feat: implement user profile management and oauth/traefik integration

User Profile (US-004): - Add authenticated profile endpoints (GET/PUT /users/me) - Add avatar upload with file validation (PNG/JPEG, max 2MB) - Create frontend profile page with edit form and avatar upload - Update app shell to link to profile page OAuth/Traefik Integration: - Externalize all Authentik URLs to environment variables - Add domain configuration (API_DOMAIN, WEB_DOMAIN, AUTHENTIK_DOMAIN) - Create docker-compose.traefik.yml for reverse proxy deployment - Update OAuth redirect/callback URLs to use configured domains - Add VITE_APP_URL for frontend public URL configuration Quality gates: pytest (50 passed), ruff, mypy, npm test (12 passed), typecheck, lint, build
2026-05-17 23:17:10 +02:00
parent 56f440db1b
commit 577b052c05
32 changed files with 1153 additions and 16 deletions
@@ -0,0 +1,29 @@
+## MODIFIED Requirements
+
+### Requirement: OAuth2/OIDC Flow
+
+The system SHALL support OAuth2/OIDC authentication via Authentik with fully configurable endpoints.
+
+#### Scenario: User login
+- GIVEN a user clicks the login button
+- WHEN the frontend redirects to Authentik authorization endpoint
+- THEN the redirect URI SHALL be constructed from environment-configured domains
+- AND the Authentik authorize URL SHALL be read from environment variables
+
+#### Scenario: Token exchange and validation
+- GIVEN Authentik has redirected with authorization code
+- WHEN the callback endpoint receives the code
+- THEN it exchanges the code for provider tokens at the configured token URL
+- AND verifies token signature using the configured JWKS URL
+- AND validates the issuer and audience from environment configuration
+
+### Requirement: Session Security
+
+The system SHALL protect sessions using httpOnly cookies with environment-aware secure defaults.
+
+#### Scenario: Cookie attributes in production
+- GIVEN successful authentication behind Traefik with HTTPS
+- WHEN cookies are set
+- THEN access_token cookie SHALL be httpOnly
+- AND access_token cookie SHALL have Secure flag based on environment
+- AND access_token cookie SHALL have SameSite based on environment
@@ -0,0 +1,24 @@
+## MODIFIED Requirements
+
+### Requirement: Docker Compose Setup
+
+The system SHALL provide Docker Compose configurations for both development and traefik deployment.
+
+#### Scenario: Development compose file
+- GIVEN the development environment
+- THEN `docker-compose.yml` SHALL define all platform services for local development
+
+#### Scenario: Traefik compose file
+- GIVEN the production deployment
+- THEN `docker-compose.traefik.yml` SHALL define all platform services behind Traefik
+- AND no ports SHALL be exposed directly (all traffic through Traefik)
+
+### Requirement: Environment Configuration
+
+The system SHALL document all required environment variables for both development and traefik deployment modes.
+
+#### Scenario: Environment setup
+- GIVEN a new developer or operator
+- WHEN they set up the project
+- THEN `.env.example` SHALL document all variables for both modes
+- AND variables SHALL include domain configuration for traefik mode
@@ -0,0 +1,31 @@
+## ADDED Requirements
+
+### Requirement: Traefik Docker Compose
+
+The system SHALL provide a `docker-compose.traefik.yml` for deployment behind an existing Traefik reverse proxy.
+
+#### Scenario: Service labels
+- GIVEN the traefik deployment configuration
+- WHEN services are started
+- THEN `docker-compose.traefik.yml` SHALL define Traefik Docker labels for each service
+- AND all routing rules SHALL use configurable domain names
+
+#### Scenario: Environment variables
+- GIVEN the traefik deployment configuration
+- WHEN configuring the deployment
+- THEN all domain names SHALL be configurable via environment variables
+- AND the proxy web name SHALL be configurable via environment variable
+
+### Requirement: Environment Configuration
+
+The system SHALL document all required environment variables for traefik deployment.
+
+#### Scenario: Required variables
+- GIVEN a new deployment
+- WHEN setting up environment variables
+- THEN `.env.example` SHALL document:
+  - `API_DOMAIN` - domain for API service
+  - `WEB_DOMAIN` - domain for web frontend
+  - `AUTHENTIK_DOMAIN` - domain for Authentik instance
+  - `PROXY_WEB_NAME` - name for web proxy service
+  - All Authentik OIDC configuration variables