### Example Output of Migration Status

Source: https://github.com/kaktaknet/discourse-vkid-oauth/blob/main/MIGRATION_GUIDE.md

This is an example of the expected output after all users have been successfully migrated to the VK ID provider.

```text
VK ID Migration Status
============================================================
Old provider (vkontakte): 0 users
New provider (vkid):      1523 users

✅ Migration complete! All users have been migrated to vkid.
```

--------------------------------

### Install and Rebuild Discourse Application

Source: https://context7.com/kaktaknet/discourse-vkid-oauth/llms.txt

These commands are used to install the VK ID OAuth plugin by editing the Discourse container configuration and then rebuilding the application. After installation, configure the plugin settings in the Discourse admin panel.

```bash
# Installation commands
cd /var/discourse
nano containers/app.yml  # Add plugin git clone
./launcher rebuild app   # Rebuild container with plugin

# Post-installation: Configure in Admin -> Settings -> Login
# - vkid_enabled: true
# - vkid_client_id: <your-app-id>
# - vkid_client_secret: <your-secret>
# - vkid_scope: vkid.personal_info email phone
```

--------------------------------

### Example Output of Bulk Migration Task

Source: https://github.com/kaktaknet/discourse-vkid-oauth/blob/main/MIGRATION_GUIDE.md

This is an example of the output when running the bulk user migration rake task, showing the number of users processed.

```text
Starting VK ID migration...
============================================================
Found 1523 users to migrate.

..................................................
..................................................
(continues...)

============================================================
Migration completed!
✅ Successfully migrated: 1523 users
```

--------------------------------

### VK ID Application Setup and Redirect URI

Source: https://context7.com/kaktaknet/discourse-vkid-oauth/llms.txt

Instructions for configuring the VK ID application on id.vk.ru, including the correct redirect URI format for Discourse and required OAuth scopes.

```bash
# Redirect URI format for VK ID Console
https://your-discourse-site.com/auth/vkid/callback

# Required OAuth scopes
vkid.personal_info  # Required - basic profile info
email               # Recommended - user email address
phone               # Optional - phone number

# VK ID API endpoints used by the plugin
Authorization: https://id.vk.ru/authorize
Token Exchange: https://id.vk.ru/oauth2/auth
User Info: https://id.vk.ru/oauth2/user_info
```

--------------------------------

### Install Discourse Plugin via Git Clone

Source: https://github.com/kaktaknet/discourse-vkid-oauth/blob/main/README.md

Add this hook to your app.yml to clone the plugin repository during container build. Ensure the path is correct for your Discourse installation.

```yaml
- git clone https://github.com/kaktaknet/discourse-vkid-oauth.git
```

--------------------------------

### Discourse Plugin Git Repository

Source: https://github.com/kaktaknet/discourse-vkid-oauth/blob/main/README.md

Alternative method to specify the plugin's Git repository for installation. Use this if the previous method has issues.

```bash
git@github.com:kaktaknet/discourse-vkid-oauth.git
```

--------------------------------

### Update Discourse Plugin via Git

Source: https://github.com/kaktaknet/discourse-vkid-oauth/blob/main/MIGRATION_GUIDE.md

If the plugin is installed via git, pull the latest changes to update to the newest version. Ensure you are in the correct directory.

```bash
cd /var/discourse
./launcher enter app
cd plugins/discourse-vk-auth
git pull
exit
```

--------------------------------

### Run Test Suite

Source: https://github.com/kaktaknet/discourse-vkid-oauth/blob/main/README.md

Execute the test suite to verify plugin functionality. This covers PKCE, user migration, and OAuth flow integration.

```bash
bundle exec rspec
```

--------------------------------

### Perform Bulk User Migration with Rake Task

Source: https://github.com/kaktaknet/discourse-vkid-oauth/blob/main/MIGRATION_GUIDE.md

Execute this rake task to migrate all existing users from the old VKontakte provider to the new VK ID provider in a single operation. Requires console access.

```ruby
cd /var/discourse
./launcher enter app
rake vkid:migrate_users
```

--------------------------------

### Configure Redirect URI

Source: https://github.com/kaktaknet/discourse-vkid-oauth/blob/main/README.md

Ensure this redirect URI matches your VK app settings to resolve 'redirect_uri_mismatch' errors.

```text
https://your-site.com/auth/vkid/callback
```

