Sign in to continue

REQUEST LIFECYCLE

Application flows

Sign-in and authenticated dashboard flows Google sign-in returns to the server, which validates OAuth state, verifies the account email against the local user store, and issues a signed session cookie. The cookie authorizes dashboard pages and API requests. 01 / GOOGLE SIGN-IN Browser /auth/google Google account consent OAuth callback state + code check Verify identity email matches user Signed session cookie + redirect 02 / AUTHENTICATED DASHBOARD Browser session cookie Auth guard requireAuth() Protected routes pages + /api/* Dashboard sanitized data

Only verified Google emails matching a local user receive a signed session.

SYSTEM OVERVIEW

Solution architecture

MCP Uni Hubs solution architecture The browser connects to the Node.js web server. The server uses Google for OAuth and calls the application runtime, which bootstraps configuration, the local JSON datastore, plugins, and the in-memory hub registry. CLIENT Browser login + dashboard APPLICATION Node.js web server OAuth · session · routes src/web-server.js HTTPS IDENTITY PROVIDER Google OAuth / OIDC verified account email BOOTSTRAPPED AT STARTUP Application runtime config · plugins · hub registry src/app-runtime.js Local JSON datastore data/ + config/ users · app configuration

Plugins are loaded during bootstrap; Google handles identity, while application data stays in the local datastore.