small-software 0.7.0__tar.gz → 0.9.0__tar.gz

{small_software-0.7.0/small_software.egg-info → small_software-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: small-software
-Version: 0.7.0
+Version: 0.9.0
 Summary: A cloud for small software: deploy team apps to Railway in one command, private by default, shared by work email
 Author: RuslanKazyradzi13
 License-Expression: MIT
@@ -30,20 +30,23 @@ Dynamic: license-file
 
 [Русская версия](https://github.com/RuslanKazyradzi13/small-software/blob/main/small-cli/README.ru.md)
 
-`small` deploys small team apps to Railway in one command and protects them with sign-in by work email or
-personal invite links.
+`small` deploys small team apps to Railway in one command and protects them with sign-in by work account (Google,
+Microsoft), work email or personal invite links.
 
 ```
 small init my-service    # skeleton: invite-link protected server, small.json, .gitignore
 cd my-service
 small deploy             # → https://my-service-3f9a.up.railway.app
 small open               # open with the invite link
-small access add ivan@company.com   # sign-in by work email, like sharing a Google Doc
-small mail resend        # how sign-in emails are sent
+small access add ivan@company.com   # who may sign in, like sharing a Google Doc
+small sso google         # "Sign in with Google" (or small sso microsoft)
+small mail resend        # or sign-in links by email
+small access log         # who signed in, when and how
 small access add bob     # or a personal link for bob (small access revoke bob to revoke it)
 small notify telegram    # access requests to Telegram
 small env set DEBUG=1    # environment variable in Railway and small.json
 small db add postgres    # database, DATABASE_URL in the app
+small volume add         # persistent disk: files and sign-in state survive deploys
 small domain add app.example.com   # custom domain
 small sleep on           # sleep when idle (saves money)
 small logs -f            # app logs
@@ -316,7 +319,7 @@ share apps itself: *"Deploy this folder and give ivan@company.com access."*
 ## `small deploy`
 
 ```
-small deploy [folder] [--name NAME] [--workspace ID] [--port N] [-m MESSAGE] [--new] [--no-wait] [--timeout SEC]
+small deploy [folder] [--name NAME] [--workspace ID] [--port N] [-m MESSAGE] [--public] [--new] [--no-wait] [--timeout SEC]
 ```
 
 | Flag | What it does |
@@ -325,6 +328,7 @@ small deploy [folder] [--name NAME] [--workspace ID] [--port N] [-m MESSAGE] [--
 | `--workspace` | workspace ID if the account has several (or `RAILWAY_WORKSPACE_ID`) |
 | `--port` | port for the public domain if the app does not listen on `$PORT` |
 | `-m`, `--message` | deploy message shown in Railway |
+| `--public` | an app without sign-in of its own: deploy it open to anyone, without the gateway (see `small gateway`) |
 | `--new` | create a new project even if the folder has been deployed before |
 | `--no-wait` | print the URL right away without waiting for the build |
 | `--timeout` | how many seconds to wait for the build (default 900) |
@@ -332,6 +336,42 @@ small deploy [folder] [--name NAME] [--workspace ID] [--port N] [-m MESSAGE] [--
 Progress goes to stderr and the final URL to stdout: `URL=$(small deploy)`.
 Exit codes: `0` success, `1` error or failed build (the last log lines are printed), `130` interrupted.
 
+## `small gateway`: sign-in in front of any app
+
+```
+small gateway [on [--port N] | off [--yes]]          # no subcommand: the status
+```
+
+The gateway protects an app that has no sign-in of its own — any language, any framework, a Dockerfile — without
+changing its code. It is a second service in the app's Railway project, `<app>-gateway`: [Caddy](https://caddyserver.com)
+takes every request, and magic-link next to it decides who gets in (Google and Microsoft sign-on, email links, invite
+links, all `small access` / `small sso` / `small mail` settings). Requests it lets in go on to the app over Railway's
+private network; the app itself has no public address.
+
+- **Private by default.** The first `small deploy` of a folder without `magic_link.py` / `magic-link.js` sets the
+  gateway up before the app ever gets an address, and puts your own invite link in `small.json` (`small open`).
+  `small deploy --public` deploys such an app open to anyone instead; redeploying an app that is open prints a warning.
+- **`on`** for an app already deployed: creates the gateway, moves the sign-in variables to it, moves the address
+  (keeping its name), and restarts the app without a public address. The app must listen on `$PORT` (small sets it to
+  `8080` if it isn't set) or pass `--port`. A custom domain has to be removed first and added back after; it then
+  points to the gateway.
+- **Who is signed in.** The gateway adds `X-Small-User` (the address, or the invite-link name), `X-Small-Method`
+  (`email`, `google`, `microsoft`, `link`) and `X-Small-Auth`, an HMAC signature of both with `SMALL_GATEWAY_KEY`, which
+  the app gets as a Railway reference. Any `X-Small-*` header a visitor sends is dropped. magic-link in the app (0.9+)
+  trusts that signature and nothing else, so an app that keeps its own sign-in code works behind the gateway too.
+- **Websockets** go through the same check. For Streamlit this means an `HttpOnly` session cookie set by the gateway.
+- **Where things live.** Sign-in variables (`ACCESS_*`, `SESSION_SECRET`, `GOOGLE_*`, `MICROSOFT_*`,
+  `SESSIONS_REVOKED`…) belong to the gateway; mail and Telegram variables go to both; everything else stays the
+  app's. `small env`, `small access`, `small sso`, `small mail` and `small deploy` route them for you, and restart only
+  the service that changed.
+- **The rest follows:** `small access log` reads the gateway's log, `small logs --gateway` shows it, `small sleep`
+  puts both to sleep (the first request wakes both, a few seconds), `small domain` attaches to the gateway,
+  `small volume add --gateway` keeps sign-in state across the gateway's restarts, `small destroy` removes both.
+- **`small deploy`** also rebuilds the gateway when it was built by an older small.
+- **`off`** gives the address and the variables back to the app and deletes the gateway. If the app has no sign-in of
+  its own, small asks first (or `--yes`): without the gateway anyone with the address gets in.
+- **Cost:** one more small service. Caddy and the sign-in server idle at a few tens of MB; with sleep on, both sleep.
+
 ## After deploy
 
 These commands work in the folder of a deployed app, that is, where `.small.json` is. `link`, `open`, `logs` and
@@ -341,18 +381,23 @@ These commands work in the folder of a deployed app, that is, where `.small.json
 small link [folder] [--as NAME]                       # print the invite link
 small open [folder] [--as NAME]                       # the same + open it in the browser
 small access [list | add EMAIL|@DOMAIN|NAME | revoke EMAIL|NAME]   # who can sign in
+small access log [-n N] [--json]                   # who signed in, when and how
+small access signout EMAIL|@DOMAIN|--all           # end their sessions on all devices
+small sso [google [--client-id ID] | microsoft [--client-id ID] [--tenant T] | off [PROVIDER]]
 small mail [resend | smtp [--from FROM] [--to TO] | log | off]  # emails for sign-in by email
 small notify [telegram [--chat-id ID] | off]        # access requests to Telegram
 small env [list [--values] | set K=V ... | unset K ...] [--no-deploy]
 small db [list | add postgres | remove postgres [--yes]]
+small volume [add [--mount /data]] [--gateway]      # persistent disk; no argument shows the status
+small gateway [on [--port N] | off [--yes]]          # sign-in in front of any app (see above)
 small domain [list | add DOMAIN [--port N] | remove DOMAIN]
 small sleep [on | off]                              # sleep mode; no argument shows the status
-small logs [folder] [--build] [-n N] [-f]            # log of the latest deploy
+small logs [folder] [--build | --gateway] [-n N] [-f]  # log of the latest deploy
 small destroy [folder] [--yes]                       # remove from Railway
 ```
 
