alex
78aaddb2b5
- Add frontend-foundation change (FN-005) with 46 tasks - Add deployment-config change (FN-006) with 27 tasks - Add runfusion-poc/opencode-poc change (FN-008) with 25 tasks - Add config-secrets change (FN-009) with 31 tasks - Add codeserver-spawn change (FN-010) with 38 tasks - Include project specsheet and configuration - Archive completed deployment-config change
37 lines
1.6 KiB
Markdown
37 lines
1.6 KiB
Markdown
## ADDED Requirements
|
|
|
|
### Requirement: User can authenticate via Authentik OIDC
|
|
The system SHALL provide an authentication flow using Authentik as the OIDC provider.
|
|
|
|
#### Scenario: Successful login
|
|
- **WHEN** an unauthenticated user clicks "Sign In"
|
|
- **THEN** the system redirects to Authentik's authorization endpoint with PKCE parameters
|
|
- **AND** after successful authentication, Authentik redirects back with an authorization code
|
|
- **AND** the system exchanges the code for tokens
|
|
- **AND** the user is redirected to the dashboard
|
|
|
|
#### Scenario: Automatic user provisioning
|
|
- **WHEN** a user authenticates for the first time
|
|
- **THEN** the backend creates a User record automatically
|
|
- **AND** the user can access their projects immediately
|
|
|
|
#### Scenario: Logout
|
|
- **WHEN** an authenticated user clicks "Sign Out"
|
|
- **THEN** the system clears all session data
|
|
- **AND** redirects to Authentik's end_session_endpoint
|
|
- **AND** the user is redirected back to the login page
|
|
|
|
### Requirement: Auth state is managed globally
|
|
The system SHALL maintain authentication state accessible throughout the application.
|
|
|
|
#### Scenario: Auth context available
|
|
- **WHEN** the application loads
|
|
- **THEN** an auth context provider wraps the component tree
|
|
- **AND** child components can read the current auth state (loading, authenticated, unauthenticated, error)
|
|
|
|
#### Scenario: Token refresh
|
|
- **WHEN** an API request returns 401 due to expired token
|
|
- **THEN** the system attempts token refresh
|
|
- **AND** retries the original request with the new token
|
|
- **AND** if refresh fails, redirects to login
|