mathias c9863e9633 feat(oidc): echo caller subject in the 403 to bootstrap the allowlist ...

First-login chicken-egg: TAPIR_ALLOWED_SUBJECT can't be known until the user
logs in once, but the allowlist gates login. Echo the (non-secret, opaque)
subject in the forbidden response so the maintainer can read it in the browser,
set the 1P item, and lock the allowlist.

2026-06-03 08:53:06 +02:00

..

oidc

feat(oidc): echo caller subject in the 403 to bootstrap the allowlist

2026-06-03 08:53:06 +02:00

static

feat(deploy): add Dockerfile and vendor htmx for deployable image

2026-06-03 00:08:35 +02:00

auth.go

feat(web): add Auth seam (interface + StubAuth) for parallel UI build

2026-06-02 23:39:04 +02:00

handlers_test.go

feat(web): sleek Stage-0 reader — design system, card list, reader detail

2026-06-03 00:20:22 +02:00

handlers.go

feat(web): sleek Stage-0 reader — design system, card list, reader detail

2026-06-03 00:20:22 +02:00

static.go

feat(deploy): add Dockerfile and vendor htmx for deployable image

2026-06-03 00:08:35 +02:00

view.go

feat(web): sleek Stage-0 reader — design system, card list, reader detail

2026-06-03 00:20:22 +02:00

views_templ.go

feat(web): sleek Stage-0 reader — design system, card list, reader detail

2026-06-03 00:20:22 +02:00

views.templ

feat(web): sleek Stage-0 reader — design system, card list, reader detail

2026-06-03 00:20:22 +02:00