TAuth demo

This page connects the mpr-header web component to a local TAuth service running under Docker Compose. Use Google or the owned email panel to sign in or create an account. Then observe the shared profile state and manage the current account.

Current session

Provider, password, and account requests use the TAuth service configured in ./config-ui.yaml. mpr-ui keeps every form on the shared auth controller and aligns the shell state with the session cookie.

Awaiting connection to the TAuth service…

Email and password flows

These forms call the configured TAuth endpoints through the shared header auth controller. TAuth sends challenge links through Pinguin. A returned link opens its matching form and keeps the token inside the shared component boundary. The page contains no app-owned request code.

Account management

Sign in first. Each panel uses the same authenticated state and does not probe TAuth independently. The unlink selector targets the seeded password identity; link Google before removing that sign-in method.

How it works

  1. The frontend is served by gHTTP on port 4443 (HTTP), which proxies the configured /auth/* routes to the local TAuth container.
  2. Auth configuration is loaded from ./config-ui.yaml via the mpr-ui-config.js loader, which applies one validated auth-config contract to the header, user, password-auth, and account-panel elements.
  3. The browser only needs the same-origin auth routes: /auth/nonce, /auth/google, /auth/logout, /auth/session, the configured password endpoints, and the configured account endpoints.
  4. The header requests /auth/nonce before it renders the official Google popup button. It refreshes that nonce while the control remains connected.
  5. Google returns the ID token to the JavaScript callback. The header sends the token and nonce to /auth/google without a Google redirect URI.
  6. The Google account panel uses the same official popup button and nonce contract. It sends the returned proof to /auth/account/google/link.
  7. After a refresh, mpr-ui restores the profile through /auth/session before it updates the shell state.
  8. Clicking Log out in the menu invokes /auth/logout and resets the profile snapshot below.