Sign-in goes straight to the identity provider

With single sign-on there is nothing to choose, so /authorize redirects to
it; the page shows only when something went wrong there.
Server 0.1.3, chart 0.1.4.

Cargo.lock

@@ -43,7 +43,7 @@ dependencies = [
 
 [[package]]
 name = "archify-sync-protocol"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
  "chrono",
  "serde",
@@ -53,7 +53,7 @@ dependencies = [
 
 [[package]]
 name = "archify-sync-server"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
  "anyhow",
  "archify-sync-protocol",
@@ -83,7 +83,7 @@ dependencies = [
 
 [[package]]
 name = "archify-sync-store"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
  "chrono",
  "serde_json",

Cargo.toml

@@ -3,7 +3,7 @@ resolver = "3"
 members = ["crates/protocol", "crates/store", "crates/server"]
 
 [workspace.package]
-version = "0.1.2"
+version = "0.1.3"
 edition = "2024"
 license = "MIT"
 repository = "https://gitea.lego-cloud.eu/vscode-extensions/archify-vscode-ext-sync"

README.md

@@ -16,7 +16,7 @@ One Rust process and PostgreSQL. The design, with its decisions, is the Archify
   - **Update log:** taking a version compacts it.
 - **Sign-in.** The editor opens `/authorize` in the browser and gets a one-time code back through its URI handler. It exchanges the code with its PKCE verifier for an access token (JWT, 15 minutes) and a refresh token. The refresh token is single use: reusing one signs out the whole session.
 - **First start.** With single sign-on there is no setup step: the identity provider says who may sign in and who is admin, and the first sign-in makes the organisation (named after `ARCHIFY_SYNC_NAME`). Without single sign-on, a server without accounts prints a first-start code in its log; the first person to use it at `/setup` becomes the admin.
-- **Invites.** An invite link (`/join/<token>`) opens the extension. Someone new makes an account on the sign-in page, so no mail server is needed. With single sign-on, the identity provider is the only way in: the sign-in page has no password form, and an invited person signs in there.
+- **Invites.** An invite link (`/join/<token>`) opens the extension. Someone new makes an account on the sign-in page, so no mail server is needed. With single sign-on, the identity provider is the only way in: sign-in goes straight to it, with no password form, and an invited person signs in there.
 
 ## Layout
 

charts/archify-sync/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: archify-sync
 description: Archify Sync, live and shared Archify models for VS Code
 type: application
-version: 0.1.3
+version: 0.1.4
-appVersion: "0.1.2"
+appVersion: "0.1.3"
 annotations:
   artifacthub.io/license: MIT
 sources:

crates/server/src/pages.rs

@@ -190,6 +190,11 @@ pub async fn authorize_page(
     State(state): State<AppState>,
     Query(q): Query<AuthorizeQuery>,
 ) -> Response {
+    // With single sign-on there is nothing to choose: straight to the identity
+    // provider. The page only shows when something went wrong there.
+    if state.oidc.is_some() && check_authorize(&state, &q).is_ok() {
+        return Redirect::to(&format!("/oidc/start?{}", q.to_query_string())).into_response();
+    }
     authorize_form(&state, &q, None).await
 }