feat(web-ui): SSO login + web UI polish + docs#572
Merged
Conversation
- veadk frontend: optional --oauth2-user-pool / --oauth2-user-pool-client / --oauth2-redirect-uri flags wire VeIdentity OAuth2 (setup_oauth2); the API is protected while the SPA shell is served so the app can show its own login page. - frontend: identity.ts resolves the signed-in user via /oauth2/userinfo (sub), a LobeHub-style login page when unauthenticated, ADK user_id now comes from the SSO identity (url-encoded in API paths), sidebar shows the user + logout. No SSO configured falls back to web-user for local dev.
SSO providers: - veadk frontend: --oauth2-provider / --oauth2-provider-label flags; expose the configured provider(s) on GET /web/auth-config (unauthenticated). Exempt the SPA shell (/, /assets, /web/auth-config) from the OAuth2 middleware so the app loads and renders its own login page instead of being bounced to the IdP. - login page renders a button per configured provider; falls back to a single login button. UI polish: - messages (user + assistant) render Markdown (GFM + code highlight) at ~14px. - sidebar right border is now dashed. - motion-based entrance/press animations (honors prefers-reduced-motion). - tool-call block restyled to match the janus-ee extension (status dot, name, collapsible 参数/返回 sections). Allowlist veadk/webui (built minified bundle) from gitleaks scanning.
- Login page: config-driven provider buttons for SSO; a username input for the no-SSO case (the chosen name becomes the ADK user_id, stored locally). - veadk frontend: --oauth2-provider/-label and pool/client UID flags (default from OAUTH2_USER_POOL_ID / OAUTH2_USER_POOL_CLIENT_ID); exempt the SPA shell + /web/auth-config from the OAuth2 middleware so the app shows its own login page; local logout (no IdP post-logout redirect needed). - Sessions are created lazily on the first message (not on page load); the sidebar refreshes on new-chat/delete; a loading overlay shows while opening a session. - UI polish: Markdown messages, dashed sidebar border, motion animations, janus-ee-style tool blocks, a two-pane trace viewer (span tree + detail), and a persistent copy button on assistant messages. - Generic (non-A2UI) UI copy. - Fix: identity_client.get_user_pool passed `uid=` but the SDK request expects `user_pool_uid=` (broke SSO-by-UID). - Docs: web-ui Authentication section (zh/en).
…dev proxy - veadk frontend: --agents-dir defaults to "." so you launch from the parent folder of your agent directories (like `adk web`) and every agent.py app populates the dropdown. - frontend README rewritten as a general web UI (chat / sessions / tracing / auth), with A2UI as one feature rather than the focus. - vite dev proxy also forwards /oauth2, /web, /debug for SSO/trace in dev.
warm-wm
approved these changes
Jun 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Builds on the merged A2UI web UI (
veadk frontend) with SSO, a richer chat UI, and docs.SSO / auth
veadk frontend --oauth2-user-pool/-client(or--oauth2-*-uid, defaulting fromOAUTH2_USER_POOL_ID/OAUTH2_USER_POOL_CLIENT_ID). The OAuth2 middleware protects the API but exempts the SPA shell +/web/auth-config, so the app renders its own login page instead of bouncing to the IdP. Identity comes from/oauth2/userinfo(sub) and drives the ADKuser_id./web/auth-config(--oauth2-provider/--oauth2-provider-label; default label forveidentityis “火山引擎 Identity”).user_id.UX
Fix
identity_client.get_user_poolpasseduid=but the SDK request expectsuser_pool_uid=(broke SSO-by-UID).Docs
framework/frontend/web-uiAuthentication section (zh/en) + the new--oauth2-*flags.Notes
veadk/webui(gitleaks allowlists it).