Auth.js OIDC only reads ID-token claims by default; Authelia puts
email on UserInfo. Set idToken:false, harden claim extraction, and
document an optional Authelia claims_policy.
The SSO button required NEXT_PUBLIC_AUTH_OIDC_ENABLED, which is baked
at build time and silently fails under Docker runtime env. Drive the
login button from server-side AUTH_OIDC_* instead, and document IdP
redirect URI + AUTH_URL setup.
Co-authored-by: Cursor Agent <[email protected]>
Add docker-build and next build jobs so Dockerfile/image failures fail
CI. Expand unit coverage for exporters/Zod and integration coverage for
search, MCT import, backup, and token revoke.
Co-authored-by: Cursor Agent <[email protected]>
Add Next.js app with SQLite/Drizzle storage for sites and LF/HF tag
dumps, multi-user Auth.js (credentials + optional OIDC), personal API
tokens in Settings, versioned /api/v1 for UI and future CLI use,
MCT/Proxmark/JSON import-export, PWA offline shell, Vitest tests, and
GitHub Actions CI.
Co-authored-by: Cursor Agent <[email protected]>
Cursor Agent