The Codex
NetworkShared

Shared SSO

Terra Infinity hub owns Google OAuth; satellites consume one-time codes. Never invent a second OAuth app on Athens.

Shared SSO is the constellation's auth model — Network (ops), not fiction. Under Social Media Science Fiction the sign-in door is a real socket: Google lives on the Terra Infinity hub; The Codex is a satellite client.

Never invent a second Google OAuth app on Athens. Login CTAs on this wiki send visitors through the hub.

Hub

  • Hub: www.terrainfinity.ca
  • Bare apex terrainfinity.ca normalizes to www.
  • Hub owns Google OAuth. This wiki has no AUTH_GOOGLE_* of its own.

Satellite flow

Satellites are consumers, not IdPs:

  1. Satellite /api/sso/login → hub /api/sso/start?returnTo=…
  2. Hub issues a one-time code after Google sign-in
  3. Satellite /api/sso/consume establishes a local session

Do not steal the hub's /api/auth/*. Wiki routes stay under /api/sso/*.

Cookie domain (implementation reality, not lore)

Host classCookie Domain
*.terrainfinity.caDomain=.terrainfinity.ca is allowed
*.cyber-athens.ca (including this wiki on Athens)Host-only, or .cyber-athens.ca — never .terrainfinity.ca
Localhost / previewHost-only

Athens cookies must not leak onto the TI parent. TI cookies must not be set from an Athens host.

Expected satellites (when wired)

Wiki dual hosts, blog, me/c sites, radio, Media Empire, disclaimer sites, and future TI-gated properties. See Domain Registry for the locked host list.

Glåüm at glaum.ca may join later. Do not document it as already SSO-linked.

Moop Club is out of wiki universe and is not a satellite here.

What this page is not

  • Not a claim that every listed host is live-wired today.
  • Not a license to publish secrets, client IDs, or staging URLs.
  • Not Owner biography — that is C.
  • Not a second identity provider for Cyber Athens.

Not yet recorded

Per-satellite wiring checklist beyond this wiki; Glåüm auth decision; hub allowlist confirmation for both wiki origins in production.

See also

Related