--------------------------------

### Run Discourse VK ID OAuth Plugin Tests

Source: https://context7.com/kaktaknet/discourse-vkid-oauth/llms.txt

Execute the plugin's test suite using Bundler to verify its functionality, including PKCE generation, user migration, and OAuth flow integration. Specific test files can also be targeted.

```bash
# Run all tests
bundle exec rspec

# Run specific test files
bundle exec rspec spec/lib/omniauth/strategies/vkid_spec.rb
bundle exec rspec spec/lib/vkid_authenticator_spec.rb
bundle exec rspec spec/integration/vk_auth_spec.rb

# Test coverage includes:
# - PKCE code_verifier and code_challenge generation
# - Token exchange with verifier validation
# - User migration from vkontakte to vkid provider
# - Username uniqueness and sanitization
# - ID token JWT parsing
# - Email verification status handling
```

--------------------------------

### Verify VK ID SDK and Settings

Source: https://github.com/kaktaknet/discourse-vkid-oauth/blob/main/README.md

Use these console logs to debug issues with the VK ID widget not displaying. Check if the SDK is loaded and if the plugin is enabled.

```javascript
console.log(window.VKIDSDK); // Should show SDK
console.log(Discourse.SiteSettings.vkid_enabled); // true
```

--------------------------------

### Monitor VK ID Logs

Source: https://github.com/kaktaknet/discourse-vkid-oauth/blob/main/MIGRATION_GUIDE.md

Tail the production log file to monitor for any VK ID related errors or activity during and after migration.

```bash
tail -f /var/discourse/shared/standalone/log/rails/production.log | grep "VK ID"
```

--------------------------------

### Rebuild Discourse Application

Source: https://github.com/kaktaknet/discourse-vkid-oauth/blob/main/MIGRATION_GUIDE.md

After updating the plugin or configuration, rebuild the Discourse application to apply the changes. This command should be run from the discourse directory.

```bash
cd /var/discourse
./launcher rebuild app
```

--------------------------------

### Rollback to Old VK Plugin

Source: https://github.com/kaktaknet/discourse-vkid-oauth/blob/main/MIGRATION_GUIDE.md

Use this command sequence for an emergency rollback to the previous VK plugin. Ensure to disable VK ID and re-enable VK auth afterwards.

```bash
cd /var/discourse
./launcher enter app
rake vkid:rollback_migration
exit
./launcher rebuild app
```

--------------------------------

### Rake Tasks for VK ID User Migration

Source: https://context7.com/kaktaknet/discourse-vkid-oauth/llms.txt

Bash commands for managing VK ID user migration tasks within Discourse. Includes checking status, performing migration, verifying configuration, and rolling back.

```bash
# Check migration status
cd /var/discourse
./launcher enter app
rake vkid:migration_status

# Output:
# VK ID Migration Status
# ============================================================
# Old provider (vkontakte): 1523 users
# New provider (vkid):      0 users
# ⚠️  1523 users still on old vkontakte provider.

# Migrate all users at once
rake vkid:migrate_users

# Output:
# Starting VK ID migration...
# ============================================================
# Found 1523 users to migrate.
# ..................................................
# ============================================================
# Migration completed!
# ✅ Successfully migrated: 1523 users

# Verify configuration
rake vkid:verify_config

# Output:
# VK ID Plugin Configuration Check
# ============================================================
# ✅ Yes - Plugin enabled
# ✅ Set (6 chars) - Client ID configured
# ✅ Set (32 chars) - Client Secret configured
# ✅ vkid.personal_info email phone - Scope configured

# Rollback if needed (emergency only)
rake vkid:rollback_migration
```

--------------------------------

### Count Users with Old VK Provider

Source: https://github.com/kaktaknet/discourse-vkid-oauth/blob/main/MIGRATION_GUIDE.md

Use this SQL query to check the number of users currently logged in with the old VKontakte provider before migration.

```sql
UserAssociatedAccount.where(provider_name: 'vkontakte').count
```

