Authentication

WiseWig delegates identity proof to OAuth/OIDC authorization code flow with S256 PKCE. beginOAuth() generates 32 cryptographically random bytes for both state and verifier, persists only the state hash with a ten-minute expiry, and permits only same-origin relative return paths. completeOAuth() consumes state before redemption, sends the one-time verifier to the configured HTTPS token endpoint, bounds provider responses, and obtains the subject from the configured HTTPS UserInfo endpoint. This follows RFC 7636 and the authorization-code flow in RFC 6749.

The external (issuer, subject) must already map to an invited WiseWig user. Authorized owners map that identity and its site role through the members interface before first login. The callback resolves the verified request hostname and authoritative roles, rotates prior sessions for that user/tenant, and creates an eight-hour D1 session record before issuing a signed HttpOnly cookie containing a unique session ID. Production page and command providers require both a valid signature and an active matching D1 record; logout revokes the record and clears the cookie. Account recovery and identity proof stay with the configured provider instead of creating a second password/recovery system in WiseWig.

@wise-wig/auth owns browser-safe Web Crypto signing and verification. It does not decide roles or authenticate passwords. The host integration supplies the signing secret from its secrets manager and resolves memberships before issuing claims.

SignedCookieSessionProvider converts a verified short-lived cookie into the tenant-scoped runtime identity. sessionCookie() emits HttpOnly, SameSite=Strict, path-scoped cookies and requires an explicit secure flag and bounded lifetime. Cookie-authenticated mutations call assertSameOriginMutation() before parsing input or invoking a command; it requires an exact configured Origin and rejects cross-site Fetch Metadata.

Cloudflare hosts call authorizePrivateSiteRequest() for every preview, edit, and private API request. It derives tenant and site scope from the verified request hostname, then checks the signed session and authoritative membership. Request bodies never choose their own tenant scope.

The browser extension opens the active HTTPS site’s /api/auth/start route and therefore uses the same OAuth PKCE flow and cookie as the editor. Its fixed local code is used only for localhost; the local endpoint returns 404 on production hosts.