alex/headquarter
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: sync oauth-traefik-integration specs to main specs

Browse Source 
- Update auth-oauth spec: configurable endpoints via environment variables
- Update docker-infrastructure spec: add traefik deployment mode
- Add traefik-deployment spec: new capability for reverse proxy deployment
This commit is contained in:
Fusion
2026-05-17 23:28:43 +02:00
parent 75657bbcb0
commit 9b04760423
3 changed files with 50 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openspec/specs/auth-oauth/spec.md
+6 -5
View File
@@ -5,19 +5,20 @@
Manage user authentication via Authentik OAuth with secure session handling.
## Requirements
### Requirement: OAuth2/OIDC Flow
The system SHALL support OAuth2/OIDC authentication via Authentik and SHALL validate Authentik-issued tokens via JWKS before creating local sessions.
The system SHALL support OAuth2/OIDC authentication via Authentik with fully configurable endpoints and SHALL validate Authentik-issued tokens via JWKS before creating local sessions.
#### Scenario: User login
- GIVEN a user clicks the login button
- WHEN the frontend redirects to Authentik authorization endpoint
- THEN the user authenticates with Authentik
- AND Authentik redirects back with authorization code
- THEN the redirect URI SHALL be constructed from environment-configured domains
- AND the Authentik authorize URL SHALL be read from environment variables
#### Scenario: Token exchange and validation
- GIVEN Authentik has redirected with authorization code
- WHEN the callback endpoint receives the code
- THEN it exchanges the code for provider tokens
- AND verifies token signature and claims using Authentik JWKS
- THEN it exchanges the code for provider tokens at the configured token URL
- AND verifies token signature using the configured JWKS URL
- AND validates the issuer and audience from environment configuration
- AND upserts the local user account
- AND mints internal access and refresh tokens