-Commands that change the app's variables (`access add` / `revoke`, `mail`, `notify`, `env set` / `unset`,
-`db add` / `remove`) and `sleep on` / `off` restart the app once. Add `--no-deploy` to skip the restart; the change
+Commands that change the app's variables (`access add` / `revoke` / `signout`, `sso`, `mail`, `notify`,
+`env set` / `unset`, `db add` / `remove`), `volume add` and `sleep on` / `off` restart the app once. Add `--no-deploy` to skip the restart; the change
 then takes effect on the next deploy.
 
 **`small link` / `small open`** build `https://<domain>/?token=<token>`.
@@ -365,15 +410,22 @@ then takes effect on the next deploy.
 
 **`small access`** controls who can open the app. There are two ways, and you can combine them.
 
-*By work email*, like sharing a Google Doc. This is the recommended way:
-- **`add ivan@company.com`** adds the address to `ACCESS_EMAILS`. Ivan opens the app, enters his email and gets a
-  message with a sign-in link: it works for 15 minutes and only once, and the browser remembers the sign-in for
-  30 days. Only someone who reads that mailbox can sign in, so passing the link on to someone else gives them
-  nothing.
+*By address*, like sharing a Google Doc. This is the recommended way:
+- **`add ivan@company.com`** adds the address to `ACCESS_EMAILS`. Ivan opens the app and proves the address is his:
+  with **Sign in with Google / Microsoft** (`small sso`), or by entering it and getting a sign-in link by email
+  (`small mail`) that works for 15 minutes and only once. The browser remembers the sign-in for 30 days. Passing a
+  link on gives nobody anything: only the owner of the mailbox or account gets in.
 - **`add @company.com`** lets in everyone with an address in that domain.
-- **`revoke ivan@company.com`** closes sign-in right after the restart, even in a browser that is already open.
-- The first `add` creates `SESSION_SECRET`, the key that signs links and sessions. Email sending must be set up:
-  `small mail`.
+- **`revoke ivan@company.com`** closes sign-in right after the restart, even in a browser that is already open. The
+  time also goes to `SESSIONS_REVOKED`, so if you add the address back later, the old sessions stay invalid.
+- **`signout ivan@company.com`** (or `@company.com`, or `--all`) ends the sessions on every device without taking
+  access away: for a lost laptop. People can do it themselves with **Sign out on all devices** if the app has a
+  volume (`small volume add`).
+- **`log`** prints who signed in, when, how (Google, Microsoft, email link, invite link) and from which IP, plus
+  refused sign-ins and access requests, across deploys: `magic_link` writes them as JSON log lines, and Railway
+  keeps them as long as your plan keeps logs. `--json` gives one object per line.
+- The first `add` creates `SESSION_SECRET`, the key that signs links and sessions. One way to sign in must be set up:
+  `small sso` or `small mail`.
 - `small` passes the address for links in emails to the app itself, in `PUBLIC_URL` (in Railway only): after the
   domain is renamed to `<name>.up.railway.app`, Railway keeps the old address in `RAILWAY_PUBLIC_DOMAIN`, and the
   links would lead to a 404. If you want links on your own domain, set `PUBLIC_URL` in `small.json`; `small` does
@@ -390,10 +442,26 @@ then takes effect on the next deploy.
   their access.
 
