capauth 0.3.12__tar.gz → 0.3.13__tar.gz

{capauth-0.3.12 → capauth-0.3.13}/.github/workflows/ci.yml

@@ -37,11 +37,16 @@ jobs:
       # `import skcapstone` succeeds without it while
       # `from skcapstone.coordination import Board` does not. --no-deps means we
       # have to name it ourselves.
+      # skcapstone requires Python 3.11+, capauth supports 3.10: on 3.10 the
+      # integration tests skip (pytest.importorskip); on 3.11+ the import is
+      # asserted here so those tests can never skip silently.
       - name: Install skcapstone (optional integration backbone) from source
+        if: matrix.python-version != '3.10'
         run: |
           pip install --no-deps --no-cache-dir \
             "skcapstone @ git+https://github.com/smilinTux/skcapstone" \
             "skcoord @ git+https://github.com/smilinTux/skcoord"
+          python -c "from skcapstone.scheduler_jobs import load_jobs_with_dropins"
       - name: Run tests with coverage
         run: python -m pytest tests/ -v --tb=short --cov=capauth --cov-report=xml --cov-report=term-missing
       - name: Upload coverage

capauth-0.3.13/.github/workflows/image.yml

@@ -0,0 +1,90 @@
+name: Container image
+
+# Publishes the CapAuth service image (the OIDC IdP and verify service) for a
+# release tag as ghcr.io/smilintux/capauth:<version>, and records its digest.
+# Consumers pin <version>@sha256:<digest> (SKStacks sksso.CAPAUTH_IMAGE refuses
+# anything else). A published version is never overwritten.
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing release tag to (re)build if its image is missing, e.g. v0.3.13"
+        required: true
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: image-${{ inputs.tag || github.ref }}
+  cancel-in-progress: false
+
+env:
+  IMAGE: ghcr.io/smilintux/capauth
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+          fetch-depth: 0
+          fetch-tags: true
+      - name: Resolve the version and refuse a tag that is not on main
+        id: v
+        env:
+          TAG: ${{ inputs.tag || github.ref_name }}
+        run: |
+          set -euo pipefail
+          case "$TAG" in v[0-9]*.[0-9]*.[0-9]*) ;; *) echo "::error::not a release tag: $TAG"; exit 1 ;; esac
+          version="${TAG#v}"
+          if ! [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::not a release version: $version"; exit 1
+          fi
+          git fetch --no-tags origin main:refs/remotes/origin/main
+          sha="$(git rev-parse "refs/tags/$TAG^{commit}")"
+          git merge-base --is-ancestor "$sha" refs/remotes/origin/main || {
+            echo "::error::$TAG ($sha) is not on main"; exit 1; }
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
+      - name: Log in to ghcr.io
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: echo "$TOKEN" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+      - name: Refuse to overwrite a published version
+        run: |
+          if docker manifest inspect "$IMAGE:${{ steps.v.outputs.version }}" >/dev/null 2>&1; then
+            echo "::error::$IMAGE:${{ steps.v.outputs.version }} already exists; versions are immutable"
+            exit 1
+          fi
+      - name: Build
+        run: |
+          docker build \
+            --build-arg CAPAUTH_VERSION="${{ steps.v.outputs.version }}" \
+            --label org.opencontainers.image.source="https://github.com/${{ github.repository }}" \
+            --label org.opencontainers.image.revision="${{ steps.v.outputs.sha }}" \
+            --label org.opencontainers.image.version="${{ steps.v.outputs.version }}" \
+            -t "$IMAGE:${{ steps.v.outputs.version }}" .
+      - name: Smoke test (version, service answers)
+        run: |
+          set -euo pipefail
+          v="${{ steps.v.outputs.version }}"
+          docker run --rm "$IMAGE:$v" capauth --version | tee /dev/stderr | grep -F "$v"
+          docker run -d --name smoke -p 18420:8420 "$IMAGE:$v"
+          for i in $(seq 1 30); do
+            curl -fsS http://127.0.0.1:18420/capauth/v1/status >/dev/null && break
+            sleep 2
+          done
+          curl -fsS http://127.0.0.1:18420/capauth/v1/status >/dev/null
+          docker rm -f smoke
+      - name: Push and record the digest
+        run: |
+          set -euo pipefail
+          v="${{ steps.v.outputs.version }}"
+          docker push "$IMAGE:$v"
+          ref="$(docker inspect --format '{{index .RepoDigests 0}}' "$IMAGE:$v")"
+          echo "Pinned reference: \`$IMAGE:$v@${ref#*@}\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "pinned: $IMAGE:$v@${ref#*@}"

