Auth plugin model
OpenNeko supports one singleton auth capability per deployment. The plugin registry rejects a second plugin that claims auth, so there is a single SSO source of truth for signin.
The signin page shows the provider label from the active auth plugin. If no auth plugin is installed, the UI can point admins toward an install command such as openneko install @open-neko/plugin-scalekit.
User bootstrap and roles
New users can bootstrap into admin role when they are the first active admin. Otherwise, provider groups map to roles: admin-like groups such as admin, admins, and owners map to admin; other users map to member.
- Keep IdP group mapping simple and test it with a non-admin account.
- Use provider-side MFA and conditional access.
- Rotate OPENNEKO_SESSION_SECRET intentionally because it signs session cookies.
- Treat IdP client secrets as worker-side plugin secrets.
Signin boundary
The web app initiates auth and completes the browser-facing session, but beginAuth and completeAuth are proxied through the worker admin path. The auth plugin keeps IdP client_secret handling inside the worker sandbox boundary.