timescale.info
Sign inSign up

How OpenChronology was built

Every merged pull request of openchronology/timeline-app, its first week of commits and its releases; and before them the 2020 PureScript editor, from snapshots of its deleted repositories in the Wayback Machine. Written to this server through the HTTP API.

327 moments · 2020-03-09T00:15:08Z CE – 2026-11-02T20:11:21Z CE · by @athan · @athan

#302 · A sign-in provider can be turned off without removing its credentials

  • timeline-app
  • pull request
  • security

Closes #301. - `OAUTH_ _ENABLED` for `GOOGLE`, `GITHUB`, `FACEBOOK` and `MICROSOFT`: `false`, `0`, `no` or `off` leaves the provider out of `providersFromEnv` even though its ID and secret are set, and its other settings aren't checked. Unset, empty, `true`, `1`, `yes` or `on` keep it; any other value stops the server at start-up. - A provider left out has no button, and starting or completing a sign-in or link with it is refused, as for an unconfigured one. Accounts that already linked it still see it under Sign-in methods and can unlink it. - Documented in `docs/authentication.md`, `.env.example`, `compose.yml` and the packaged `openchronology.env`, which now also lists `OAUTH_FACEBOOK_GRAPH_VERSION`. For timescale.info: `OAUTH_FACEBOOK_ENABLED=false` until Meta's business verification is done. Tests: `test/auth.test.mjs` covers off, on, half-configured-but-off and invalid values. `npm test` passes apart from the README-contents check, which only fails locally on agent worktrees.

Sources

Open #302 · A sign-in provider can be turned off without removing its credentials in the timeline