{capauth-0.3.12 → capauth-0.3.13}/CHANGELOG.md

@@ -6,6 +6,37 @@ All notable changes to `capauth` are documented here. The format is based on
 
 ## [Unreleased]
 
+- Release tags (`v*`) now also publish the service image
+  `ghcr.io/smilintux/capauth:<version>` (`.github/workflows/image.yml`): the
+  tag must be on main, a published version is never overwritten, the image is
+  smoke-tested (`capauth --version`, `/capauth/v1/status`) before the push,
+  and the job summary records the digest to pin (`<version>@sha256:...`).
+
+- `capauth sign-challenge`: reads the CapAuth login challenge from the
+  clipboard (or `--stdin`), refuses anything that is not a complete
+  `CAPAUTH_NONCE_V1`/`V2` challenge, signs it with gpg (gpg-agent's pinentry
+  asks for the passphrase; the tool never handles it) and puts the armored
+  signature back on the clipboard (or `--stdout`), printing only
+  `signed, paste it now`. Key: `--key`, `$CAPAUTH_SIGN_KEY`, or the profile.
+  The OIDC login page gains a "Paste signature and continue" button, names
+  the command in its steps and remembers the fingerprint of the last manual
+  login, so a repeat login is copy, sign, paste. Docs: `docs/SIGN_CHALLENGE.md`.
+
+- Service image builds from a plain checkout again: the Dockerfile takes
+  `--build-arg CAPAUTH_VERSION=<version>` (default `0.0.0+docker`) for
+  setuptools-scm, because `.dockerignore` keeps `.git` out of the context.
+
+- OIDC IdP: a static client may set `require_nonce: false` so stock
+  Authentik's OAuth source, which never sends an OIDC `nonce`, can use the
+  authorization code flow. State, PKCE S256 and the confidential client secret
+  stay mandatory; the default is unchanged (nonce required), and a nonce that
+  is sent must still be well formed.
+
+- CI: green on main again. `ruff format` (pinned 0.15.4) applied to
+  `tests/test_backup_fallback.py`; the Python 3.10 job no longer installs
+  skcapstone (it requires 3.11+), and the skcapstone integration tests skip
+  there while 3.11+ asserts the import so they cannot skip silently.
+
 - Raise operator proof absolute and idle ceilings to 24 hours while keeping
   access capabilities bounded to five minutes (card `4af0ae7f`).
 

{capauth-0.3.12 → capauth-0.3.13}/Dockerfile

@@ -16,6 +16,10 @@ COPY src/ ./src/
 # resolves these relative to the package root → /app/phone-signer.
 COPY phone-signer/ ./phone-signer/
 
+# The build context has no .git (.dockerignore), so setuptools-scm cannot
+# derive a version: pass one with --build-arg CAPAUTH_VERSION=<version>.
+ARG CAPAUTH_VERSION=0.0.0+docker
+ENV SETUPTOOLS_SCM_PRETEND_VERSION=${CAPAUTH_VERSION}
 RUN pip install --no-cache-dir -e ".[service]"
 RUN pip install --no-cache-dir python-multipart>=0.0.6
 

{capauth-0.3.12/src/capauth.egg-info → capauth-0.3.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: capauth
-Version: 0.3.12
+Version: 0.3.13
 Summary: Capability-based Authentication — decentralized, PGP-based identity and authorization
 Author-email: smilinTux <admin@smilintux.org>
 License: GPL-3.0-or-later
@@ -254,6 +254,7 @@ capauth pqc-report                           # live PQC posture per surface
 
