mirror of
https://github.com/hanzoai/id.git
synced 2026-10-30 14:57:39 +00:00
zooqueen
8f3f605bea
The deployed hanzo.id SPA (id:0.1.7, 26d old) POSTed login to /api/login with the implicit-flow body type:"token". That path hit the SPA static catch-all -> index.html (HTML 200) -> JSON.parse threw -> "Unable to sign in", and even reaching IAM, type:"token" is rejected (implicit flow disabled). Current source already POSTs /v1/iam/login with responseType=code; a fresh build of HEAD fixes it. - Dockerfile: final stage ghcr.io/hanzoai/static:0.4.1 -> hanzoai/spa:1.2.0. static's default CSP is `default-src 'none'` (no script-src/connect-src) which blanks the SPA and blocks fetch() to IAM; spa serves /public on :3000 with index.html fallback and an SPA-safe CSP (frame-ancestors 'none'). Matches the live deploy contract (containerPort 3000, /health probe) exactly. - LoginForm identifier input stays type="text" (accepts `z` and `[email protected]`); forgot/signup keep type="email" (semantically correct). - Adds social-provider + email/SMS-code login UI (best-effort appLogin), and a signupEnabled tenant flag for invite-only tenants. - Tenant clientId hanzo-id (verified: POST /v1/iam/login app=hanzo-id org=hanzo user=z -> {"status":"ok","data":"hanzo/z"}). - Pin @hanzo/iam to ^0.9.4 (published patch line). - apps/web 0.1.1 -> 0.1.8.