feat(sso): per-app integration — RS256/JWKS OIDC, Open-Notebook + Jellyfin, Layer-2 proof-of-proxy (Phase 2) - #2229

Merged

POWERFULMOVES merged 7 commits into

mainfrom

feat/sso-gateway-apps

Jul 26, 2026

Commits on Jul 26, 2026

feat(sso-auth): OIDC id_token RS256 + /oidc/jwks (Jellyfin-compatible provider)

POWERFULMOVES
and
claude
committed
60f4334
feat(sso): proof-of-proxy shared secret (Layer 2, CRITICAL header-spoof fix)

POWERFULMOVES
and
claude
committed
9ea918d
chore(sso): bump PMOVES-Open-Notebook gitlink -> 7e67910 (Remote-User proof-of-proxy)

POWERFULMOVES
and
claude
committed
0afa6b3
chore(sso): bump PMOVES-Jellyfin gitlink -> f80afdee0 (OIDC plugin bake, Task 9)

POWERFULMOVES
and
claude
committed
006330b
feat(sso): brand_defaults seeds SSO config + generates gateway secrets

POWERFULMOVES
and
claude
committed
4f14084
feat(sso-auth): self-provision OIDC signing key (load-or-generate, no pipeline PEM)

POWERFULMOVES
and
claude
committed
f509ac9
fix(sso): sso-auth needs pmoves_api (reach GoTrue) + missing env vars (live e2e)

POWERFULMOVES
and
claude
committed
9953743