 # Auth & integration
 capauth login <service_url> [--no-claims]    # passwordless PGP login (caches OIDC token)
+capauth sign-challenge                        # sign the copied browser login challenge, paste the result
 capauth setup forgejo --capauth-url <url>    # generate Forgejo OIDC app.ini block
 
 # Mesh & membership
@@ -294,6 +295,7 @@ rides in the payload `event` field so routing stays severity-based.
 | **[Integration Blueprint](docs/INTEGRATION_BLUEPRINT.md)** | third-party integration guide |
 | **[Cold-Machine Bootstrap & DR](docs/COLD_MACHINE_BOOTSTRAP_AND_DR.md)** | standing capauth back up on a blank box + disaster recovery: the restore-not-regenerate rule, the ordered restore chain, and the operator checklist |
 | **[authentik-capauth](docs/authentik-capauth.md)** | the custom Authentik image with the CapAuth PGP stage baked in — build (`AK_VERSION`, version-agnostic venv install, frontend rebuild), SKStacks deploy + `lifecycle.migrate` override, and the four build/migrate gotchas |
+| **[Sign a login: copy, sign, paste](docs/SIGN_CHALLENGE.md)** | `capauth sign-challenge`: the four-step browser login with your gpg key, one-time setup, desktop shortcut |
 | **[AI Advocate](AI-ADVOCATE.md)** | how AI advocates manage a sovereign profile on your behalf |
 
 ## Why it matters

{capauth-0.3.12 → capauth-0.3.13}/README.md

@@ -191,6 +191,7 @@ capauth pqc-report                           # live PQC posture per surface
 
 # Auth & integration
 capauth login <service_url> [--no-claims]    # passwordless PGP login (caches OIDC token)
+capauth sign-challenge                        # sign the copied browser login challenge, paste the result
 capauth setup forgejo --capauth-url <url>    # generate Forgejo OIDC app.ini block
 
 # Mesh & membership
@@ -231,6 +232,7 @@ rides in the payload `event` field so routing stays severity-based.
 | **[Integration Blueprint](docs/INTEGRATION_BLUEPRINT.md)** | third-party integration guide |
 | **[Cold-Machine Bootstrap & DR](docs/COLD_MACHINE_BOOTSTRAP_AND_DR.md)** | standing capauth back up on a blank box + disaster recovery: the restore-not-regenerate rule, the ordered restore chain, and the operator checklist |
 | **[authentik-capauth](docs/authentik-capauth.md)** | the custom Authentik image with the CapAuth PGP stage baked in — build (`AK_VERSION`, version-agnostic venv install, frontend rebuild), SKStacks deploy + `lifecycle.migrate` override, and the four build/migrate gotchas |
+| **[Sign a login: copy, sign, paste](docs/SIGN_CHALLENGE.md)** | `capauth sign-challenge`: the four-step browser login with your gpg key, one-time setup, desktop shortcut |
 | **[AI Advocate](AI-ADVOCATE.md)** | how AI advocates manage a sovereign profile on your behalf |
 
