-6 text-center">
+        <h1 className="text-xl font-bold mb-2">OAuth sign-in</h1>
+        <p className="text-discord-text-muted">{message}</p>
+      </div>
+    </div>
+  );
+};
+
+export default OAuthCallback;

src/components/ui/AddServerModal.tsx

@@ -3,8 +3,11 @@ import { useEffect, useState } from "react";
 import { FaQuestionCircle } from "react-icons/fa";
 import BaseModal from "../../lib/modal/BaseModal";
 import { Button, ModalBody, ModalFooter } from "../../lib/modal/components";
+import { getBuiltinOAuthConfig } from "../../lib/oauth";
 import { isTauri } from "../../lib/platformUtils";
 import useStore from "../../store";
+import type { ServerOAuthConfig } from "../../types";
+import { OAuthSection } from "./OAuthSection";
 import { TextInput } from "./TextInput";
 
 export const AddServerModal: React.FC = () => {
@@ -40,9 +43,19 @@ export const AddServerModal: React.FC = () => {
   );
   const [registerEmail, setRegisterEmail] = useState("");
   const [registerPassword, setRegisterPassword] = useState("");
+  const [oauthConfig, setOauthConfig] = useState<ServerOAuthConfig | undefined>(
+    undefined,
+  );
 
   const [error, setError] = useState("");
 
+  // In single-server lock-mode, surface the deployer-baked OAuth config so
+  // the welcome screen exposes a "Sign in with X" CTA instead of the full
+  // editable provider form.
+  const lockedOauth = __HIDE_SERVER_LIST__
+    ? getBuiltinOAuthConfig()
+    : undefined;
+
   useEffect(() => {
     setServerName(prefillServerDetails?.name || "");
     setServerHost(prefillServerDetails?.host || "");
@@ -121,6 +134,7 @@ export const AddServerModal: React.FC = () => {
         registerEmail,
         registerPassword,
         true,
+        oauthConfig,
       );
       toggleAddServerModal(false);
     } catch (err) {
@@ -238,6 +252,14 @@ export const AddServerModal: React.FC = () => {
             </>
           )}
 
+          {lockedOauth && (
+            <OAuthSection
+              initial={oauthConfig}
+              onChange={setOauthConfig}
+              locked={lockedOauth}
+            />
+          )}
+
           <div className="mb-4">
             <label className="block text-discord-text-muted text-sm font-medium mb-1">
               Nickname