--------------------------------

### VkidAuthenticator: Main Authentication Handler

Source: https://context7.com/kaktaknet/discourse-vkid-oauth/llms.txt

Handles OAuth responses, user information extraction, and migration from the legacy VK OAuth provider. Requires VK ID client ID and secret from site settings.

```ruby
# lib/vkid_authenticator.rb
class VkidAuthenticator < Auth::ManagedAuthenticator
  def name
    'vkid'
  end

  def enabled?
    SiteSetting.vkid_enabled
  end

  # Register OmniAuth middleware with credentials
  def register_middleware(omniauth)
    omniauth.provider :vkid,
      SiteSetting.vkid_client_id,
      SiteSetting.vkid_client_secret,
      scope: SiteSetting.vkid_scope || 'vkid.personal_info email phone'
  end

  # Process authentication after OAuth flow
  def after_authenticate(auth_token, existing_account: nil)
    result = super

    # Extract email from user_info or id_token
    result.email = auth_token.info.email
    result.email_valid = auth_token.extra.dig(:id_token_claims, 'email_verified') ||
                        (auth_token.extra.dig(:scope)&.include?('email'))

    result.username = generate_username(auth_token)
    result.name = auth_token.info.name

    # Store VK-specific data
    result.extra_data = {
      vkid_user_id: auth_token.uid.to_s,
      vkid_first_name: auth_token.info.first_name,
      vkid_last_name: auth_token.info.last_name,
      vkid_phone: auth_token.info.phone,
      vkid_scope: auth_token.extra.dig(:scope)
    }

    # Auto-migrate from old vkontakte provider
    if existing_account.nil? && result.user.nil?
      migrated_user = migrate_from_old_provider(auth_token.uid)
      result.user = migrated_user if migrated_user
    end

    result
  end

  private

  def generate_username(auth_token)
    username = auth_token.info.first_name&.downcase ||
               auth_token.info.email&.split('@')&.first ||
               "vkid_#{auth_token.uid}"
    username = username.gsub(/[^a-zA-Z0-9_]/, '_')[0...20]
    ensure_unique_username(username)
  end

  def migrate_from_old_provider(vkid_uid)
    old_account = UserAssociatedAccount.find_by(
      provider_name: 'vkontakte',
      provider_uid: vkid_uid.to_s
    )
    return nil unless old_account
    old_account.update!(provider_name: 'vkid')
    old_account.user
  end
end
```

--------------------------------

### Check VK ID Migration Status

Source: https://github.com/kaktaknet/discourse-vkid-oauth/blob/main/MIGRATION_GUIDE.md

Use this rake task to verify the status of the user migration from the old VKontakte provider to the new VK ID provider. It shows counts for both.

```ruby
cd /var/discourse
./launcher enter app
rake vkid:migration_status
```

--------------------------------

### Configure VK ID Application Redirect URI

Source: https://github.com/kaktaknet/discourse-vkid-oauth/blob/main/README.md

Set the Redirect URI in your VK ID application settings to this value. This is where VK ID will send the user back after authentication.

```text
https://your-discourse-site.com/auth/vkid/callback
```

--------------------------------

### Discourse Plugin Configuration for VK ID

Source: https://context7.com/kaktaknet/discourse-vkid-oauth/llms.txt

YAML configuration settings for enabling and customizing the VK ID authentication plugin in Discourse. Includes options for client ID, secret, and scopes.

```yaml
# config/settings.yml
plugins:
  vkid_enabled:
    default: false
    client: true
    description: "Enable VK ID authentication (OAuth 2.1 with PKCE)"

  vkid_client_id:
    default: ""
    description: "VK ID Application ID (from id.vk.ru)"
    regex: "^[0-9]+$"

  vkid_client_secret:
    default: ""
    secret: true
    description: "VK ID Application Secret Key"

  vkid_scope:
    default: "vkid.personal_info email phone"
    description: "VK ID OAuth scopes"
    type: enum
    choices:
      - vkid.personal_info
      - vkid.personal_info email
      - vkid.personal_info email phone
```

--------------------------------

### UserAssociatedAccount Before and After Migration

Source: https://github.com/kaktaknet/discourse-vkid-oauth/blob/main/MIGRATION_GUIDE.md

Illustrates the change in the `provider_name` field for a `UserAssociatedAccount` record after the migration from 'vkontakte' to 'vkid'.

```ruby
# Before migration
UserAssociatedAccount.find(123)
# => provider_name: "vkontakte", provider_uid: "12345"

# After migration
UserAssociatedAccount.find(123)
# => provider_name: "vkid", provider_uid: "12345"
```