 ## Why it matters

{capauth-0.3.12 → capauth-0.3.13}/docs/CAPAUTH_OIDC_IDP.md

@@ -175,10 +175,17 @@ Add an entry to your CapAuth client registry for Authentik:
   "client_secret": "<long-random-secret>",
   "redirect_uris": ["https://<authentik-host>/source/oauth/callback/capauth/"],
   "name": "Authentik",
-  "scopes": ["openid", "profile", "email", "groups"]
+  "scopes": ["openid", "profile", "email", "groups"],
+  "require_nonce": false
 }
 ```
 
+`require_nonce: false` is needed because Authentik's OAuth source never sends
+an OIDC `nonce` (checked against Authentik 2025.12). Without it `/oidc/authorize`
+answers `400 invalid_nonce`. The flow stays bound by `state`, PKCE S256 and the
+client secret. Set the source's **PKCE** field to **S256** (Authentik 2025.2+;
+older Authentik has no source PKCE and cannot use this IdP).
+
 > The redirect URI Authentik uses for an OAuth source is
 > `https://<authentik-host>/source/oauth/callback/<source-slug>/`. If you name
 > the source slug `capauth`, the URI is the one above. Confirm the exact value

capauth-0.3.13/docs/SIGN_CHALLENGE.md

@@ -0,0 +1,80 @@
+# Signing a CapAuth login: copy, sign, paste
+
+`capauth sign-challenge` is the simple way to log in with your PGP key when an
+application (for example skmesh, through Authentik) offers "Sign in with
+CapAuth". You never type a key, a fingerprint (after the first time) or a gpg
+command.
+
+## The four steps
+
+1. On the login page click **Sign in with CapAuth** (the button next to the
+   normal username and password form). You land on the CapAuth page; open
+   "Other sign-in and recovery options" if it is closed.
+2. Click **Copy message**. (The first time only: type your key's fingerprint
+   into the fingerprint box first. The page remembers it in this browser, so
+   next time the section is already open with a fresh message.)
+3. Run **`capauth sign-challenge`** in a terminal, or press your desktop
+   shortcut (below). gpg shows its own passphrase window; type the key's
+   passphrase there. The terminal prints `signed, paste it now`.
+4. Click **Paste signature and continue** (or paste into the box with Ctrl+V
+   and click Verify & Continue). You are logged in.
+
+The message you copy is only valid for a few minutes. If it expired, reload
+the page and start again at step 2.
+
+## What the command does, and what it does not
+
+- Reads the copied text from the clipboard (Wayland `wl-paste`, X11 `xclip`
+  or `xsel`, macOS `pbpaste`), or from stdin with `--stdin`.
+- Refuses anything that is not a complete CapAuth login challenge
+  (`CAPAUTH_NONCE_V1` or `CAPAUTH_NONCE_V2` with every field in order). It
+  never signs arbitrary clipboard text.
+- Signs with `gpg --armor --detach-sign --local-user <key>`. The passphrase
+  goes from you to gpg-agent's pinentry dialog; the command never sees,
+  stores or prints it.
+- Puts the ASCII-armored signature on the clipboard (or prints it with
+  `--stdout`) and prints only `signed, paste it now`.
+
+Which key: `--key <fingerprint>`, else `$CAPAUTH_SIGN_KEY`, else the key of
+your CapAuth profile (`capauth profile show`).
+
+## One-time setup
+
+1. Install capauth (`pip install capauth`) and a clipboard tool
+   (`sudo apt install wl-clipboard` on Wayland, `xclip` on X11).
+2. gpg must hold the private key. A CapAuth profile keeps it in
+   `<CapAuth home>/identity/private.asc` (home: `~/.skcapstone/capauth`, or
+   `capauth --home`). Import it once; gpg asks for its passphrase in the
+   pinentry window and keeps it protected with that passphrase:
+
+   ```bash
+   gpg --import ~/.skcapstone/capauth/identity/private.asc
+   ```
+
+   This is a second protected copy of the key (in `~/.gnupg`). If the key's
+   passphrase is ever changed, change it in gpg too (`gpg --edit-key <fp>`,
+   then `passwd`), or delete the gpg copy and import again.
+3. The key must be enrolled and approved in CapAuth and linked to your user
+   (the admin does the approval and the link; you send them your **public**
