feat: harden plugin api for separate repos, signed updates and generic external login

plugins/sso/tests/backend/helpers.ts

@@ -57,6 +57,7 @@ export async function startServer(
     permissions?: string[];
     linkedUsers?: Record<string, number>;
     before?: (sqlite: TestDb["sqlite"]) => void;
+    settings?: Record<string, unknown>;
   } = {},
 ): Promise<TestServer> {
   const db = await createTestDb(pluginDir, { before: options.before });
@@ -74,6 +75,7 @@ export async function startServer(
     permissions: options.permissions,
     linkedUsers: options.linkedUsers,
     baseUrl: "https://termix.test",
+    settings: options.settings,
   });
 
   const { activate } = await import("../../src/backend/index.js");

plugins/sso/tests/backend/sso.test.ts

@@ -185,6 +185,31 @@ describe("the login method", () => {
     ]);
   });
 
+  it("marks the first provider to start on its own with silent sign-in on", async () => {
+    const s = await startLegacy({ settings: { silentLoginDefault: true } });
+    expect(await s.mock.auth.loginMethods[0].describe!()).toEqual([
+      {
+        id: "3",
+        label: "Keycloak",
+        type: "oidc",
+        enabled: true,
+        autoStart: true,
+      },
+    ]);
+  });
+
+  it("lets OIDC_SILENT_LOGIN_DEFAULT override the setting", async () => {
+    const s = await startLegacy({ settings: { silentLoginDefault: true } });
+    vi.stubEnv("OIDC_SILENT_LOGIN_DEFAULT", "false");
+    const [instance] = await s.mock.auth.loginMethods[0].describe!();
+    expect(instance.autoStart).toBeUndefined();
+    vi.stubEnv("OIDC_SILENT_LOGIN_DEFAULT", "true");
+    s.mock.settings.clear();
+    expect((await s.mock.auth.loginMethods[0].describe!())[0].autoStart).toBe(
+      true,
+    );
+  });
+
   it("falls back to the provider configured through the environment", async () => {
     server = await startServer();
     vi.stubEnv("OIDC_CLIENT_ID", "env-client");