--------------------------------

### Add VK ID OAuth Plugin to Discourse Container

Source: https://context7.com/kaktaknet/discourse-vkid-oauth/llms.txt

Add this configuration to the `hooks.after_code` section of your `/var/discourse/containers/app.yml` file to clone the plugin repository. Rebuild your Discourse application for the changes to take effect.

```yaml
hooks:
  after_code:
    - exec:
        cd: $home/plugins
        cmd:
          - git clone https://github.com/kaktaknet/discourse-vkid-oauth.git
```

--------------------------------

### Discourse VK ID Authentication Settings

Source: https://github.com/kaktaknet/discourse-vkid-oauth/blob/main/README.md

Configure these settings in Discourse Admin panel to enable and customize VK ID authentication. Ensure you use your actual App ID and Secret Key.

```text
vkid_enabled: ✅
vkid_client_id: 123456
vkid_client_secret: ••••••
vkid_scope: vkid.personal_info email phone
vkid_widget_enabled: ✅
vkid_widget_providers: vkid,ok_ru,mail_ru
```

--------------------------------

### VK ID OmniAuth Strategy Implementation

Source: https://context7.com/kaktaknet/discourse-vkid-oauth/llms.txt

Ruby code defining the OmniAuth strategy for VK ID. It handles OAuth2 flow, PKCE generation, and user data retrieval.

```ruby
module OmniAuth
  module Strategies
    class Vkid < OmniAuth::Strategies::OAuth2
      option :name, 'vkid'

      option :client_options, {
        site: 'https://id.vk.ru',
        authorize_url: '/authorize',
        token_url: '/oauth2/auth',
        auth_scheme: :request_body
      }

      option :pkce, true

      # Generate PKCE challenge for authorization
      def authorize_params
        super.tap do |params|
          @code_verifier = SecureRandom.urlsafe_base64(43)
          session['omniauth.vkid.pkce.verifier'] = @code_verifier

          params[:code_challenge] = Base64.urlsafe_encode64(
            Digest::SHA256.digest(@code_verifier),
            padding: false
          )
          params[:code_challenge_method] = 'S256'
          params[:response_type] = 'code'
          params[:state] = SecureRandom.hex(16)
          params[:scope] = options[:scope] || 'vkid.personal_info email phone'
          params[:prompt] = 'login'
        end
      end

      # Include code_verifier in token exchange
      def token_params
        super.tap do |params|
          params[:code_verifier] = session.delete('omniauth.vkid.pkce.verifier')
          params[:device_id] = request.params['device_id']
          params.delete(:client_secret)
        end
      end

      uid do
        raw_info['user_id'] || raw_info.dig('user', 'user_id') || id_token_claims['sub']
      end

      info do
        {
          email: raw_info.dig('user', 'email') || id_token_claims['email'],
          name: [raw_info.dig('user', 'first_name'), raw_info.dig('user', 'last_name')].compact.join(' '),
          first_name: raw_info.dig('user', 'first_name'),
          last_name: raw_info.dig('user', 'last_name'),
          phone: raw_info.dig('user', 'phone'),
          image: raw_info.dig('user', 'avatar')
        }
      end

      def raw_info
        @raw_info ||= access_token.post(
          'https://id.vk.ru/oauth2/user_info',
          body: { access_token: access_token.token, client_id: options[:client_id] },
          headers: { 'Content-Type' => 'application/x-www-form-urlencoded' }
        ).parsed
      end
    end
  end
end
```

--------------------------------

### Register VK ID Authentication Provider

Source: https://context7.com/kaktaknet/discourse-vkid-oauth/llms.txt

Registers the VK ID authenticator with Discourse. Ensure the 'vkid_enabled' site setting is true to activate this provider. Loads custom OmniAuth strategy and SVG icon.

```ruby
# plugin.rb - Plugin entry point
# name: discourse-vkid-oauth
# version: 2.0.0
# required_version: 2.7.0

# Enable/disable via admin settings
enabled_site_setting :vkid_enabled

# Load custom OAuth strategy
require_relative "lib/omniauth/strategies/vkid"
require_relative "lib/vkid_authenticator"

# Register authentication provider
auth_provider(
  title: "VK ID",
  authenticator: VkidAuthenticator.new,
  message: "Sign in with VK ID",
  icon: "fab-vk"
)

# Register VK icon
register_svg_icon "fab-vk" if respond_to?(:register_svg_icon)
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.