mitbringsl

Tronax/mitbringsl

Fork 0

Commit graph

Author	SHA1	Message	Date
Tronax	3f187f1ede	Feature: Server-driven auth method discovery + OIDC-only enforcement Backend: - New AUTH_PASSWORD_ENABLED flag (default true). When false, email/password registration and login return 403; the server enforces OIDC-only login. - New OIDC_GENERIC_DISPLAY_NAME so the app can show 'Authentik'/'Keycloak' instead of a generic 'OIDC' label. - New public endpoint GET /api/config returns which auth methods the server offers (password_enabled + per-provider OIDC capabilities). No auth required, so the login screen can query it before logging in. - .env.example and docker-compose.yml expose the new env vars. App: - DTOs + MitbringslApi.getServerConfig() for /api/config. - AuthViewModel: new 'connect' flow. The user enters the server URL, taps 'Verbinden', and the app fetches /api/config. The returned ServerAuthConfig drives which login options are shown: * password-only -> email/password form * OIDC-only -> OIDC token form * both -> toggle between the two If the server offers no method, a clear error is shown. - AuthScreen: split into ConnectView (server URL) and LoginView (the login form matching the server's capabilities). The mode toggle only appears when the server offers more than one method.	2026-08-06 10:28:12 +02:00
Tronax	a5ef8cf3ba	Backend Phase B (2/2): OIDC auth + config validation - internal/auth/oidc.go: OIDCService mit go-oidc v3 - id_token-Verifikation via JWKS (Signatur, iss, aud, exp) - Provider-Caching (sync.Map, lazy init per Issuer-URL) - Unterstützt Google + Generic OIDC - internal/auth/user.go: GetByOIDCSubject + CreateOIDCUser (find-or-create via (oidc_issuer, oidc_subject)) - internal/httpapi/auth.go: POST /auth/oidc Handler (id_token verifiziern → find-or-create User → issueSession) - internal/httpapi/api.go: /auth/oidc Route verdrahtet - internal/config/config.go: OIDC-Validierung (enabled → client_id + issuer Pflicht) - go.mod/go.sum: go-oidc/v3 + oauth2 Abhängigkeiten - AGENTS.md: Phase B vollständig als erledigt markiert Verifiziert: E2E gegen lokalen Mock-IdP (Discovery → JWKS → signiertes id_token → User angelegt → 2. Login gleicher User → tampered Token → 401). Alle Fehlerpfade geprüft. go build ./... && go vet ./... && go test ./internal/auth/... ✅	2026-08-05 19:45:00 +02:00
Tronax	7b1c18590e	Backend Phase B (1/2): password auth + sessions Argon2id password hashing (PHC format, self-encoded/decoded without an external lib) with constant-time verification, UserStore (create/get by email and id) and SessionStore (opaque crypto/rand tokens, SHA-256 hashed in DB, create/lookup/revoke, last_seen_at bump on lookup). HTTP layer: Register/Login/Logout handlers + RequireAuth middleware. Login uses a dummy-hash path so unknown-email and wrong-password yield the same timing/shape, narrowing user enumeration. Tokens accepted via Bearer header (native clients) or session cookie (HttpOnly, SameSite=Lax). Routes wired in api.go: POST /auth/register, /auth/login, /auth/logout. Verified with go test, go vet and an end-to-end smoke test against a real PostgreSQL container (register/login/logout/duplicate/short-pw/wrong-pw). OIDC (Phase B part 2) follows next; the issueSession helper is reused.	2026-08-05 19:05:07 +02:00

Author

SHA1

Message

Date

Tronax

3f187f1ede

Feature: Server-driven auth method discovery + OIDC-only enforcement

Backend:
- New AUTH_PASSWORD_ENABLED flag (default true). When false, email/password
  registration and login return 403; the server enforces OIDC-only login.
- New OIDC_GENERIC_DISPLAY_NAME so the app can show 'Authentik'/'Keycloak'
  instead of a generic 'OIDC' label.
- New public endpoint GET /api/config returns which auth methods the
  server offers (password_enabled + per-provider OIDC capabilities).
  No auth required, so the login screen can query it before logging in.
- .env.example and docker-compose.yml expose the new env vars.

App:
- DTOs + MitbringslApi.getServerConfig() for /api/config.
- AuthViewModel: new 'connect' flow. The user enters the server URL,
  taps 'Verbinden', and the app fetches /api/config. The returned
  ServerAuthConfig drives which login options are shown:
    * password-only -> email/password form
    * OIDC-only     -> OIDC token form
    * both          -> toggle between the two
  If the server offers no method, a clear error is shown.
- AuthScreen: split into ConnectView (server URL) and LoginView (the
  login form matching the server's capabilities). The mode toggle only
  appears when the server offers more than one method.

2026-08-06 10:28:12 +02:00

Tronax

a5ef8cf3ba

Backend Phase B (2/2): OIDC auth + config validation

- internal/auth/oidc.go: OIDCService mit go-oidc v3
  - id_token-Verifikation via JWKS (Signatur, iss, aud, exp)
  - Provider-Caching (sync.Map, lazy init per Issuer-URL)
  - Unterstützt Google + Generic OIDC
- internal/auth/user.go: GetByOIDCSubject + CreateOIDCUser
  (find-or-create via (oidc_issuer, oidc_subject))
- internal/httpapi/auth.go: POST /auth/oidc Handler
  (id_token verifiziern → find-or-create User → issueSession)
- internal/httpapi/api.go: /auth/oidc Route verdrahtet
- internal/config/config.go: OIDC-Validierung
  (enabled → client_id + issuer Pflicht)
- go.mod/go.sum: go-oidc/v3 + oauth2 Abhängigkeiten
- AGENTS.md: Phase B vollständig als erledigt markiert

Verifiziert: E2E gegen lokalen Mock-IdP (Discovery → JWKS →
signiertes id_token → User angelegt → 2. Login gleicher User →
tampered Token → 401). Alle Fehlerpfade geprüft.

go build ./... && go vet ./... && go test ./internal/auth/... ✅

2026-08-05 19:45:00 +02:00

Tronax

7b1c18590e

Backend Phase B (1/2): password auth + sessions

Argon2id password hashing (PHC format, self-encoded/decoded without an
external lib) with constant-time verification, UserStore (create/get by
email and id) and SessionStore (opaque crypto/rand tokens, SHA-256 hashed
in DB, create/lookup/revoke, last_seen_at bump on lookup).

HTTP layer: Register/Login/Logout handlers + RequireAuth middleware.
Login uses a dummy-hash path so unknown-email and wrong-password yield the
same timing/shape, narrowing user enumeration. Tokens accepted via Bearer
header (native clients) or session cookie (HttpOnly, SameSite=Lax).

Routes wired in api.go: POST /auth/register, /auth/login, /auth/logout.
Verified with go test, go vet and an end-to-end smoke test against a real
PostgreSQL container (register/login/logout/duplicate/short-pw/wrong-pw).

OIDC (Phase B part 2) follows next; the issueSession helper is reused.

2026-08-05 19:05:07 +02:00

3 commits