 - **`list`** shows who has access: addresses and names (tokens are hidden).
-- **Sign-in log.** Sign-ins show up in the log: `small logs | Select-String "signed in by"` (PowerShell; on
-  macOS/Linux use `grep`) → `signed in by email (ivan@company.com)` or `signed in by link (bob)`. With
-  `OWNER_LANG=ru` these lines are in Russian; search them with `Select-String`, not `findstr`, which reads the
-  argument and the text in different encodings and does not find Cyrillic.
+- **Sign-in log.** `small access log` (above). In the raw log (`small logs`) each sign-in is one JSON line, for
+  example `{"message": "[magic-link] signed in with Google: ivan@company.com, ip 203.0.113.7", "magic_link":
+  "sign_in", "method": "google", ...}`; Railway's log explorer filters them with `@magic_link:sign_in`.
+
+**`small sso`** sets up sign-in with a work account. Who may sign in is still the access list.
+- **`google`**: "Sign in with Google" for Google Workspace accounts and Gmail addresses. `small` prints what to do
+  in Google Cloud (about 5 minutes: an OAuth client of type Web application) and the exact redirect URI to register,
+  then asks for the client ID and secret (the secret from `GOOGLE_CLIENT_SECRET` or with hidden input).
+- **`microsoft`**: "Sign in with Microsoft" for the members of one Microsoft Entra organization. `small` prints the
+  steps (an app registration, single tenant, a client secret) and the redirect URI; `--tenant` takes the Directory
+  (tenant) ID or your domain (`company.com`), which `small` resolves to the ID.
+- **Checked before saving.** `small` shows the provider the client ID and secret; a wrong pair is refused and
+  nothing is saved.
+- **Which accounts count.** Google: verified Gmail addresses, or accounts of a Google Workspace organization; a
+  personal Google account registered with a company address is refused. Microsoft: members of your tenant only, not
+  guests and not other organizations. Details: [SECURITY.md](https://github.com/RuslanKazyradzi13/small-software/blob/main/SECURITY.md#threat-model).
+- **Redirect URI**: `https://<app>/_access/sso/callback`, or `https://<app>/` for `streamlit`. With your own domain,
+  set `PUBLIC_URL` in `small.json` first, and register that address.
+- If email sign-in isn't set up, the sign-in page shows only the provider buttons; with both, it shows both.
+- **`off [google|microsoft]`** turns one or both off; with no subcommand you get the status and the redirect URI.
 
 **`small mail`** sets how the app sends sign-in emails.
 - **`resend`** sends through [Resend](https://resend.com) over HTTPS. `small` takes the key from `RESEND_API_KEY`
@@ -444,6 +512,16 @@ then takes effect on the next deploy.
   status.
 - **`remove`** removes the domain.
 
+**`small volume`** gives the app a persistent disk (a Railway volume).
+- **`add`** creates one at `/data` (`--mount` for another path, outside `/app`) and restarts the app. The app can
+  keep files there; the path is in `RAILWAY_VOLUME_MOUNT_PATH`. With no subcommand you get the path and how much is
+  used.
+- **Sign-in state.** `magic_link` keeps it in `.magic-link.db` (SQLite) on the volume: used sign-in links stay used
+  after a restart, rate limits are shared by worker processes, and **Sign out on all devices** appears. Without a
+  volume this state lives in memory and a restart forgets it.
+- **Trade-off.** With a volume each deploy has a few seconds of downtime: two copies of the app can't share the disk.
+  A service has one volume.
+
 **`small sleep`** controls Railway's sleep mode (serverless).
 - **`on`**: with no incoming requests the app goes to sleep and uses no CPU or memory; the first request wakes it
   up in a few seconds. Handy for apps that are opened a couple of times a day.
@@ -461,7 +539,7 @@ then takes effect on the next deploy.
   that it disappears from Railway too.
 
 **`small logs`** shows the log of the latest deploy.
-- **Which log.** The app log by default, the build log with `--build`. `-n` sets the number of lines (default 100).
+- **Which log.** The app log by default, the build log with `--build`, the gateway's with `--gateway`. `-n` sets the number of lines (default 100).
 - **Follow mode.** `-f` appends new lines every 2 seconds; `Ctrl+C` exits.
 - **Format.** Every line is printed with its local time. Requests from the **Request access** button show up as
   `[access-request] ...`, and they are easy to filter: `small logs | findstr access-request`.
@@ -566,8 +644,9 @@ The tests start a local mock of the Railway API (GraphQL + the upload endpoint)
 deploy, repeat deploy, failed build, crash, taken domain, several workspaces, wrong token, ignore rules.
 