+   key: `capauth export-pubkey`).
+
+### Desktop shortcut
+
+Bind a keyboard shortcut (GNOME: Settings, Keyboard, Custom Shortcuts;
+Cinnamon and KDE have the same) to:
+
+```bash
+capauth sign-challenge
+```
+
+gpg-agent needs a graphical pinentry for this (`pinentry-gnome3` or
+`pinentry-qt`, the default on desktop installs). Then the flow is: Copy
+message, shortcut, passphrase window, Paste signature and continue.
+
+## Later upgrade: sign on the phone
+
+The CapAuth Bunker phone signer ([CAPAUTH_BUNKER_REMOTE_SIGNER.md](CAPAUTH_BUNKER_REMOTE_SIGNER.md))
+keeps the key on your phone and signs by scanning a QR code ("Sign from
+another device (QR)" on the same page). It needs the `/bunker/` routes and a
+relay configured on the server side, so it is a follow-up to this copy and
+paste flow.

{capauth-0.3.12 → capauth-0.3.13}/scripts/capauth-backup.sh

@@ -152,8 +152,16 @@ backup_keystore() {
                 # Online backup: consistent snapshot of a live DB, source untouched.
                 sqlite3 "$DB_PATH" ".backup '$dst'"
             else
-                warn "sqlite3 not found; falling back to cp (best-effort consistency)"
-                cp -p "$DB_PATH" "$dst"
+                log "sqlite3 CLI not found; using Python SQLite online backup"
+                python3 - "$DB_PATH" "$dst" <<'PY'
+import sqlite3
+import sys
+
+source, destination = sys.argv[1:]
+with sqlite3.connect(f"file:{source}?mode=ro", uri=True) as live:
+    with sqlite3.connect(destination) as backup:
+        live.backup(backup)
+PY
             fi
             chmod 600 "$dst"
             manifest "keys.db: source=$DB_PATH bytes=$(stat -c%s "$dst" 2>/dev/null || stat -f%z "$dst") sha256=$(sha "$dst")"

{capauth-0.3.12 → capauth-0.3.13}/src/capauth/cli.py

@@ -646,6 +646,47 @@ def export_pubkey(ctx: click.Context, output: Optional[str]) -> None:
         raise SystemExit(1)
 
 
+@main.command("sign-challenge")
+@click.option(
+    "--key",
+    default=None,
+    help="Fingerprint to sign with (default: $CAPAUTH_SIGN_KEY, then your CapAuth profile).",
+)
+@click.option("--stdin", "from_stdin", is_flag=True, help="Read the challenge from stdin.")
+@click.option("--stdout", "to_stdout", is_flag=True, help="Print the signature instead.")
+@click.pass_context
+def sign_challenge_cmd(
+    ctx: click.Context, key: Optional[str], from_stdin: bool, to_stdout: bool
+) -> None:
+    """Sign the CapAuth login challenge on the clipboard.
+
+    On the login page click "Copy message", run this, then paste: the
+    signature replaces the challenge on the clipboard. gpg-agent asks for the
+    key's passphrase in its own dialog; this command never sees it.
+    """
+    from .sign_challenge import (
+        ChallengeError,
+        normalize_challenge,
+        read_clipboard,
+        resolve_key,
+        write_clipboard,
+    )
+    from .sign_challenge import sign as gpg_sign
+
+    try:
+        fp = resolve_key(key, ctx.obj.get("home"))
+        text = click.get_text_stream("stdin").read() if from_stdin else read_clipboard()
+        signature = gpg_sign(normalize_challenge(text), fp)
+        if to_stdout:
+            click.echo(signature, nl=False)
+        else:
+            write_clipboard(signature)
+            click.echo("signed, paste it now")
+    except ChallengeError as exc:
+        click.echo(f"Error: {exc}", err=True)
+        raise SystemExit(1)
+
+
 @main.command("verify")
 @click.option(
     "--pubkey",

{capauth-0.3.12 → capauth-0.3.13}/src/capauth/service/oidc/clients.py

@@ -17,10 +17,16 @@ Each client entry:
       "client_secret": "change-me",
       "redirect_uris": ["https://authentik.example/source/oauth/callback/capauth/"],
       "name": "Authentik",
-      "scopes": ["openid", "profile", "email", "groups"]
+      "scopes": ["openid", "profile", "email", "groups"],
+      "require_nonce": true
     }
 
 ``redirect_uris`` is matched EXACTLY (no wildcard) per OAuth2 security guidance.
+
