feat: implement auth, projects, and frontend foundation

2026-05-17 20:21:55 +00:00
parent e7819bfc82
commit 71d9fe6406
88 changed files with 10936 additions and 47 deletions
@@ -0,0 +1,27 @@
+## Why
+
+The project has database foundations in place but still lacks production-ready user authentication. We need a secure OAuth2/OIDC integration with Authentik that issues internal session credentials and supports reliable logout and token revocation.
+
+## What Changes
+
+- Implement backend OAuth2/OIDC login and callback flow against Authentik.
+- Verify Authentik-issued tokens via JWKS before minting local credentials.
+- Mint short-lived internal JWT access tokens and store refresh tokens server-side.
+- Add refresh-token rotation, revocation, and explicit logout semantics.
+- Apply environment-aware secure cookie policy (strict in production, relaxed for localhost development).
+- Add auth endpoints, supporting services, and test coverage for auth flows.
+
+## Capabilities
+
+### New Capabilities
+- `auth-session-tokens`: Internal JWT access-token issuance, opaque refresh-token storage, rotation, and revocation.
+
+### Modified Capabilities
+- `auth-oauth`: Extend OAuth/OIDC behavior to require JWKS validation, internal JWT minting, cookie policy by environment, and DB-backed refresh lifecycle.
+
+## Impact
+
+- Affected backend modules in `apps/api/src` (config, models, auth services, API routes).
+- New database schema object for refresh-token persistence and an accompanying migration.
+- New environment variables for OIDC/JWT/cookie settings.
+- Frontend auth integration points for login/logout/me/refresh behavior.