 Template tests on real frameworks are skipped if the framework is not installed; the rest pass.
-- `streamlit` tests: the access gate through `streamlit.testing.v1.AppTest` (personal tokens and sign-in by email:
-  form, one-time link, session cookie, revocation, sign out) and the server through `python app.py`.
+- `streamlit` tests: the access gate through `streamlit.testing.v1.AppTest` (personal tokens, sign-in by email:
+  form, one-time link, session cookie, revocation, sign out; sign-in with Google against a local provider, refusals,
+  sign out on all devices) and the server through `python app.py`.
 - 2 `fastapi` tests: `TestClient` and `uvicorn main:app` the way Railway runs it, plus a check that the token is
   hidden in the access log.
 
@@ -582,6 +661,11 @@ Dashboard buttons: the "Open via invite link" redirect and its protection agains
 token, with Railway and with Railway unavailable. Sleep mode and the cost estimate in the dashboard, Railway errors
 while computing the cost.
 
+`small sso`, `volume`, `access log` and `access signout` are tested against mocks of Railway, Google and Microsoft:
+the credential check, a wrong secret that saves nothing, resolving a domain to a tenant, the Streamlit and custom
+domain redirect URIs, old `magic_link` code, the volume and its mount path, the access log table, `--json` and the MCP
+tool, sign-outs by address, domain and `--all`, forgetting old sign-outs.
+
 `small sleep`, `db`, `domain` and `notify` are tested against mocks of Railway and the Telegram Bot API:
 - turning sleep on and off, turning it on again without requests, `--no-deploy`;
 - deploying the Postgres template with default values, the `DATABASE_URL` reference, a workflow error, removing
@@ -621,4 +705,5 @@ network, timeout, wrong token, garbage status, no token in the response):
 ## Limitations
 
 - Only the root `.gitignore`/`.railwayignore` are read; nested ones are ignored.
-- One service is created, in the `production` environment. Databases: Postgres only (`small db`).
+- One service is created (two with the gateway), in the `production` environment. Databases: Postgres only
+  (`small db`).

{small_software-0.7.0 → small_software-0.9.0}/README.md

@@ -2,20 +2,23 @@
 
 [Русская версия](https://github.com/RuslanKazyradzi13/small-software/blob/main/small-cli/README.ru.md)
 
-`small` deploys small team apps to Railway in one command and protects them with sign-in by work email or
-personal invite links.
+`small` deploys small team apps to Railway in one command and protects them with sign-in by work account (Google,
+Microsoft), work email or personal invite links.
 
 ```
 small init my-service    # skeleton: invite-link protected server, small.json, .gitignore
 cd my-service
 small deploy             # → https://my-service-3f9a.up.railway.app
 small open               # open with the invite link
-small access add ivan@company.com   # sign-in by work email, like sharing a Google Doc
-small mail resend        # how sign-in emails are sent
+small access add ivan@company.com   # who may sign in, like sharing a Google Doc
+small sso google         # "Sign in with Google" (or small sso microsoft)
+small mail resend        # or sign-in links by email
+small access log         # who signed in, when and how
 small access add bob     # or a personal link for bob (small access revoke bob to revoke it)
 small notify telegram    # access requests to Telegram
 small env set DEBUG=1    # environment variable in Railway and small.json
 small db add postgres    # database, DATABASE_URL in the app
+small volume add         # persistent disk: files and sign-in state survive deploys
 small domain add app.example.com   # custom domain
 small sleep on           # sleep when idle (saves money)
 small logs -f            # app logs
@@ -288,7 +291,7 @@ share apps itself: *"Deploy this folder and give ivan@company.com access."*
 ## `small deploy`
 
