Customize live SSO labels and readable OIDC profile names #22

Merged

jchapman merged 1 commit from codex/issues-1-3-sso-profile into main 2026-10-27 02:49:00 +00:00

Conversation 0 Commits 1 Files changed 24 +520 -25

jchapman commented 2026-10-27 02:43:49 +00:00

Owner

Copy link

Administrators can now set Sign-in > SSO button text and have it refresh on desktop/mobile sign-in screens without restarting Bridge. Blank text restores the default; input is bounded to 120 Unicode characters, controls are rejected, and HTML remains text. The setting uses existing encrypted persistence and administrator authorization.

OIDC accounts now show a bounded readable label from the verified ID token (name, then preferred_username, then SSO user) in the session header and administrator views. Names refresh at sign-in. Stable account IDs distinguish duplicates; issuer plus subject, internal usernames, roles and verified-email rules remain unchanged. Existing accounts receive the readable fallback until their next provider sign-in.

Validation passed locally: Linux AMD64 backend tests and vet with the pinned importer; focused API and auth/configuration race suites; UI lint/build and audit (zero reported vulnerabilities); all four focused browser suites; full disposable browser/queue/SQLite/upload-recovery/settings walkthrough, including live label and restart persistence; nine CI policy tests and source/document/workflow contracts; redacted full-history and staged-source secret scans. Added regressions cover duplicate/changed/missing/malformed names, separate issuers, local-account separation, authorization, fallback, bounds, escaping and mobile layout. Documentation and installation checkpoints are updated.

References #1 and #3; workflow followed from #14. Review draft: source published, not merged or deployed. Native Forgejo AMD64/ARM64 release gates and actual-provider/deployed checks remain outstanding; no gate waiver is claimed. The existing UI bundle-size advisory remains. No active upload/task or pilot service was interrupted. Held issue #12 and PR #19 remain untouched.

Administrators can now set **Sign-in > SSO button text** and have it refresh on desktop/mobile sign-in screens without restarting Bridge. Blank text restores the default; input is bounded to 120 Unicode characters, controls are rejected, and HTML remains text. The setting uses existing encrypted persistence and administrator authorization. OIDC accounts now show a bounded readable label from the verified ID token (`name`, then `preferred_username`, then `SSO user`) in the session header and administrator views. Names refresh at sign-in. Stable account IDs distinguish duplicates; issuer plus subject, internal usernames, roles and verified-email rules remain unchanged. Existing accounts receive the readable fallback until their next provider sign-in. Validation passed locally: Linux AMD64 backend tests and vet with the pinned importer; focused API and auth/configuration race suites; UI lint/build and audit (zero reported vulnerabilities); all four focused browser suites; full disposable browser/queue/SQLite/upload-recovery/settings walkthrough, including live label and restart persistence; nine CI policy tests and source/document/workflow contracts; redacted full-history and staged-source secret scans. Added regressions cover duplicate/changed/missing/malformed names, separate issuers, local-account separation, authorization, fallback, bounds, escaping and mobile layout. Documentation and installation checkpoints are updated. References #1 and #3; workflow followed from #14. Review draft: source published, not merged or deployed. Native Forgejo AMD64/ARM64 release gates and actual-provider/deployed checks remain outstanding; no gate waiver is claimed. The existing UI bundle-size advisory remains. No active upload/task or pilot service was interrupted. Held issue #12 and PR #19 remain untouched.

jchapman added 1 commit 2026-10-27 02:43:49 +00:00

Customize live SSO labels and display readable OIDC profile names 2ff357ea69

jchapman referenced this pull request 2026-10-27 02:44:38 +00:00

Allow administrators to customize the SSO sign-in button text #1

jchapman referenced this pull request 2026-10-27 02:44:38 +00:00

Display a readable profile name for OIDC users instead of the internal identity key #3

jchapman changed title from WIP: Customize live SSO labels and readable OIDC profile names to Customize live SSO labels and readable OIDC profile names 2026-10-27 02:48:42 +00:00

jchapman merged commit 09085fa7b7 into main 2026-10-27 02:49:00 +00:00

jchapman referenced this pull request from a commit 2026-10-27 02:49:01 +00:00

Merge pull request 'Customize live SSO labels and readable OIDC profile names' (#22) from codex/issues-1-3-sso-profile into main

jchapman referenced this pull request 2026-10-27 02:49:50 +00:00

Allow administrators to customize the SSO sign-in button text #1

jchapman referenced this pull request 2026-10-27 02:49:51 +00:00

Display a readable profile name for OIDC users instead of the internal identity key #3

jchapman referenced this pull request 2026-10-27 02:49:53 +00:00

Approved pilot priorities and cross-chat handoff workflow #14

jchapman referenced this pull request 2026-10-27 02:49:53 +00:00

Approved pilot priorities and cross-chat handoff workflow #14

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

jchapman/Immich-Bridge!22

No description provided.