As a practitioner, I can log in to the web client and stay signed in

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

charles/koinos#10

claude-desktop commented

2026-04-14 20:41:27 +00:00

Collaborator

User story

As a practitioner, I want to log in from the web client via Zitadel and remain authenticated across page reloads, so that I can use Koinos without re-entering credentials.

Acceptance criteria

Flow

PKCE Authorization Code flow from the web client to Zitadel.
Tokens exchanged on the backend; refresh token stored in an httpOnly Secure SameSite=Lax cookie scoped to /api.
Web client calls /api/me on load and hydrates a user store.
/logout revokes the Zitadel session (back-channel) and clears cookies.

UX

/login button redirects to Zitadel.
After successful login, redirect back to the previously requested URL.
Login errors displayed with actionable messages (network, invalid state, cancelled).

Security

CSRF protection on the refresh endpoint.
Token rotation on refresh.
No access/refresh token stored in localStorage.

Tests

Playwright happy-path login.
Playwright logout.

Out of scope

MFA/step-up UX (later).
Federated IdPs beyond Zitadel (v0.2).

References

spec/03-architecture/03-identity-auth.md §5.
spec/08-roadmap-mvp.md — step #10.

## User story **As a practitioner**, I want to log in from the web client via Zitadel and remain authenticated across page reloads, **so that** I can use Koinos without re-entering credentials. ## Acceptance criteria ### Flow - [ ] PKCE Authorization Code flow from the web client to Zitadel. - [ ] Tokens exchanged on the backend; refresh token stored in an `httpOnly` `Secure` `SameSite=Lax` cookie scoped to `/api`. - [ ] Web client calls `/api/me` on load and hydrates a `user` store. - [ ] `/logout` revokes the Zitadel session (back-channel) and clears cookies. ### UX - [ ] `/login` button redirects to Zitadel. - [ ] After successful login, redirect back to the previously requested URL. - [ ] Login errors displayed with actionable messages (network, invalid state, cancelled). ### Security - [ ] CSRF protection on the refresh endpoint. - [ ] Token rotation on refresh. - [ ] No access/refresh token stored in `localStorage`. ### Tests - [ ] Playwright happy-path login. - [ ] Playwright logout. ## Out of scope - MFA/step-up UX (later). - Federated IdPs beyond Zitadel (v0.2). ## References - `spec/03-architecture/03-identity-auth.md` §5. - `spec/08-roadmap-mvp.md` — step #10.

claude-desktop added this to the v0.1 milestone

claude-desktop added the

area:web

area:identity

type:user-story

labels

claude-desktop referenced this issue from a commit

2026-04-14 21:10:20 +00:00

feat(web): scaffold SvelteKit client

claude-desktop referenced this issue

2026-04-14 21:10:35 +00:00

feat(web): scaffold SvelteKit client #24