feat(login): username/password + host:port credentials sign-in alongside SSO#16
Merged
Merged
Conversation
…side SSO
Adds a second sign-in path to the login screen: HTTP Basic credentials
(ClickHouse user + password), optionally against another host:port, as an
alternative to the OAuth/SSO flow.
- src/ui/login.js: rebuilt to the Login.html design — SSO + credentials with a
primary/secondary swap, an "Advanced" host disclosure, password show/hide, and
a live "Target" summary row. Faithful to the handoff, reusing existing tokens.
- src/ui/app.js: `authMode` ('oauth' | 'basic'); a `connect()` action that probes
SELECT 1, commits the session, and enters the workbench; basic branches behind
the existing chCtx seams (getToken/authHeader/refresh/isSignedIn/email/host),
ensureConfig no-op, clearTokens resets. Basic session restored from
sessionStorage (ch_basic_*); no ch-client changes needed.
- src/core/target.js: pure resolveTarget() host→origin normalizer.
- src/net/oauth-config.js: parse top-level `basic_login` (default on), tolerate
0 IdPs (credentials-only deployments).
- src/main.js: bootstrap decision → app.isSignedIn() (covers both modes).
- docs: config.json.example `basic_login`; README credentials section incl. the
CSP connect-src + target CORS caveats for cross-origin hosts.
Tests at 100% per-file gate (452 passing); build clean.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WFt3fLEJW7XdBhoc8SgH9A
Collaborator
Author
E2E verified on the github demo cluster (demo:demo) ✅Deployed this branch's Cluster: OSS ClickHouse Results — same-origin credentials (primary case, no CORS):
No bugs found.
|
This was referenced Jun 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a second sign-in path to the login screen: ClickHouse username + password (HTTP Basic), optionally against another host:port, as an alternative to the existing OAuth/SSO flow. Faithfully recreates the handoff
Login.htmldesign in vanillah(), reusing the app's existing tokens (Altinity-blue accent, no dev-only Tweaks panel).Why
Many ClickHouse deployments have no OAuth — just a CH user + password. This lets those users sign in, and lets anyone point the credential path at a different server.
How
src/ui/login.js— rebuilt: SSO + credentials with a primary/secondary button swap (Connect becomes primary once both fields are filled), an Advanced host disclosure, password show/hide, and a live Target summary row.src/ui/app.js—authMode(oauth|basic); aconnect()action that probesSELECT 1, commits the session, and enters the workbench; basic-mode branches behind the existingchCtxseams (getToken/authHeader/refresh/isSignedIn/email/host),ensureConfigno-op,clearTokensreset. A basic session is restored fromch_basic_*sessionStorage. Noch-client.jschanges — the seams were already there.src/core/target.js— pureresolveTarget()host→origin normalizer (blank → serving origin; bare host →https://…:8443; explicit scheme/port honoured).src/net/oauth-config.js— parse top-levelbasic_login(default on; setfalseto force SSO-only); tolerate 0 IdPs (credentials-only deployments).src/main.js— bootstrap decision →app.isSignedIn()(covers both modes).deploy/config.json.examplebasic_login; README credentials section incl. the CSPconnect-src+ target CORS caveats for cross-origin hosts.Security notes
sessionStoragefor the tab session (same lifetime as the OAuth token), sent asAuthorization: Basic base64(user:password).connect-srcCSP and (b) the target CH allowing CORS / answering theAuthorizationpreflight — documented in the README.Tests
npm test: 452 passing, 100% per-file coverage gate green (app.js100/90.81/96.73/100).npm run build: clean →dist/sql.html.target.test.js,login.test.js(full rewrite),app.test.js(basic-mode suite),oauth-config.test.js,main.test.js.E2E (pending, delegated)
To be verified on the github demo cluster (id 337, CH
26.3.10.62) withdemo:demo—demo:demoauth already confirmed via ACM. Primary case is same-origin credentials (no CORS). Deploy isclickhouse-client→user_files/sql.html(overwrites the live asset — confirm before deploying).🤖 Generated with Claude Code