+``require_nonce`` (default true) may be set to false for a relying party that
+never sends an OIDC ``nonce``, such as stock Authentik's OAuth source. The code
+flow stays bound by state, PKCE S256 and the confidential client secret; a
+nonce that is sent must still be well formed and is echoed in the ID token.
 """
 
 from __future__ import annotations
@@ -44,6 +50,7 @@ class OIDCClient:
     redirect_uris: list[str]
     name: str = ""
     scopes: list[str] = field(default_factory=lambda: list(DEFAULT_SCOPES))
+    require_nonce: bool = True
 
     def redirect_uri_allowed(self, redirect_uri: str) -> bool:
         """Return True if *redirect_uri* exactly matches a registered URI."""
@@ -93,6 +100,7 @@ class ClientRegistry:
             redirect_uris=list(entry.get("redirect_uris", [])),
             name=entry.get("name", entry["client_id"]),
             scopes=list(entry.get("scopes", DEFAULT_SCOPES)),
+            require_nonce=entry.get("require_nonce", True) is not False,
         )
 
     # ------------------------------------------------------------------

{capauth-0.3.12 → capauth-0.3.13}/src/capauth/service/oidc/provider.py

@@ -162,7 +162,7 @@ _LOGIN_PAGE = """<!DOCTYPE html>
 <head>
   <meta charset="UTF-8"/>
   <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
-  <title>CapAuth — Sign in with PGP</title>
+  <title>CapAuth: Sign in with PGP</title>
   <style>
     *{{box-sizing:border-box;margin:0;padding:0}}
     body{{font-family:'Segoe UI',system-ui,sans-serif;background:#0f0f1a;color:#e2e8f0;
@@ -212,7 +212,7 @@ _LOGIN_PAGE = """<!DOCTYPE html>
   <details id="manual-pgp">
   <summary>Other sign-in and recovery options</summary>
   <p class="sub" style="font-size:.74rem;margin:.6rem 0">The text below is the message to sign. It is not a signature. Paste only a fresh ASCII-armored PGP signature into the signature box.</p>
-  <div class="step">1 — Your PGP fingerprint</div>
+  <div class="step">1 - Your PGP fingerprint (remembered after the first login)</div>
   <label for="fp">Fingerprint (40- or 64-hex chars)</label>
   <input id="fp" type="text" maxlength="64" placeholder="ABCDEF0123..." autocomplete="off"/>
 
@@ -220,9 +220,13 @@ _LOGIN_PAGE = """<!DOCTYPE html>
   <div class="nonce-box" id="nonce">Enter your fingerprint to load the complete signed payload.</div>
   <button class="copy" type="button" onclick="copyPayload()">Copy message</button>
 
-  <div class="step">3 - Paste your signed message or detached signature</div>
-  <label for="sig">Signed message / signature (ASCII armor)</label>
-  <textarea id="sig" placeholder="-----BEGIN PGP MESSAGE-----&#10;...&#10;-----END PGP MESSAGE-----"></textarea>
+  <div class="step">3 - Sign it: run <code>capauth sign-challenge</code> on your computer</div>
+  <p class="sub" style="font-size:.74rem;margin:.2rem 0 .8rem">It signs the copied message with your key (gpg asks for your passphrase in its own window) and puts the signature on the clipboard.</p>
+
+  <div class="step">4 - Paste the signature</div>
+  <button class="copy" type="button" onclick="pasteAndSubmit()">Paste signature and continue</button>
+  <label for="sig">or paste it here yourself (ASCII armor)</label>
+  <textarea id="sig" placeholder="-----BEGIN PGP SIGNATURE-----&#10;...&#10;-----END PGP SIGNATURE-----"></textarea>
 
   <p class="sub">This fingerprint must already have an approved CapAuth enrollment.</p>
 
@@ -236,7 +240,7 @@ _LOGIN_PAGE = """<!DOCTYPE html>
   </div>
 
   <p style="margin-top:1rem;font-size:.74rem;color:#475569">
-    Manual GPG: copy the complete message, then use <code>gpg --armor --sign</code> for an inline signed message
+    Without the capauth tool: copy the complete message, then use <code>gpg --armor --sign</code> for an inline signed message
     or <code>gpg --armor --detach-sign</code> for a detached signature. The browser extension can sign automatically.
   </p>
   </details>
@@ -282,7 +286,7 @@ refreshBrowserAuth();
 async function passkeyLogin(){{
   document.getElementById("err").style.display="none";
