# Chirp web quickstart

This local Rust app completes a real Authorization Code + PKCE login. It uses
`openidconnect` 4.0.1 to verify the ID token, check the UserInfo subject matches,
and display only your app-specific subject. It stores no tokens or user records and creates no persistent app
session. It binds to loopback only.

1. Install Rust with Cargo, then open https://signin.chirpauth.com/dashboard.
   Sign in with email or a passkey, or choose **Create an account with a passkey**.
   Save the account ID and recovery codes when prompted.
2. Register an app with redirect URI `http://127.0.0.1:4178/auth/cb`.
3. In this directory, copy `.env.example` to `.env` and replace
   `CHIRP_CLIENT_ID` with the ID shown in the dashboard. Leave the issuer as-is.
4. Run `cargo run --locked`, open `http://127.0.0.1:4178`, and click
   **Sign in with Chirp**. A successful callback displays `OIDC verified` and
   the app-specific `sub`.
5. Refresh the callback: it must fail, because the browser transaction and code
   are single-use. Return to `/` to start a new login.
6. When finished, open the app in the dashboard, type its client ID, and choose
   **Permanently retire app**. Retirement cannot be undone. If recent sign-in
   is required, sign out of Chirp from your account page and sign in again.
   Once all your apps are retired and any subscription cancelled, use
   **Delete your account** on the account page if you want to leave Chirp.

The example binds state, nonce, and a PKCE verifier to an HttpOnly, SameSite=Lax
browser cookie for ten minutes. It rejects callbacks from another browser,
expired/replayed transactions, mismatched issuer/state, and invalid ID tokens.
The SDK is configured to accept Chirp's explicit `chirp-id+jwt` JOSE type.
Signature, algorithm, issuer, audience, expiry, and nonce checks remain enabled.
No client secret is needed for the public client. Email is not an app identifier.

For production, serve HTTPS with Secure cookies, create your own app session
after validation, and put expiring transactions in storage shared by your app
instances. Chirp session revocation or app retirement prevents future Chirp
authentication; it does not clear an existing session maintained by your app.
Use your own session expiry and logout policy. From Chirp account management,
choose **Export your account** to download current account data before deletion.
The export page explains coverage and exclusions.

Reference: https://docs.rs/openidconnect/4.0.1/openidconnect/ .

Ordinary human grants include an opaque access token valid only for `GET` or
`POST /userinfo` with an Authorization bearer header. UserInfo returns only
`sub`; it exposes no email or cross-app identifier. The token expires with the
ID token and stops working when the app is retired or account deletion begins.
It does not authorize Chirp control or resource APIs.

Dependency auditing: run `cargo audit --file Cargo.lock` from this directory.
The local audit policy excepts only RUSTSEC-2023-0071: this example uses RSA
public keys for signature verification and holds no RSA private key or
signing/decryption capability. Reassess the exception before adding either.