Skip to content

Document device verification and the login actor #94 - #95

Draft
rymsha wants to merge 20 commits into
masterfrom
device-login
Draft

Document device verification and the login actor #94#95
rymsha wants to merge 20 commits into
masterfrom
device-login

Conversation

@rymsha

@rymsha rymsha commented Oct 16, 2026

Copy link
Copy Markdown
Contributor

Closes #94

Documents the JavaScript APIs the XP 8.2 device-login chain adds: enonic/xp#12458 (principal-restricted login), enonic/xp#12460 and enonic/xp#12461 (device login served by core, with the ID provider's verification page) and enonic/xp#12473 (actor on logins and audit log entries).

  • web/id-providers: the XP-served device endpoints listed next to the ID provider's own; a note on autoLogin that XP's own bearer tokens are accepted before it runs; a new deviceVerification section with the req.deviceLogin table, the form contract the page posts back, and a minimal TypeScript implementation.
  • web/request-response: request.accessToken on token-authenticated requests.
  • libraries/lib-auth: the principals and actor parameters of login(), with an example.
  • libraries/lib-auditlog: the actor parameter of log() and the field on returned entries.

The platform side, the flow itself, vhost settings and configuration, is in enonic/doc-platform#607.

Draft until the XP chain merges.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LmGPp3CzNhyaESxdq6id8J

Generated by Claude Code

claude and others added 20 commits October 16, 2026 09:28
@claude
Document device verification and the login actor #94
6c29428 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LmGPp3CzNhyaESxdq6id8J
@claude
Handle a missing deviceLogin in the example, and say which fields may…
aa02610 
… be null #94

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LmGPp3CzNhyaESxdq6id8J
@claude
Membership changes apply at the next login, not to a running session #94
63010ba 


Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LmGPp3CzNhyaESxdq6id8J
@claude
lib-auth login: a system.admin member gains every listed principal
fefd9c3 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LmGPp3CzNhyaESxdq6id8J
@claude
lib-auth: getIdProviderSettings()
948246c 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LmGPp3CzNhyaESxdq6id8J
@claude
ID providers: request.idProviderSettings replaces the lib-auth function
085d46b 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LmGPp3CzNhyaESxdq6id8J
@claude
Types: RequestAccessToken, IdProviderSettings, DeviceLogin and its parts
0a23cab 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LmGPp3CzNhyaESxdq6id8J
@claude
ID providers: idProviderSettings.scopes carries roles and required pe…
2c937e9 
…r scope

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LmGPp3CzNhyaESxdq6id8J
@claude
ID providers: profile as a required label-only scope in the example
025636d 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LmGPp3CzNhyaESxdq6id8J
@claude
Examples: no Content Studio app role in scope and principals examples
52fe618 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LmGPp3CzNhyaESxdq6id8J
@claude
lib-auth login: what a restricted login does with groups
e381a04 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LmGPp3CzNhyaESxdq6id8J
@claude
lib-auth login: the restriction option is roles
5ad769c 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LmGPp3CzNhyaESxdq6id8J
@rymsha @claude
lib-auth login: promote a verified third-party access token
3ade664 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LmGPp3CzNhyaESxdq6id8J
@rymsha @claude
Access tokens: every token names its audience and client, at+jwt type
3b65653 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LmGPp3CzNhyaESxdq6id8J
@rymsha @claude
Access tokens: a vhost declaring no audience stands for XP itself, by…
ec90256 
… its issuer name

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LmGPp3CzNhyaESxdq6id8J
@rymsha @claude
Access tokens: say each thing once
ca250c0 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LmGPp3CzNhyaESxdq6id8J
@rymsha @claude
Scopes of a request come from its grant
14ba993 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LmGPp3CzNhyaESxdq6id8J
@rymsha @claude
XP 8.2.0 badge on what device login adds
e848efa 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LmGPp3CzNhyaESxdq6id8J
@rymsha @claude
Access tokens: say what an audience is in plain words
b849e34 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LmGPp3CzNhyaESxdq6id8J
@rymsha @claude
Access tokens: plainer wording
60f5959 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LmGPp3CzNhyaESxdq6id8J

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot will automatically review once the pull request is marked ready for review

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Document device verification and the login actor

2 participants

@rymsha @claude