# TASK METADATA

- **Target Files:** `auth-yes/server/db.ts`, `auth-yes/server/oidc.ts`,
  `auth-yes/server/main.ts`, `auth-yes/ui/admin/integrations.tsx` (and related
  UI files)
- **Core Objective:** Implement seamless 3rd-party SSO via a Zero-Click OIDC
  Provider and Traefik ForwardAuth Header injection.
- **Dependencies:** Core Auth-Yes session mechanisms, Valkey cache, Hono
  routing, React/JSX for UI.
- **Additional Important Notes:** Ensure OIDC logic is decoupled from `main.ts`
  to prevent a monolith. Database migrations are required for OIDC
  clients/authorization codes.

---

### Phase 2: The Bonus Stage — Seamless 3rd-Party SSO (Gitea, Portainer, etc.)

Your vision for frictionless 3rd-party access without double-logins is
achievable through two native patterns we can bring directly into auth-yes:

#### 1. The "Zero-Click" OIDC Provider in auth-yes

• Most self-hosted power tools (Gitea, Nextcloud, Grafana, Portainer, Proxmox,
Vaultwarden) support standard OpenID Connect (OIDC). • When auth-yes exposes
standard OIDC endpoints (/oauth/authorize, /oauth/token, /oauth/userinfo): • You
click "Login with Auth-Yes" on Gitea (or configure Gitea for auto-login). •
Gitea redirects to auth.atyg.org. • Because you already have your .atyg.org
passkey cookie active, auth-yes instantly authorizes and redirects back in ~10
milliseconds without presenting any login dialogs. • Gitea automatically creates
and syncs your account on the fly.

#### 2. Reverse-Proxy Header Authentication (Traefik ForwardAuth)

• Apps like Gitea have native Reverse Proxy Auth
(ENABLE_REVERSE_PROXY_AUTHENTICATION = true). • When Traefik calls
/api/forward-auth, auth-yes injects X-Forwarded-User: <username>. Gitea
immediately trusts the header and logs you in transparently with zero
interaction.

#### 3. 3rd-Party App Integrations Manager in Admin Console

• We can expand our Application Registry (/admin/apps) with an Integrations
Catalog (Client IDs, OIDC secrets, callback URLs, and role-mapping presets for
Gitea, Grafana, Portainer, etc.). • This gives you a single pane of glass to
manage passkey-secured SSO across your entire self-hosted ecosystem, allowing
you to optionally bypass Cloudflare Zero Trust popups entirely.