alex/headquarter
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: implement auth, projects, and frontend foundation

Browse Source
This commit is contained in:
Alex
2026-05-17 20:21:55 +00:00
parent e7819bfc82
commit 71d9fe6406
88 changed files with 10936 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openspec/specs/auth-oauth/spec.md
+30 -19
View File
@@ -3,12 +3,9 @@
## Purpose
Manage user authentication via Authentik OAuth with secure session handling.
## Requirements
### Requirement: OAuth2/OIDC Flow
The system SHALL support OAuth2/OIDC authentication via Authentik.
The system SHALL support OAuth2/OIDC authentication via Authentik and SHALL validate Authentik-issued tokens via JWKS before creating local sessions.
#### Scenario: User login
- GIVEN a user clicks the login button
@@ -16,43 +13,57 @@ The system SHALL support OAuth2/OIDC authentication via Authentik.
- THEN the user authenticates with Authentik
- AND Authentik redirects back with authorization code
#### Scenario: Token exchange
#### Scenario: Token exchange and validation
- GIVEN Authentik has redirected with authorization code
- WHEN the callback endpoint receives the code
- THEN it exchanges the code for access and refresh tokens
- AND sets httpOnly, Secure, SameSite=strict cookies
- THEN it exchanges the code for provider tokens
- AND verifies token signature and claims using Authentik JWKS
- AND upserts the local user account
- AND mints internal access and refresh tokens
### Requirement: Session Security
The system SHALL protect sessions using httpOnly cookies and SHALL apply secure cookie defaults by environment.
The system SHALL protect sessions using httpOnly cookies.
#### Scenario: Cookie attributes
- GIVEN successful authentication
#### Scenario: Cookie attributes in production
- GIVEN successful authentication in production
- WHEN cookies are set
- THEN access_token cookie SHALL be httpOnly
- AND access_token cookie SHALL have Secure flag
- AND access_token cookie SHALL have SameSite=strict
- AND refresh_token cookie SHALL have same attributes
- AND refresh_token cookie SHALL have the same attributes
#### Scenario: Cookie attributes in localhost development
- GIVEN successful authentication in localhost development
- WHEN cookies are set
- THEN access_token cookie SHALL be httpOnly
- AND access_token cookie SHALL have Secure=false
- AND access_token cookie SHALL have SameSite=lax
- AND refresh_token cookie SHALL have the same attributes
### Requirement: Token Refresh
The system SHALL support automatic token refresh.
The system SHALL support automatic token refresh with server-side refresh token storage, rotation, and revocation.
#### Scenario: Access token expiration
- GIVEN a user has an expired access token
- WHEN the user makes an authenticated request
- THEN the system uses the refresh token to get a new access token
- WHEN the user makes an authenticated request that can refresh
- THEN the system validates the refresh token against non-expired, non-revoked DB state
- AND rotates the refresh token
- AND issues a new internal access token
#### Scenario: Refresh token reuse detection
- GIVEN a refresh token has already been rotated or revoked
- WHEN it is presented again to the refresh endpoint
- THEN the system rejects the request with unauthorized status
- AND invalidates the token chain for the session
### Requirement: Session Termination
The system SHALL support explicit logout.
The system SHALL support explicit logout with refresh token invalidation.
#### Scenario: User logout
- GIVEN an authenticated user
- WHEN the user clicks logout
- THEN all auth cookies are cleared
- AND the refresh token is invalidated
- AND the refresh token is invalidated in server-side storage
## Dependencies