feat: harden plugin api for separate repos, signed updates and generic external login

plugins/sso/src/backend/index.ts

@@ -5,6 +5,16 @@ import { createProviderStore } from "./providers.js";
 import { createSsoLogin, METHOD_ID } from "./login.js";
 import { PUBLIC_PATHS, registerSsoRoutes } from "./routes.js";
 
+/**
+ * Whether the login page starts the first provider without a click. The
+ * OIDC_SILENT_LOGIN_DEFAULT environment variable pins it either way.
+ */
+export async function silentLoginDefault(ctx: PluginContext): Promise<boolean> {
+  const pinned = process.env.OIDC_SILENT_LOGIN_DEFAULT;
+  if (pinned !== undefined) return pinned.trim().toLowerCase() === "true";
+  return (await ctx.settings.get("silentLoginDefault")) === true;
+}
+
 export async function activate(ctx: PluginContext) {
   const table = await ctx.db.define(providers);
   const store = createProviderStore(ctx, table);
@@ -17,11 +27,14 @@ export async function activate(ctx: PluginContext) {
     icon: "key-round",
     kind: "redirect",
     external: true,
-    describe: async () =>
-      (await store.listInstances()).map((instance) => ({
+    describe: async () => {
+      const autoStart = await silentLoginDefault(ctx);
+      return (await store.listInstances()).map((instance, index) => ({
         ...instance,
         enabled: true,
-      })),
+        ...(autoStart && index === 0 ? { autoStart: true } : {}),
+      }));
+    },
     start: login.start,
     callback: login.callback,
   });