Fusion
2ce7862058
Replace complex JWT + refresh token authentication with simple session-based auth using signed cookies. **Removed:** - JWT token service (jwt_service.py) - Refresh token store (refresh_store.py) - Refresh token model and database table - JWKS fetching and OIDC token verification - python-jose dependency **Added:** - Session service (session.py) with HMAC-SHA256 signed cookies - Auth dependencies module for shared auth logic - Session-based auth endpoints **Updated:** - All API endpoints to use session-based auth - Config: removed JWT settings, added SESSION_SECRET/SESSION_TTL_HOURS - Tests: rewritten for session-based flow - Frontend: no changes needed (already uses cookies) Quality gates: ruff ✓, mypy ✓, typecheck ✓, lint ✓
1.8 KiB
1.8 KiB
Simplify Authentik Auth Flow
Problem
The current authentication implementation is overly complex for our needs:
- Multiple layers: OIDC token exchange, refresh token rotation, complex cookie management
- Difficult to debug: Many moving parts make deployment issues hard to diagnose
- Over-engineered: We don't need the full OIDC flow complexity for our use case
- Maintenance burden: The sophisticated approach requires deep understanding of OAuth2/OIDC internals
Solution
Replace the current complex auth flow with a simplified approach:
- Authentik OAuth: Keep OAuth2 authentication via Authentik
- Session-based: Use simple session cookies instead of JWT + refresh tokens
- Authentik as source of truth: User profiles synced from Authentik on login
- Simpler implementation: Reduce auth-related code by ~70%
Benefits
- Easier to deploy: Fewer configuration variables and moving parts
- Easier to debug: Clear flow: Login → Authentik → Session Cookie
- Less code: Remove JWT service, refresh token store, complex OIDC logic
- Future-proof: Still supports teams/groups via Authentik's user info endpoint
- Better UX: No token refresh issues, simpler logout
Scope
What stays:
- OAuth2 authentication via Authentik
- User model in database (synced from Authentik)
- Protected routes requiring authentication
- Frontend auth state management
What goes:
- JWT access tokens
- Refresh token rotation
- Complex OIDC token verification
- Multiple cookie types (access_token, refresh_token)
- Token expiry/refresh logic
- JWKS fetching and validation
What's new:
- Simple session cookie (httpOnly, secure, SameSite)
- Authentik user info endpoint integration
- Simplified auth middleware
- Cleaner logout (just delete session)