This repository has no description
2configs/omnigent: accept pocket-id logins without email_verified
author
lassulus
date
(Aug 13, 2026, 4:27 PM CEST)
commit
5cf875f8
5cf875f8e1bad2b0b2ddb22fef0a559a12b14142
parent
84ff3739
84ff3739d5c9d0a88bbd0b877d31c22a232d132a
+10
+10
2configs/omnigent.nix
+10
2configs/omnigent.nix
···
105
105
OMNIGENT_OIDC_REDIRECT_URI = "https://${domain}/auth/callback";
106
106
OMNIGENT_OIDC_LOGOUT_REDIRECT_URI = "https://${domain}/";
107
107
OMNIGENT_OIDC_ALLOWED_DOMAINS = "lassul.us";
108
+
# pocket-id emits `email` *and* `email_verified` in the id_token when the
109
+
# `email` scope is requested (which omnigent does), but the value of
110
+
# `email_verified` is the users.email_verified column, whose default comes
111
+
# from the app-config key `emailsVerified` — shipped as false. omnigent
112
+
# otherwise hard-rejects the login with "Could not determine user email
113
+
# from IdP". The gate exists for IdPs where a user can self-assert an
114
+
# arbitrary address; here users are provisioned by hand in pocket-id
115
+
# (signups are disabled) and the domain allowlist above still applies, so
116
+
# the marker carries no information for us.
117
+
OMNIGENT_OIDC_SKIP_EMAIL_VERIFICATION = "1";
108
118
OMNIGENT_ADMIN_LIST_PATH = "${admins}";
109
119
# The wheel checks PyPI for updates on every start otherwise.
110
120
OMNIGENT_NO_UPDATE_CHECK = "1";