zeekay 724506820a Stop being an identity provider ...

The forge served its own OIDC discovery document, its own JWKS, its own
authorize, token, userinfo and introspection endpoints -- measured live,
all answering 200 beside hanzo.id. It also carried local password
sign-in, sign-up, e-mail activation, password reset, TOTP, WebAuthn,
OpenID consumption and account linking between them.

No service issues or checks its own credentials. Identity is Hanzo IAM's.

A credential is verified in exactly one place now: iam.go checks that IAM
signed the bearer, against the issuer's published keys. That needs no
client secret and no login source, so a git push, a CI clone and a
package pull work with nothing configured here -- which is what the
[iam] block the deployment already writes is for.

There is no browser sign-in. The redirect to hanzo.id and back is not
built and could not be salvaged from what was removed: that machinery WAS
the second provider. A human reaches this instance with a token until it
is written.

2026-09-03 10:47:47 -07:00

..

auth.go

Stop being an identity provider

2026-09-03 10:47:47 -07:00