 ```
-small deploy [folder] [--name NAME] [--workspace ID] [--port N] [-m MESSAGE] [--new] [--no-wait] [--timeout SEC]
+small deploy [folder] [--name NAME] [--workspace ID] [--port N] [-m MESSAGE] [--public] [--new] [--no-wait] [--timeout SEC]
 ```
 
 | Flag | What it does |
@@ -297,6 +300,7 @@ small deploy [folder] [--name NAME] [--workspace ID] [--port N] [-m MESSAGE] [--
 | `--workspace` | workspace ID if the account has several (or `RAILWAY_WORKSPACE_ID`) |
 | `--port` | port for the public domain if the app does not listen on `$PORT` |
 | `-m`, `--message` | deploy message shown in Railway |
+| `--public` | an app without sign-in of its own: deploy it open to anyone, without the gateway (see `small gateway`) |
 | `--new` | create a new project even if the folder has been deployed before |
 | `--no-wait` | print the URL right away without waiting for the build |
 | `--timeout` | how many seconds to wait for the build (default 900) |
@@ -304,6 +308,42 @@ small deploy [folder] [--name NAME] [--workspace ID] [--port N] [-m MESSAGE] [--
 Progress goes to stderr and the final URL to stdout: `URL=$(small deploy)`.
 Exit codes: `0` success, `1` error or failed build (the last log lines are printed), `130` interrupted.
 
+## `small gateway`: sign-in in front of any app
+
+```
+small gateway [on [--port N] | off [--yes]]          # no subcommand: the status
+```
+
+The gateway protects an app that has no sign-in of its own — any language, any framework, a Dockerfile — without
+changing its code. It is a second service in the app's Railway project, `<app>-gateway`: [Caddy](https://caddyserver.com)
+takes every request, and magic-link next to it decides who gets in (Google and Microsoft sign-on, email links, invite
+links, all `small access` / `small sso` / `small mail` settings). Requests it lets in go on to the app over Railway's
+private network; the app itself has no public address.
+
+- **Private by default.** The first `small deploy` of a folder without `magic_link.py` / `magic-link.js` sets the
+  gateway up before the app ever gets an address, and puts your own invite link in `small.json` (`small open`).
+  `small deploy --public` deploys such an app open to anyone instead; redeploying an app that is open prints a warning.
+- **`on`** for an app already deployed: creates the gateway, moves the sign-in variables to it, moves the address
+  (keeping its name), and restarts the app without a public address. The app must listen on `$PORT` (small sets it to
+  `8080` if it isn't set) or pass `--port`. A custom domain has to be removed first and added back after; it then
+  points to the gateway.
+- **Who is signed in.** The gateway adds `X-Small-User` (the address, or the invite-link name), `X-Small-Method`
+  (`email`, `google`, `microsoft`, `link`) and `X-Small-Auth`, an HMAC signature of both with `SMALL_GATEWAY_KEY`, which
+  the app gets as a Railway reference. Any `X-Small-*` header a visitor sends is dropped. magic-link in the app (0.9+)
+  trusts that signature and nothing else, so an app that keeps its own sign-in code works behind the gateway too.
+- **Websockets** go through the same check. For Streamlit this means an `HttpOnly` session cookie set by the gateway.
+- **Where things live.** Sign-in variables (`ACCESS_*`, `SESSION_SECRET`, `GOOGLE_*`, `MICROSOFT_*`,
+  `SESSIONS_REVOKED`…) belong to the gateway; mail and Telegram variables go to both; everything else stays the
+  app's. `small env`, `small access`, `small sso`, `small mail` and `small deploy` route them for you, and restart only
+  the service that changed.
+- **The rest follows:** `small access log` reads the gateway's log, `small logs --gateway` shows it, `small sleep`
+  puts both to sleep (the first request wakes both, a few seconds), `small domain` attaches to the gateway,
+  `small volume add --gateway` keeps sign-in state across the gateway's restarts, `small destroy` removes both.
+- **`small deploy`** also rebuilds the gateway when it was built by an older small.
+- **`off`** gives the address and the variables back to the app and deletes the gateway. If the app has no sign-in of
+  its own, small asks first (or `--yes`): without the gateway anyone with the address gets in.
+- **Cost:** one more small service. Caddy and the sign-in server idle at a few tens of MB; with sleep on, both sleep.
+
 ## After deploy
 
 These commands work in the folder of a deployed app, that is, where `.small.json` is. `link`, `open`, `logs` and
@@ -313,18 +353,23 @@ These commands work in the folder of a deployed app, that is, where `.small.json
 small link [folder] [--as NAME]                       # print the invite link
 small open [folder] [--as NAME]                       # the same + open it in the browser
 small access [list | add EMAIL|@DOMAIN|NAME | revoke EMAIL|NAME]   # who can sign in
+small access log [-n N] [--json]                   # who signed in, when and how
+small access signout EMAIL|@DOMAIN|--all           # end their sessions on all devices
+small sso [google [--client-id ID] | microsoft [--client-id ID] [--tenant T] | off [PROVIDER]]
 small mail [resend | smtp [--from FROM] [--to TO] | log | off]  # emails for sign-in by email
 small notify [telegram [--chat-id ID] | off]        # access requests to Telegram
 small env [list [--values] | set K=V ... | unset K ...] [--no-deploy]
 small db [list | add postgres | remove postgres [--yes]]
+small volume [add [--mount /data]] [--gateway]      # persistent disk; no argument shows the status
+small gateway [on [--port N] | off [--yes]]          # sign-in in front of any app (see above)
 small domain [list | add DOMAIN [--port N] | remove DOMAIN]
 small sleep [on | off]                              # sleep mode; no argument shows the status
-small logs [folder] [--build] [-n N] [-f]            # log of the latest deploy
+small logs [folder] [--build | --gateway] [-n N] [-f]  # log of the latest deploy
 small destroy [folder] [--yes]                       # remove from Railway
 ```
 
-Commands that change the app's variables (`access add` / `revoke`, `mail`, `notify`, `env set` / `unset`,
-`db add` / `remove`) and `sleep on` / `off` restart the app once. Add `--no-deploy` to skip the restart; the change
+Commands that change the app's variables (`access add` / `revoke` / `signout`, `sso`, `mail`, `notify`,
+`env set` / `unset`, `db add` / `remove`), `volume add` and `sleep on` / `off` restart the app once. Add `--no-deploy` to skip the restart; the change
 then takes effect on the next deploy.
 
 **`small link` / `small open`** build `https://<domain>/?token=<token>`.
@@ -337,15 +382,22 @@ then takes effect on the next deploy.
 
