mirror of
https://github.com/PR0M3TH3AN/bitlogin.git
synced 2026-10-27 08:31:21 +00:00
thePR0M3TH3ANandClaude Fable 5
37f5bbd243
Implements centralized-onramps.md §CO3.3, per the owner call that static only is the way. No server anywhere: the host registers a Google OAuth client ID (onramp-google-client-id) and the widget does the rest -- a popup runs the plain implicit grant (no external script, so script-src 'self' survives), scoped to drive.appdata only, redirecting back to the widget page itself, which relays the token fragment to its opener under the same origin+nonce discipline as the service handshake. Returning users: the credential file is read from the user's app-data folder and fed into the ordinary password login. First-timers: fresh identity or §SF10 import, client-side registration, credential uploaded to their own Drive -- with the no-orphan rule forcing the phrase ceremony if the upload fails. Rotating the password later IS the graduation step; the rotate screen says so for managed sessions, and the dashboard states the custody plainly: your sign-in key is stored in your own Google Drive. driveOnramp.ts is pure and unit-tested (13 tests); new pins keep all network I/O out of the element and constrain Drive fetches to the two Google API constants. Hosts add https://www.googleapis.com to connect-src and register the widget page URL as the redirect URI -- documented in the guide, llms.txt, and the design doc (v0.3), including the recorded dependency on the legacy implicit grant. Co-Authored-By: Claude Fable 5 <[email protected]>