   if(!window.capauthWebAuthn || !window.capauthWebAuthn.available()){{
-    return setErr("This browser has no passkey support — use PGP above.");
+    return setErr("This browser has no passkey support. Use PGP below.");
   }}
   try{{
     const redirect = await window.capauthWebAuthn.login(BASE, REQUEST_ID);
@@ -321,14 +325,14 @@ document.getElementById("fp").addEventListener("blur", async function(){{
       "service="+ch.service, "expires="+ch.expires].join("\\n");
     document.getElementById("nonce").textContent=currentPayload;
     // window.capauth provider: auto-sign with Tier B origin-binding. The
-    // extension injects origin=window.location.origin and signs in-extension —
+    // extension injects origin=window.location.origin and signs in-extension -
     // the private key never reaches this page. Falls back to manual paste.
     if(window.capauth && window.capauth.isCapAuth){{
       try{{
         const res=await window.capauth.signChallenge(ch);
         document.getElementById("sig").value=res.signature;
         submitSig();
-      }}catch(e){{ /* denied/locked — leave the paste flow available */ }}
+      }}catch(e){{ /* denied/locked: leave the paste flow available */ }}
     }}
   }}catch(e){{ document.getElementById("nonce").textContent="Error: "+e.message; }}
 }});
@@ -338,7 +342,7 @@ async function submitSig(){{
   const fp=document.getElementById("fp").value.trim().toUpperCase().replace(/\\s/g,"");
   const sig=document.getElementById("sig").value.trim();
   if(![40,64].includes(fp.length)) return setErr("Fingerprint must be 40- or 64-hex characters.");
-  if(!currentNonce) return setErr("No challenge loaded — tab out of the fingerprint field first.");
+  if(!currentNonce) return setErr("No challenge loaded. Enter your fingerprint first.");
   if(!sig) return setErr("Paste your PGP signature.");
 
   const body={{request_id:REQUEST_ID, fingerprint:fp, nonce:currentNonce,
@@ -347,9 +351,33 @@ async function submitSig(){{
     method:"POST", headers:{{"Content-Type":"application/json"}}, body: JSON.stringify(body)
   }});
   if(!r.ok){{ const b=await r.json().catch(()=>({{}})); return setErr(b.detail || b.error || "Login failed."); }}
+  try{{ localStorage.setItem("capauth_manual_fp",fp); }}catch(e){{}}
   const d=await r.json();
   window.location.href=d.redirect_to;
 }}
+
+async function pasteAndSubmit(){{
+  document.getElementById("err").style.display="none";
+  let text="";
+  try{{ text=await navigator.clipboard.readText(); }}
+  catch(e){{ return setErr("This browser did not allow reading the clipboard. Paste the signature into the box (Ctrl+V), then click Verify & Continue."); }}
+  if(!/BEGIN PGP (SIGNATURE|MESSAGE)/.test(text)){{
+    return setErr("The clipboard holds no signature yet. Click Copy message, run capauth sign-challenge, then try again.");
+  }}
+  document.getElementById("sig").value=text.trim();
+  submitSig();
+}}
+
+// the fingerprint of the last successful manual login: open this section
+// with a fresh challenge loaded, so the next login is copy, sign, paste
+(function(){{
+  let fp="";
+  try{{ fp=(localStorage.getItem("capauth_manual_fp")||"").trim(); }}catch(e){{}}
+  if(![40,64].includes(fp.length)||!/^[0-9A-F]+$/.test(fp)) return;
+  document.getElementById("fp").value=fp;
+  document.getElementById("manual-pgp").open=true;
+  document.getElementById("fp").dispatchEvent(new Event("blur"));
+}})();
 </script>
 </body>
 </html>
@@ -1067,7 +1095,7 @@ def build_oidc_router(
             raise HTTPException(status_code=400, detail="invalid_code_challenge")
         if not (_OPAQUE_MIN_LENGTH <= len(state) <= 512):
             raise HTTPException(status_code=400, detail="invalid_state")
-        if not (_OPAQUE_MIN_LENGTH <= len(nonce) <= 512):
+        if (nonce or client.require_nonce) and not (_OPAQUE_MIN_LENGTH <= len(nonce) <= 512):
             raise HTTPException(status_code=400, detail="invalid_nonce")
         scopes = scope.split()
         if (