docs(readme): zero-code 모드를 운영자 관점으로 명확화 + consumer-backend 요구 명시 - #84
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
요약
README.md/README.en.mdline 9의 "별도 백엔드 코드가 필요 없습니다(zero-code 모드)" 문구를 명확화authorizationCode를 중계·교환하는 얇은 consumer 백엔드(예: Supabase Edge Function)가 여전히 필요하고, 클라이언트에서/oidc/token을 직접 호출하지 않음을 명시https://docs.aitc.dev/guides/oidc-bridge)로 deep-link 추가README.en.md(영어 미러)에 동일한 내용을 대응 영문으로 함께 적용배경
기존 문구는 "미니앱 개발자도 백엔드가 필요 없다"로 읽힐 수 있어 보안상 오해를 유발했습니다. 실제로
/oidc/token직접 호출은client_secret노출 위험이 있으며, public-client 경우에도 consumer 백엔드(Edge Function 등)를 통한 중계가 올바른 패턴입니다. audit #110에서 식별된 misleading 항목입니다.Refs #110