Skip to content

Commit 3dff180

Browse files
author
jarvis
committed
chore: reduce OIDC pull request noise
1 parent ae11f7e commit 3dff180

18 files changed

Lines changed: 14 additions & 85 deletions

File tree

‎app/components/login/index.vue‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ const { data: oidcConfig } = useFetch<{ enabled: boolean }>('/api/auth/config')
1717
<CardContent class="grid gap-4">
1818
<template v-if="oidcConfig?.enabled">
1919
<Button type="button" class="w-full" @click="signInWithOidc()">
20-
{{ $t('login.oidc_submit') }}
20+
OpenID Connect
2121
</Button>
2222
<Separator />
2323
</template>

‎docs/api/index.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ Send your site password in the `Authorization` header:
2323
Authorization: Bearer YOUR_SITE_TOKEN
2424
```
2525

26-
(`Bearer` means “here is the token”.) It must match `NUXT_SITE_TOKEN` exactly (at least 8 characters). Browsers can also authenticate with a verified Cloudflare Access login or a configured OpenID Connect session. OIDC access and ID tokens remain on the server and are never stored by the browser.
26+
(`Bearer` means “here is the token”.) It must match `NUXT_SITE_TOKEN` exactly (at least 8 characters). With [Cloudflare Access](/configuration/cloudflare-access) enabled, browsers can also authenticate with a verified Access login.
2727

2828
## CORS
2929

‎docs/configuration/index.md‎

Lines changed: 5 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -52,23 +52,11 @@ Set this yourself. It is the **dashboard login password** and the **API password
5252
If you leave it empty, Sink may invent a random password at build time that can change on the next deploy.
5353
:::
5454

55-
| Variable | When | Where | Purpose |
56-
| ------------------------------- | ---------------- | ------------------------------------ | ---------------------------------------------------------- |
57-
| `NUXT_SITE_TOKEN` | Runtime (secret) | Encrypted secret on Workers or Pages | Login + API password |
58-
| `NUXT_OIDC_ISSUER` | Runtime | Worker/Pages variable | Optional OpenID Connect issuer URL |
59-
| `NUXT_OIDC_CLIENT_ID` | Runtime | Worker/Pages variable | Confidential web client ID |
60-
| `NUXT_OIDC_CLIENT_SECRET` | Runtime (secret) | Encrypted secret on Workers or Pages | Confidential web client secret |
61-
| `NUXT_OIDC_REDIRECT_URI` | Runtime | Worker/Pages variable | Exact callback URL ending in `/api/auth/callback` |
62-
| `NUXT_OIDC_SESSION_SECRET` | Runtime (secret) | Encrypted secret on Workers or Pages | Random value of at least 32 characters for signed sessions |
63-
| `NUXT_OIDC_SESSION_TTL_SECONDS` | Runtime | Worker/Pages variable | Local session limit; defaults to `28800` |
64-
| `DEPLOY_D1_DATABASE_ID` | Build | Workers Builds or Pages variables | D1 database ID (from the D1 detail page) |
65-
| `DEPLOY_KV_NAMESPACE_ID` | Build | Workers Builds or Pages variables | KV namespace ID (from the KV detail page) |
66-
67-
### User ownership
68-
69-
Each verified OpenID Connect or Cloudflare Access identity gets an isolated set of links, tags, and analytics. Sink uses the provider's stable subject identifier as the owner ID. The site token remains the `root` identity and owns links created through token-authenticated API requests, including existing links upgraded from an earlier release.
70-
71-
Short-link slugs remain globally unique because every public redirect shares the same hostname. A user therefore receives a conflict when another user already owns the requested slug, without gaining access to that link.
55+
| Variable | When | Where | Purpose |
56+
| ------------------------ | ---------------- | ------------------------------------ | ----------------------------------------- |
57+
| `NUXT_SITE_TOKEN` | Runtime (secret) | Encrypted secret on Workers or Pages | Login + API password |
58+
| `DEPLOY_D1_DATABASE_ID` | Build | Workers Builds or Pages variables | D1 database ID (from the D1 detail page) |
59+
| `DEPLOY_KV_NAMESPACE_ID` | Build | Workers Builds or Pages variables | KV namespace ID (from the KV detail page) |
7260

7361
## Recommended (analytics)
7462

‎docs/zh-CN/api/index.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ description: Sink 的 OpenAPI 文档、身份认证、CORS 与端点索引。
2323
Authorization: Bearer YOUR_SITE_TOKEN
2424
```
2525

26-
（`Bearer` 的意思是「后面是令牌」。）必须与 `NUXT_SITE_TOKEN` 完全一致（至少 8 个字符）。浏览器也可以使用已验证的 Cloudflare Access 登录或已配置的 OpenID Connect Session。OIDC access token 和 ID token 始终保留在服务端，不会存入浏览器。
26+
（`Bearer` 的意思是「后面是令牌」。）必须与 `NUXT_SITE_TOKEN` 完全一致（至少 8 个字符）。启用 [Cloudflare Access](/zh-CN/configuration/cloudflare-access) 后，浏览器也可以用已验证的 Access 登录访问 API。
2727

