mikeknight85/PriceStalker v1.2.0

PriceStalker 1.2.0 — Single Sign-On (BETA)

on GitHub

First release with Single Sign-On support via OIDC. Marked BETA while the integration gets tested across more providers in the wild.

Added

• OIDC / SSO (BETA) — PriceStalker can now act as an OIDC Relying Party against any compliant provider: Authentik, Keycloak, Google, Okta, Auth0, etc. Standard Authorization Code + PKCE flow with state + nonce + ID-token signature validation.
• Three admin-selectable policies (Settings → Authentication, admin only):
  • local — current behavior, OIDC UI hidden
  • both — local form and "Sign in with X" button coexist
  • oidc — SSO-only with auto-redirect to the IdP on visit; admin can always reach local login via /login?local=1 (break-glass)
• JIT provisioning — auto-create PriceStalker accounts from the first successful OIDC sign-in. First user is auto-promoted to admin.
• Identity linking — existing local account with matching email is auto-linked on first OIDC sign-in (no duplicate users).
• "Require verified email" admin toggle — enforces email_verified=true in the token. Default on (safe for Google/Microsoft). Disable for self-hosted IdPs like Authentik/Keycloak that don't emit this claim by default.
• "Test discovery" button in the admin panel — validates an issuer URL before saving.

Activation

Ships feature-flagged off — upgrading from 1.1.x changes nothing until you opt in:

ENABLE_SSO=true
PUBLIC_URL=https://your.pricestalker.domain

Then configure the provider in Settings → Authentication.

Redirect URI to add in your IdP:

https://your.pricestalker.domain/api/auth/oidc/callback

Known limitations (BETA)

• No Single Logout (SLO) — logging out of your IdP does not automatically log you out of PriceStalker (the two sessions are decoupled JWTs). Use PriceStalker's own logout button. SLO is the first thing on the v1.3.0 roadmap.
• One OIDC provider at a time — schema supports per-user provider tracking, but admin UI only configures one provider.
• No group → role mapping yet — admins are promoted manually after JIT.

Full design doc at docs/SSO_DESIGN.md.

Docker images

ghcr.io/mikeknight85/pricestalker-backend:1.2.0
ghcr.io/mikeknight85/pricestalker-frontend:1.2.0

Changed

• adminMiddleware extracted into its own middleware/admin.ts so the new admin-auth routes can share it.
• users.password_hash is nullable (OIDC-provisioned users never had one). Password-change attempts on SSO accounts now return a clear error pointing you to your IdP.