 **`small access`** controls who can open the app. There are two ways, and you can combine them.
 
-*By work email*, like sharing a Google Doc. This is the recommended way:
-- **`add ivan@company.com`** adds the address to `ACCESS_EMAILS`. Ivan opens the app, enters his email and gets a
-  message with a sign-in link: it works for 15 minutes and only once, and the browser remembers the sign-in for
-  30 days. Only someone who reads that mailbox can sign in, so passing the link on to someone else gives them
-  nothing.
+*By address*, like sharing a Google Doc. This is the recommended way:
+- **`add ivan@company.com`** adds the address to `ACCESS_EMAILS`. Ivan opens the app and proves the address is his:
+  with **Sign in with Google / Microsoft** (`small sso`), or by entering it and getting a sign-in link by email
+  (`small mail`) that works for 15 minutes and only once. The browser remembers the sign-in for 30 days. Passing a
+  link on gives nobody anything: only the owner of the mailbox or account gets in.
 - **`add @company.com`** lets in everyone with an address in that domain.
-- **`revoke ivan@company.com`** closes sign-in right after the restart, even in a browser that is already open.
-- The first `add` creates `SESSION_SECRET`, the key that signs links and sessions. Email sending must be set up:
-  `small mail`.
+- **`revoke ivan@company.com`** closes sign-in right after the restart, even in a browser that is already open. The
+  time also goes to `SESSIONS_REVOKED`, so if you add the address back later, the old sessions stay invalid.
+- **`signout ivan@company.com`** (or `@company.com`, or `--all`) ends the sessions on every device without taking
+  access away: for a lost laptop. People can do it themselves with **Sign out on all devices** if the app has a
+  volume (`small volume add`).
+- **`log`** prints who signed in, when, how (Google, Microsoft, email link, invite link) and from which IP, plus
+  refused sign-ins and access requests, across deploys: `magic_link` writes them as JSON log lines, and Railway
+  keeps them as long as your plan keeps logs. `--json` gives one object per line.
+- The first `add` creates `SESSION_SECRET`, the key that signs links and sessions. One way to sign in must be set up:
+  `small sso` or `small mail`.
 - `small` passes the address for links in emails to the app itself, in `PUBLIC_URL` (in Railway only): after the
   domain is renamed to `<name>.up.railway.app`, Railway keeps the old address in `RAILWAY_PUBLIC_DOMAIN`, and the
   links would lead to a 404. If you want links on your own domain, set `PUBLIC_URL` in `small.json`; `small` does
@@ -362,10 +414,26 @@ then takes effect on the next deploy.
   their access.
 
 - **`list`** shows who has access: addresses and names (tokens are hidden).
-- **Sign-in log.** Sign-ins show up in the log: `small logs | Select-String "signed in by"` (PowerShell; on
-  macOS/Linux use `grep`) → `signed in by email (ivan@company.com)` or `signed in by link (bob)`. With
-  `OWNER_LANG=ru` these lines are in Russian; search them with `Select-String`, not `findstr`, which reads the
-  argument and the text in different encodings and does not find Cyrillic.
+- **Sign-in log.** `small access log` (above). In the raw log (`small logs`) each sign-in is one JSON line, for
+  example `{"message": "[magic-link] signed in with Google: ivan@company.com, ip 203.0.113.7", "magic_link":
+  "sign_in", "method": "google", ...}`; Railway's log explorer filters them with `@magic_link:sign_in`.
+
+**`small sso`** sets up sign-in with a work account. Who may sign in is still the access list.
+- **`google`**: "Sign in with Google" for Google Workspace accounts and Gmail addresses. `small` prints what to do
+  in Google Cloud (about 5 minutes: an OAuth client of type Web application) and the exact redirect URI to register,
+  then asks for the client ID and secret (the secret from `GOOGLE_CLIENT_SECRET` or with hidden input).
+- **`microsoft`**: "Sign in with Microsoft" for the members of one Microsoft Entra organization. `small` prints the
+  steps (an app registration, single tenant, a client secret) and the redirect URI; `--tenant` takes the Directory
+  (tenant) ID or your domain (`company.com`), which `small` resolves to the ID.
+- **Checked before saving.** `small` shows the provider the client ID and secret; a wrong pair is refused and
+  nothing is saved.
+- **Which accounts count.** Google: verified Gmail addresses, or accounts of a Google Workspace organization; a
+  personal Google account registered with a company address is refused. Microsoft: members of your tenant only, not
+  guests and not other organizations. Details: [SECURITY.md](https://github.com/RuslanKazyradzi13/small-software/blob/main/SECURITY.md#threat-model).
+- **Redirect URI**: `https://<app>/_access/sso/callback`, or `https://<app>/` for `streamlit`. With your own domain,
+  set `PUBLIC_URL` in `small.json` first, and register that address.
+- If email sign-in isn't set up, the sign-in page shows only the provider buttons; with both, it shows both.
+- **`off [google|microsoft]`** turns one or both off; with no subcommand you get the status and the redirect URI.
 
 **`small mail`** sets how the app sends sign-in emails.
 - **`resend`** sends through [Resend](https://resend.com) over HTTPS. `small` takes the key from `RESEND_API_KEY`
@@ -416,6 +484,16 @@ then takes effect on the next deploy.
   status.
 - **`remove`** removes the domain.
 
+**`small volume`** gives the app a persistent disk (a Railway volume).
+- **`add`** creates one at `/data` (`--mount` for another path, outside `/app`) and restarts the app. The app can
+  keep files there; the path is in `RAILWAY_VOLUME_MOUNT_PATH`. With no subcommand you get the path and how much is
+  used.
+- **Sign-in state.** `magic_link` keeps it in `.magic-link.db` (SQLite) on the volume: used sign-in links stay used
+  after a restart, rate limits are shared by worker processes, and **Sign out on all devices** appears. Without a
+  volume this state lives in memory and a restart forgets it.
+- **Trade-off.** With a volume each deploy has a few seconds of downtime: two copies of the app can't share the disk.
+  A service has one volume.
+
 **`small sleep`** controls Railway's sleep mode (serverless).
 - **`on`**: with no incoming requests the app goes to sleep and uses no CPU or memory; the first request wakes it
   up in a few seconds. Handy for apps that are opened a couple of times a day.
@@ -433,7 +511,7 @@ then takes effect on the next deploy.
   that it disappears from Railway too.
 
