plausible_ce_oidc

# plausible_ce_oidc

OIDC authorization-code login for [Plausible Community Edition](https://github.com/plausible/analytics) v2.1.4.

CE does not load auth plugins at runtime. Add this package to the Plausible `mix.exs` and name it from the router, then build with `MIX_ENV=ce`.

From the root of a Plausible CE v2.1.4 checkout:

```bash
git apply path/to/plausible_ce_oidc/priv/plausible-v2.1.4.patch
```

[`priv/plausible-v2.1.4.patch`](priv/plausible-v2.1.4.patch) ships with this package. It adds this dependency and the router lines below. The dependency is the Hex package, so the checkout can live anywhere.

```elixir
{:plausible_ce_oidc, "~> 0.1.0", only: [:ce, :ce_dev, :ce_test]}
```

```elixir
plug(PlausibleCeOidc.FirstLaunchPlug, redirect_to: "/register")
plug PlausibleCeOidc.LoginPlug

get "/auth/oidc", PlausibleCeOidc.Controller, :start, alias: false
get "/auth/oidc/callback", PlausibleCeOidc.Controller, :callback, alias: false
```

`LoginPlug` goes after `PlausibleWeb.AuthPlug`. `FirstLaunchPlug` replaces `PlausibleWeb.FirstLaunchPlug` so the OAuth callback is not redirected to `/register` on an empty database. `alias: false` is required because those routes sit inside `scope "/", PlausibleWeb`. Without it Phoenix looks up `PlausibleWeb.PlausibleCeOidc.Controller` and `/auth/oidc` returns 500. The patch does not mount the UI under a path. `PlausibleCeOidc.ScriptNamePlug` can prefix root-relative `href`, `action`, and `Location` values with the `BASE_URL` path when a host inserts it. A path mount also needs the LiveView socket to keep that path, and a click handler for links LiveView redraws as `/sites/new`. Those edits stay with the host.

Set `OIDC_ISSUER_URL`, `OIDC_CLIENT_ID`, `OIDC_CLIENT_SECRET`, and `OIDC_REDIRECT_URI`. Leave any of them empty and CE email login stays in place. The email claim is the Plausible address. `sub` is the PDS DID. Login fails when the email claim is missing. A previous `{handle}@users.support.test` account is moved onto that address. A `picture` claim is stored under `PLAUSIBLE_OIDC_AVATAR_DIR` (default `/var/lib/plausible/oidc-avatars`) and served from `/avatar/:hash`.

`/login?password=1` keeps the email form. `/js/script.js` and `/api/event` are not in the browser pipeline.

## Publish

```bash
pnpm run package:plausible-ce-oidc
HEX_API_KEY="$(op read 'op://FileOrbit/FileOrbit/add more/HEX_PM_API_KEY')" pnpm run publish:plausible-ce-oidc
```

## License

GNU Affero General Public License v3.0 or any later version, the same terms as Plausible Community Edition. See [LICENSE.md](LICENSE.md).