Sign-in and session
Local sign-in
Username + password. Session token in sessionStorage → vion.token (~12 hours).
When VION_MULTI_TENANT is on, a Tenant field appears on the form; if empty, the default tenant is selected.
OIDC
GET /api/v1/auth/options → if oidc: true, “Sign in with OIDC” is shown.
Flow: GET /api/v1/auth/oidc/start (302) → IdP → return #token=.
If endSession is true, an IdP sign-out link (/api/v1/auth/oidc/logout) appears in the header.
Emergency access (break-glass)
When breakGlass: true, a small link under the form. TOTP yields a ~1 hour session (VION_BREAK_GLASS_*). An ISA-101 countdown band is shown.
Lockout
After VION_LOGIN_LOCKOUT_THRESHOLD (default 5) wrong passwords, the account locks; duration is VION_LOGIN_LOCKOUT_MINUTES (default 15). Unlock from Admin Users.
Profile and palette
- Header avatar → My profile (
PATCH /api/v1/auth/me, avatar) - Ctrl+K command palette: surface jump, Validate, Publish, Backup
- Selected surface
sessionStoragevion.surface - Light/dark theme (
vion-studio-theme)