Players sign in to the website, and admins to the admin panel, with an
OpenID Connect provider (DorkNet:SignIn:*). The first sign-in links the
provider identity (issuer + subject) to a DorkNet account with that
account's password; after that the provider sign-in is enough.
- Cookie sessions per host, keys persisted in the database so redeploys
keep people signed in; unlink, deletion or a ban ends the session.
- Link attempts limited to 5 failures per 15 minutes per identity and
per username.
- Admin panel: "Sign in with ..." exchanges the session for the usual
admin tokens via GET /api/admin/v1/sso (IsAdmin still required).
- Downloads: optional DorkNet:Downloads:RequireSignIn serves the
manifest and files only to signed-in players; the Downloads and Quest
pages offer sign-in instead.
- Website: sign-in in the header, /link and /account pages.
The game client's login is unchanged.
Review follow-ups:
- The downloads routes now answer only on the apex (the site's host) and 404
on every other accepted host, so the game's open API/CDN subdomains can't
serve the builds.
- Install on Quest passes its own file to the Quest page instead of always
picking the newest release.
- Waiting for the bucket's headers is limited to 30 s; the body still streams
without a limit.
- Dispose the upstream request message; use LINQ in FindFile.
When the server is pointed at the bucket CI publishes builds to
(DorkNet:Downloads:BaseUrl), the site lists them on a new Downloads page and
the Quest page offers "Latest build" next to "Choose file".
The server reads manifest.json and the files over HTTP on the internal network
and streams them through with Range support (DownloadsController); only files
the manifest lists are served. The xapk reader now reads from a byte source,
either the picked File or the server URL via Range requests, so the browser
installer streams the APK and OBB to the headset without downloading the
package first. Unset, both features stay hidden.
Alexa