feat(users): Microsoft (Entra ID) OAuth + DB-settings-driven providers - #189
Merged
Conversation
Microsoft (Entra ID) provider plus a refactor moving all OAuth providers off env vars onto the DB-backed settings UI with live reload, resolving providers at request time so DB-only credentials actually mount. Spec only — no implementation yet.
…py (300-line cap)
Deploying simple-module-python with
|
| Latest commit: |
40427f8
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://c618bac7.simple-module-python.pages.dev |
| Branch Preview URL: | https://feat-microsoft-oidc-db-setti.simple-module-python.pages.dev |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
httpx_oauth'sMicrosoftGraphOAuth2), alongside Google/GitHub/OIDC.SM_USERS_OAUTH_*env vars onto the DB-backed admin settings UI (/settings/modules → Users), with secret masking and grouped fields (matches thebackground_tasks/file_storagesettings pattern)./api/users/auth/{provider}/{login,callback}) that resolves the provider from a cache built inon_startupfrom hydrated settings. This fixes a latent bug: routes mount at app construction (before DB settings hydrate), so a provider configured only via the UI previously showed a login button whose route was never mounted (a 404).SettingsReloadedevent — add/remove a provider in the UI with no restart. The login-button list is derived from the same cache, eliminating button/route drift.enabled_provider_names; adds README setup docs + an env→settings migration note.OAuth credentials (Google/GitHub/OIDC/Microsoft) are no longer read from
SM_USERS_OAUTH_*env vars at runtime — they're DB-backed settings now. Existing deployments migrate once:(Same migration
background_tasksalready made. Token secrets keep their env bootstrap path, untouched.)Test plan
make test-py— 1295 passedmodules/users/tests/test_oauth.py,test_oauth_routes.py)create_appinstance: configure Microsoft via settings → button appears +/auth/microsoft/login302s tologin.microsoftonline.comwith the client_id/tenant; clear creds + reload → 404; re-add → 302 — all without a restart<base-url>/api/users/auth/microsoft/callback)Notes
OAuthAccount.oauth_nameis already a string; settings persist in the existing settings store.userPrincipalName(stockhttpx_oauthclient); guest/external accounts may have a non-email UPN — documented in the README rather than worked around, consistent with the Google/GitHub clients.Spec:
docs/superpowers/specs/2026-06-03-microsoft-oidc-design.md· Plan:docs/superpowers/plans/2026-06-03-microsoft-oidc.md