2828
## CORS
2929

‎docs/zh-CN/configuration/index.md‎

Lines changed: 5 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -52,23 +52,11 @@ description: Sink 支持的全部环境变量——做什么、填在哪、什
5252
如果留空，Sink 可能在构建时随机生成密码，下次部署可能变化。
5353
:::
5454

55-
| 变量 | 时机 | 放哪里 | 用途 |
56-
| ------------------------------- | -------------- | ---------------------------- | ------------------------------------------ |
57-
| `NUXT_SITE_TOKEN` | 运行时（密钥） | Workers 或 Pages 的加密密钥 | 登录 + API 密码 |
58-
| `NUXT_OIDC_ISSUER` | 运行时 | Worker 或 Pages 变量 | 可选的 OpenID Connect 签发者 URL |
59-
| `NUXT_OIDC_CLIENT_ID` | 运行时 | Worker 或 Pages 变量 | 机密 Web 客户端 ID |
60-
| `NUXT_OIDC_CLIENT_SECRET` | 运行时（密钥） | Workers 或 Pages 的加密密钥 | 机密 Web 客户端密钥 |
61-
| `NUXT_OIDC_REDIRECT_URI` | 运行时 | Worker 或 Pages 变量 | 以 `/api/auth/callback` 结尾的精确回调 URL |
62-
| `NUXT_OIDC_SESSION_SECRET` | 运行时（密钥） | Workers 或 Pages 的加密密钥 | 至少 32 字符的随机 Session 签名密钥 |
63-
| `NUXT_OIDC_SESSION_TTL_SECONDS` | 运行时 | Worker 或 Pages 变量 | 本地 Session 上限，默认 `28800` |
64-
| `DEPLOY_D1_DATABASE_ID` | 构建时 | Workers Builds 或 Pages 变量 | D1 数据库 ID（在 D1 详情页） |
65-
| `DEPLOY_KV_NAMESPACE_ID` | 构建时 | Workers Builds 或 Pages 变量 | KV 命名空间 ID（在 KV 详情页） |
66-
67-
### 用户数据归属
68-
69-
每个通过 OpenID Connect 或 Cloudflare Access 验证的身份都有相互隔离的链接、标签和访问分析数据。Sink 使用身份提供方稳定的 subject 标识作为 owner ID。站点令牌继续代表 `root` 身份，并拥有通过令牌 API 创建的链接，以及从旧版本升级的现有链接。
70-
71-
由于同一主机名下的公开跳转共用短码命名空间，短码仍然全局唯一。如果其他用户已经占用了指定短码，当前用户只会收到冲突响应，无法访问对方的链接。
55+
| 变量 | 时机 | 放哪里 | 用途 |
56+
| ------------------------ | -------------- | ---------------------------- | ------------------------------ |
57+
| `NUXT_SITE_TOKEN` | 运行时（密钥） | Workers 或 Pages 的加密密钥 | 登录 + API 密码 |
58+
| `DEPLOY_D1_DATABASE_ID` | 构建时 | Workers Builds 或 Pages 变量 | D1 数据库 ID（在 D1 详情页） |
59+
| `DEPLOY_KV_NAMESPACE_ID` | 构建时 | Workers Builds 或 Pages 变量 | KV 命名空间 ID（在 KV 详情页） |
7260

7361
## 推荐配置（访问分析）
7462

‎i18n/locales/de-DE/auth.json‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@
55
"tips": "Tipps",
66
"preview_token": "Der Site-Token für den Vorschaumodus ist",
77
"submit": "Anmelden",
8-
"oidc_submit": "Mit OpenID Connect fortfahren",
98
"failed": "Anmeldung fehlgeschlagen, bitte versuche es erneut",
109
"token_label": "Site-Token",
1110
"token_required": "Token ist erforderlich",

‎i18n/locales/en-US/auth.json‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@
55
"tips": "Tips",
66
"preview_token": "The site token for preview mode is",
77
"submit": "Log in",
8-
"oidc_submit": "Continue with OpenID Connect",
98
"failed": "Failed to log in. Please try again.",
109
"token_label": "Site Token",
1110
"token_required": "Token is required.",

‎i18n/locales/fr-FR/auth.json‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@
55
"tips": "Astuces",
66
"preview_token": "Le jeton du site pour le mode aperçu est",
77
"submit": "Connexion",
8-
"oidc_submit": "Continuer avec OpenID Connect",
98
"failed": "Échec de la connexion, veuillez réessayer",
109
"token_label": "Jeton du site",
1110
"token_required": "Le jeton est requis",

‎i18n/locales/id-ID/auth.json‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@
55
"tips": "Tips",
66
"preview_token": "Token situs untuk mode pratinjau adalah",
77
"submit": "Masuk",
8-
"oidc_submit": "Lanjutkan dengan OpenID Connect",
98
"failed": "Login gagal, silakan coba lagi",
109
"token_label": "Token Situs",
1110
"token_required": "Token wajib diisi",

‎i18n/locales/it-IT/auth.json‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@
55
"tips": "Suggerimenti",
66
"preview_token": "Il token del sito per la modalità anteprima è",
77
"submit": "Accedi",
8-
"oidc_submit": "Continua con OpenID Connect",
98
"failed": "Accesso fallito, riprova",
109
"token_label": "Token del Sito",
1110
"token_required": "Il token è obbligatorio",

0 commit comments

Comments
 (0)