Repository navigation
feat(oidc): hosted login and consent pages with no-build branding #406
Description
Why
An authorization endpoint needs a login UI the API serves itself. Theming must not need a build step or break on upgrade.
What
- Hosted sign-in supporting every enabled method (passkeys, magic link, OTP, TOTP, recovery)
- Consent page for third-party clients
- Branding through design tokens and CSS variables set in system config: logo, colors, fonts, app name
- Accessible (WCAG 2.2 AA)
Done when
The hosted pages cover every enabled method and are branded without code.
Activity
Bccorb commentedon Oct 30, 2026
Architecture for this is settled in ADR 0001 (#520). The OpenID Provider runs in a separate public login edge (new repo, seamless-auth-oidc-provider) that signs users in through the first-party routes. The auth API stays private and cookie-free. See D3, D7 and D8. The hosted pages are a SPA in the edge repo on @seamless-auth/react, using the first-party routes. On the API: only the
hosted_uisystem_config key.Bccorb commentedon Nov 1, 2026
Shipped in v0.21.0. The hosted login and consent pages are in the edge (seamless-auth-oidc-provider#14), branded from the
hosted_uisystem config with no build step (seamless-auth-oidc-provider#17, API #532). Branding is documented under "Brand The Hosted Pages". An accessibility audit against WCAG 2.2 AA has not been done; it will be tracked on its own issue. Closing. The audit is tracked in fells-code/seamless-auth-oidc-provider (new issue).