 **`small logs`** shows the log of the latest deploy.
-- **Which log.** The app log by default, the build log with `--build`. `-n` sets the number of lines (default 100).
+- **Which log.** The app log by default, the build log with `--build`, the gateway's with `--gateway`. `-n` sets the number of lines (default 100).
 - **Follow mode.** `-f` appends new lines every 2 seconds; `Ctrl+C` exits.
 - **Format.** Every line is printed with its local time. Requests from the **Request access** button show up as
   `[access-request] ...`, and they are easy to filter: `small logs | findstr access-request`.
@@ -538,8 +616,9 @@ The tests start a local mock of the Railway API (GraphQL + the upload endpoint)
 deploy, repeat deploy, failed build, crash, taken domain, several workspaces, wrong token, ignore rules.
 
 Template tests on real frameworks are skipped if the framework is not installed; the rest pass.
-- `streamlit` tests: the access gate through `streamlit.testing.v1.AppTest` (personal tokens and sign-in by email:
-  form, one-time link, session cookie, revocation, sign out) and the server through `python app.py`.
+- `streamlit` tests: the access gate through `streamlit.testing.v1.AppTest` (personal tokens, sign-in by email:
+  form, one-time link, session cookie, revocation, sign out; sign-in with Google against a local provider, refusals,
+  sign out on all devices) and the server through `python app.py`.
 - 2 `fastapi` tests: `TestClient` and `uvicorn main:app` the way Railway runs it, plus a check that the token is
   hidden in the access log.
 
@@ -554,6 +633,11 @@ Dashboard buttons: the "Open via invite link" redirect and its protection agains
 token, with Railway and with Railway unavailable. Sleep mode and the cost estimate in the dashboard, Railway errors
 while computing the cost.
 
+`small sso`, `volume`, `access log` and `access signout` are tested against mocks of Railway, Google and Microsoft:
+the credential check, a wrong secret that saves nothing, resolving a domain to a tenant, the Streamlit and custom
+domain redirect URIs, old `magic_link` code, the volume and its mount path, the access log table, `--json` and the MCP
+tool, sign-outs by address, domain and `--all`, forgetting old sign-outs.
+
 `small sleep`, `db`, `domain` and `notify` are tested against mocks of Railway and the Telegram Bot API:
 - turning sleep on and off, turning it on again without requests, `--no-deploy`;
 - deploying the Postgres template with default values, the `DATABASE_URL` reference, a workflow error, removing
@@ -593,4 +677,5 @@ network, timeout, wrong token, garbage status, no token in the response):
 ## Limitations
 
 - Only the root `.gitignore`/`.railwayignore` are read; nested ones are ignored.
-- One service is created, in the `production` environment. Databases: Postgres only (`small db`).
+- One service is created (two with the gateway), in the `production` environment. Databases: Postgres only
+  (`small db`).

{small_software-0.7.0 → small_software-0.9.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "small-software"
-version = "0.7.0"
+version = "0.9.0"
 description = "A cloud for small software: deploy team apps to Railway in one command, private by default, shared by work email"
 license = "MIT"
 license-files = ["LICENSE"]

small_software-0.9.0/small_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.9.0"

{small_software-0.7.0 → small_software-0.9.0}/small_cli/access.py

@@ -9,6 +9,7 @@ import re
 import secrets
 from urllib.parse import quote
 
+from . import gateway
 from .config import CONFIG_FILE, load_config
 from .i18n import tr
 from .railway import Railway, RailwayError, token_from_env
@@ -18,6 +19,12 @@ NAME_RE = re.compile(r"[A-Za-z0-9_.@-]{1,40}\Z")
 EMAIL_RE = re.compile(r"[^@\s,;<>\"']+@[^@\s,;<>\"']+\.[^@\s,;<>\"']+\Z")
 DOMAIN_RE = re.compile(r"@[^@\s,;<>\"']+\.[^@\s,;<>\"']+\Z")
 MAIL_VARS = ("RESEND_API_KEY", "SMTP_URL", "LOGIN_LINKS_TO_LOG")
+# Single sign-on: a provider is on when all of its variables are set (small sso google / small sso microsoft).
+SSO_VARS = {"google": ("GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"),
+            "microsoft": ("MICROSOFT_CLIENT_ID", "MICROSOFT_CLIENT_SECRET", "MICROSOFT_TENANT_ID")}
+SSO_NAMES = {"google": "Google", "microsoft": "Microsoft"}
+SSO_CALLBACK = "/_access/sso/callback"
+SESSION_DAYS = 30  # how long a sign-in lasts in magic_link: older sign-out times can be forgotten
 
 
 def parse(value):
@@ -54,13 +61,19 @@ def parse_emails(value):
 
