jerry/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-10-28 21:11:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

Address enterprise login review feedback

Browse Source 
Signed-off-by: coder 0 <d97ebdbb198c7237c94f84ea8bb8a73583ea067407eebd0062abbb3962527fb1@buzz.block.builderlab.xyz>
Signed-off-by: bb-expert <51cde9442e46eac81c83ec71552708c3b0cb96a88ff8e1581d8fb4de281afbf3@buzz.block.builderlab.xyz>
This commit is contained in:
coder 0
2026-09-28 14:16:28 -06:00
committed by bb-expert
parent 0587fe76b0
commit 3adbb6eddb
11 changed files with 144 additions and 280 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
docs/enterprise-identity-adapter.md
View File

@@ -40,12 +40,20 @@ GET {adapter_base}/v1/login/start?return_to={callback_url}&handoff_challenge={ba
```
The adapter authenticates the user however the operator chooses, binds the
completed browser login to `handoff_challenge`, and redirects to:
completed browser login to `handoff_challenge`, and redirects to the exact
`return_to` loopback callback. Desktop always supplies
`http://127.0.0.1:{ephemeral_port}/callback/{nonce}`; adapters should accept
loopback callbacks on any port as recommended by RFC 8252 §7.3 and reject
non-loopback callback hosts. Success redirects to:
```text
{callback_url}?code={single_use_code}
```
Failures may redirect to the same callback with `error` and optional
`error_description` query parameters. Desktop surfaces `error_description` when
present, otherwise `error`.
The code alone is not a credential. The adapter MUST accept it only when the
exchange presents the matching handoff secret. Browser navigation may follow the
adapter's identity-provider redirects; the non-browser adapter calls below must
@@ -83,7 +91,10 @@ Success response:
`email` and `profile_projection` are optional. `profile_projection` is ignored by
Desktop unless `BUZZ_BUILD_ENTERPRISE_PROFILE_PROJECTION` opts into publishing
those fields as the user's public Buzz profile.
those fields as the user's public Buzz profile. The exchange `expires_at` and a
later session-check `expires_at` must describe the same fixed adapter session;
Desktop rejects mismatched values during login so a code exchange cannot commit a
different session than the one verified by `/v1/session`.
## Session check