Repository navigation
Add Telegram sign-in (0.5.2) - #50
Merged
Merged
Conversation
getTelegramOAuthUrl() starts a Telegram OpenID Connect login. The backend builds
the oauth.telegram.org URL, and the kit refuses it unless it carries exactly
this login's PKCE challenge (S256), the nonce <appId>.<loginNonce(secret)>,
the scope `openid profile` and response_type `code`. On the callback, a
telegram_grant is redeemed inside the attested enclave with the job
verify_telegram {code_verifier, login_secret}. The enclave derives the nonce
from the secret, so a stolen code is useless without it. The token it signs
(iss https://enclave.cavos.xyz/telegram) is bound and used like the GitHub one.
The modal gains a "Continue with Telegram" button behind the providers list.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Telegram sign-in, shaped like GitHub's. Publishes
@cavos/kit@0.5.2on merge.getTelegramOAuthUrl()/login('telegram'). The authorize URL is refused unless it ishttps://oauth.telegram.org/authwith exactly this login's PKCE challenge (S256), nonce<appId>.<loginNonce(secret)>, scopeopenid profileandresponse_type=code.telegram_grantis redeemed in the attested enclave withverify_telegram {code_verifier, login_secret}. The enclave derives the nonce from the secret, so a stolen code is useless without it.iss https://enclave.cavos.xyz/telegram) is wired into login binding, social recovery andproviderFromClaims.'telegram'is inproviders.Needs the recovery enclave release v2 (live) and cavos-web with cavos-labs/cavos#342 and #344 (live). No change to the attestation defaults: release v2 is verified through the signed release bundle.
Tested in production from the local demo with a packed tarball: Telegram login → enclave verification → wallet created.
npm test: 545 pass (24 new).