0fcfc745ff
fix: add alias=session to Cookie dependencies
...
FastAPI uses parameter name as cookie name by default.
get_current_user_id was looking for 'session_cookie' but we set
the cookie as 'session'. Add alias='session' to match.
2026-05-19 10:56:11 +02:00
d214ab82db
debug: add logging to auth cookie handling
...
Add debug logging to understand why /auth/me succeeds but
/users/me/config fails with 401.
2026-05-19 10:52:33 +02:00
58bf30ed15
fix: set cookie domain for cross-subdomain authentication
...
In production, the session cookie needs to be shared across
subdomains (e.g., api.example.com and app.example.com).
- Add cookie_domain property to config (extracts parent domain)
- Set SameSite=None for cross-origin requests in production
- Update auth callback and logout to use cookie domain
- This fixes the login loop where session cookie wasn't sent
2026-05-18 23:33:59 +02:00
2ce7862058
feat: simplify auth flow - replace JWT with session cookies
...
Replace complex JWT + refresh token authentication with simple
session-based auth using signed cookies.
**Removed:**
- JWT token service (jwt_service.py)
- Refresh token store (refresh_store.py)
- Refresh token model and database table
- JWKS fetching and OIDC token verification
- python-jose dependency
**Added:**
- Session service (session.py) with HMAC-SHA256 signed cookies
- Auth dependencies module for shared auth logic
- Session-based auth endpoints
**Updated:**
- All API endpoints to use session-based auth
- Config: removed JWT settings, added SESSION_SECRET/SESSION_TTL_HOURS
- Tests: rewritten for session-based flow
- Frontend: no changes needed (already uses cookies)
Quality gates: ruff ✓, mypy ✓, typecheck ✓, lint ✓
2026-05-18 22:54:53 +02:00
137757602f
fix: make refresh_token optional in OIDC token exchange
...
Authentik may not return a refresh_token in the authorization_code
response. Use .get() instead of direct dict access to prevent KeyError.
2026-05-18 21:41:13 +02:00
577b052c05
feat: implement user profile management and oauth/traefik integration
...
User Profile (US-004):
- Add authenticated profile endpoints (GET/PUT /users/me)
- Add avatar upload with file validation (PNG/JPEG, max 2MB)
- Create frontend profile page with edit form and avatar upload
- Update app shell to link to profile page
OAuth/Traefik Integration:
- Externalize all Authentik URLs to environment variables
- Add domain configuration (API_DOMAIN, WEB_DOMAIN, AUTHENTIK_DOMAIN)
- Create docker-compose.traefik.yml for reverse proxy deployment
- Update OAuth redirect/callback URLs to use configured domains
- Add VITE_APP_URL for frontend public URL configuration
Quality gates: pytest (50 passed), ruff, mypy, npm test (12 passed), typecheck, lint, build
2026-05-17 23:17:10 +02:00
alex
71d9fe6406
feat: implement auth, projects, and frontend foundation
2026-05-17 20:21:55 +00:00
Fusion
alex