 
 def app_env(root, state, warn=None):
-    """(app variables, where each one comes from): Railway, overlaid with non-empty values from small.json."""
+    """(app variables, where each one comes from): Railway, overlaid with non-empty values from small.json. Behind the
+    gateway, the sign-in variables come from the gateway's service."""
     env, sources = {}, {}
     linked = all(state.get(k) for k in ("projectId", "environmentId", "serviceId"))
     if linked and token_from_env():
         try:
-            env = dict(Railway(token_from_env()).service_variables(
-                state["projectId"], state["environmentId"], state["serviceId"]))
+            api = Railway(token_from_env())
+            env = dict(api.service_variables(state["projectId"], state["environmentId"], state["serviceId"]))
+            if gateway.is_on(state):
+                for name in gateway.GATEWAY_ONLY:
+                    env.pop(name, None)
+                ours = api.service_variables(state["projectId"], state["environmentId"], state["gateway"]["serviceId"])
+                env.update({k: v for k, v in ours.items() if k in gateway.GATEWAY_ONLY + gateway.SHARED})
             sources = dict.fromkeys(env, "Railway")
         except RailwayError as e:
             if warn:
@@ -95,11 +108,85 @@ def invite_link(domain, token):
     return url + "?token=" + quote(token, safe="") if token else url
 
 
-def email_login_problem(root):
+def sso_enabled(env):
+    """Single sign-on providers set up in the app's variables, in button order: ["google", "microsoft"] or fewer."""
+    return [provider for provider, names in SSO_VARS.items() if all(env.get(name) for name in names)]
+
+
+def is_streamlit(root):
+    app = root / "app.py"
+    return app.is_file() and "streamlit" in app.read_text(encoding="utf-8", errors="replace")
+
+
+def app_url(root, state):
+    """The app's public address: PUBLIC_URL from small.json (your own domain), else the Railway domain, else None."""
+    custom = load_config(root / CONFIG_FILE)["env"].get("PUBLIC_URL", "").strip().rstrip("/")
+    if custom:
+        return custom
+    return "https://" + state["domain"] if state.get("domain") else None
+
+
+def redirect_uri(root, state):
+    """Where Google and Microsoft send people back after sign-in: /_access/sso/callback, or the page itself for
+    Streamlit without the gateway (it can't serve other paths). None until the app has an address."""
+    base = app_url(root, state)
+    if base is None:
+        return None
+    return base + "/" if is_streamlit(root) and not gateway.is_on(state) else base + SSO_CALLBACK
+
+
+def parse_revoked(value):
+    """SESSIONS_REVOKED "ivan@company.com=1760000000, *=1760000100" -> {"ivan@company.com": 1760000000, "*": ...}."""
+    found = {}
+    for item in (value or "").split(","):
+        who, _, moment = item.strip().lower().rpartition("=")
+        who = who.strip()
+        if (who == "*" or is_email(who)) and moment.strip().isdigit():
+            found[who] = max(found.get(who, 0), int(moment))
+    return found
+
+
+def add_revoked(value, who, now):
+    """SESSIONS_REVOKED with `who` (an address, @domain or *) signed out at `now`. Sign-outs older than a session's
+    lifetime are dropped: every session they could end has expired anyway."""
+    entries = parse_revoked(value)
+    entries[who.lower()] = int(now)
+    keep = sorted((w, t) for w, t in entries.items() if t > now - SESSION_DAYS * 24 * 3600)
+    return ", ".join("%s=%d" % pair for pair in keep)
+
+
+def feature_problem(root, state=None):
+    """None if the app's code knows sign-in with Google and Microsoft and signing out (small 0.8), or the gateway
+    does it for the app; otherwise what is in the way and how to fix it."""
+    if gateway.is_on(state or {}):
+        return None
+    streamlit = is_streamlit(root)
+    if streamlit and "sso_finish" not in (root / "app.py").read_text(encoding="utf-8", errors="replace"):
+        return (tr("app.py is from a streamlit template older than small 0.8, without sign-in with Google and "
+                   "Microsoft. Take require_access() from the new app.py, and magic_link.py next to it: %s",
+                   "app.py — из шаблона streamlit старше small 0.8, без входа через Google и Microsoft. Возьмите "
+                   "require_access() из нового app.py и magic_link.py рядом с ним: %s") % (TEMPLATES_DIR / "streamlit"))
+    for name, template in (("magic_link.py", "streamlit" if streamlit else "python-http"),
+                           ("magic-link.js", "node-http")):
+        path = root / name
+        if path.is_file():
+            if "SESSIONS_REVOKED" in path.read_text(encoding="utf-8", errors="replace"):
+                return None
+            return (tr("%s in the app is older than small 0.8: it knows neither sign-in with Google and Microsoft nor "
+                       "signing out. Replace it with the new one: %s",
+                       "%s в приложении старше small 0.8: не знает ни входа через Google и Microsoft, ни выхода "
+                       "на всех устройствах. Замените его новым: %s") % (name, TEMPLATES_DIR / template / name))
+    return None  # no magic_link next to the code: the app may keep it elsewhere, as for email sign-in
+
+
+def email_login_problem(root, state=None):
     """None if the app code supports sign-in by email; otherwise, what is in the way and how to fix it.
 
     Streamlit cannot be wrapped in middleware: there sign-in by email is done by require_access() in app.py via
-    MagicLinkGate from magic_link.py, so new versions of both files are needed."""
+    MagicLinkGate from magic_link.py, so new versions of both files are needed. Behind the gateway the app's code
+    doesn't matter: the gateway signs people in."""
+    if gateway.is_on(state or {}):
+        return None
     app = root / "app.py"
     source = app.read_text(encoding="utf-8", errors="replace") if app.is_file() else ""
     streamlit = "streamlit" in source