mirror of
https://github.com/hanzo-apps/tabs.git
synced 2026-09-15 19:32:29 +00:00
zeekayandHanzo Dev
8c0ded7bfe
UNIFIED IDENTITY. A pasted token was the honest shape for a backendless app on day one and the wrong one to keep: it is a credential handled by hand, and it is not the identity the rest of Hanzo uses. Sign-in is OIDC authorization code + PKCE against hanzo.id now — the same login as everything else — in about sixty lines against their own discovery document, with no dependency. A static site cannot keep a secret, so PKCE is not a convenience here; it IS what replaces the secret, and `hanzo-tabs` is registered as a genuine public client. The token still lives in this browser, because there is nowhere else it could: inventing a session store would mean inventing the server this product exists without. The difference is that it is now short-lived, refreshable, and issued to this origin rather than copied from a terminal. A PURE STATIC EXPORT. `output: 'export'` — no server at request time, not even a Node one. Tabs reads the control plane from the browser with the caller's own token and frames terminals the machines themselves serve over the zero-trust fabric; both ends of that conversation are already authenticated, so a server here would be a third party to it. The Dockerfile goes with the same reasoning: what ships is a directory of files. Deployed at tabs.hanzo.ai from S3 via hanzoai/static. Two things had to be fixed to get there and both were ours: the S3 adapter refused directory requests outright (fixed in hanzoai/static v0.5.4 — every static site was 404ing at its own root), and the default CSP is `default-src 'none'`, which blocks every script, so the page rendered and nothing ran. Verified in a real browser against the live IdP: the sign-in button lands on hanzo.id/login/oauth/authorize carrying the PKCE challenge, with no console errors. Co-authored-by: Hanzo Dev <[email protected]>