GameCult/repixelizer
Watch
9
0
Fork
You've already forked repixelizer
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Refresh Heimdall sessions in hosted access

Browse source
This commit is contained in:
Meta Vens 2026-05-20 13:43:53 +01:00
commit d90bf8eeef
7 changed files with 246 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/implementation-plan.md
View file

@ -30,6 +30,8 @@ The hosted web shell has an auth seam:
- `src/repixelizer/access.py` owns the app-local access boundary and local ownership checks
- `src/repixelizer/gui.py` owns hosted route policy, landing-page behavior, and queue/job stamping
- `GC_ACCESS_MODE=heimdall` supports provider start, backend callback receipt, local JWT verification, and httpOnly session adoption
- Heimdall mode also keeps a separate httpOnly refresh cookie and asks
Heimdall to reissue short-lived app claims before restarting provider OAuth
- self-host and local runs stay permissive by default unless `GC_ACCESS_*` turns the seam on
## What is working