PKCE frontend authentication#11528

Draft

nbudin wants to merge 42 commits into

mainfrom

pkce-frontend-auth

Commits on May 18, 2026

Implement PKCE frontend authentication with JWT bearer tokens

nbudin
and
claude
committed
Fetch client configuration via GraphQL instead of server-rendered props

nbudin
and
claude
committed
Fix CORS and sign-out for PKCE frontend auth

nbudin
and
claude
committed
Fix sign-out navigation race in SignOutButton

nbudin
and
claude
committed
Redirect back to convention after sign-out

nbudin
and
claude
committed
Allow cross-host redirect in respond_to_on_destroy

nbudin
and
claude
committed
Fix respond_to_on_destroy signature to match Devise

nbudin
and
claude
committed
Render sign-in page in root site CMS layout

nbudin
and
claude
committed
Render sign-in page as a React component inside AppRoot

nbudin
and
claude
committed
Add Devise page components for sign-up and forgot password

nbudin
and
claude
committed
Use React Router Link for navigation between auth pages

nbudin
and
claude
committed
We don't need to html_safe an empty string
nbudin
committed
Replace authentication modal with direct redirects to Devise pages

nbudin
and
claude
committed
Port user con profile setup flow to JavaScript

nbudin
and
claude
committed
Move profile setup and clickwrap redirects into appRootLoader

nbudin
and
claude
committed
Internationalize hardcoded strings in authentication components

nbudin
and
claude
committed
Register GraphQLNotAuthenticatedErrorEvent listener eagerly at module level

nbudin
and
claude
committed
No need to escape an empty string
nbudin
committed
Show convention name on auth pages; allow null recaptchaSiteKey

nbudin
and
claude
committed
Resolve sign-in convention via OAuth return URL in GraphQL

nbudin
and
claude
committed
Also check request params for OAuth return URL in convention resolver

nbudin
and
claude
committed
Factor sign-in convention into a separate on-demand query

nbudin
and
claude
committed
Show OAuth app name on sign-in pages; rename sign-in context hook

nbudin
and
claude
committed
Fix PKCE OAuth redirect loop in development

nbudin
and
claude
committed
Revert localhost http:// redirect URI change

nbudin
and
claude
committed
Rename session cookie to _intercode_session2

nbudin
and
claude
committed

Commits on May 19, 2026