forked from Onyva/onyva-login-skill
Timo Uttenweiler
366edf55d9
Major SKILL.md update: lessons learned from real integrations - Add IdP-initiated SSO handling (Admin-Panel sends ?code= only, no state) → state missing must NOT trigger 400, otherwise admin-panel app tiles break - Add Middleware-Reihenfolge warning (SessionMiddleware LIFO footgun) - Add Auth-Guard distinction: HTML-Navigation 307 vs JSON-API 401 - Add Frontend 401-handling pattern (hard navigation, not fetch redirect) - Add stdlib-only HTTP + JWT-decode helpers (urllib.request + base64url padding) - Add Session-Storage options table (in-memory / SessionMiddleware / Redis) - Add CLIENT_SECRET generation guidance (admin-panel vs locally) - Add Smoke-Test mit curl (5 calls catching 90% of typical bugs) - Add "replace existing auth" checklist (remove old constants/routes/HTML) - Cookie flags: explain why samesite=lax (not strict) for OIDC callback - Logout: two separate functions, FastAPI doesn't support decorator stacking - Hard restart guidance for middleware iteration - Many additional Fallstricke entries from real bugs