alex
78aaddb2b5
- Add frontend-foundation change (FN-005) with 46 tasks - Add deployment-config change (FN-006) with 27 tasks - Add runfusion-poc/opencode-poc change (FN-008) with 25 tasks - Add config-secrets change (FN-009) with 31 tasks - Add codeserver-spawn change (FN-010) with 38 tasks - Include project specsheet and configuration - Archive completed deployment-config change
1.6 KiB
1.6 KiB
ADDED Requirements
Requirement: User can authenticate via Authentik OIDC
The system SHALL provide an authentication flow using Authentik as the OIDC provider.
Scenario: Successful login
- WHEN an unauthenticated user clicks "Sign In"
- THEN the system redirects to Authentik's authorization endpoint with PKCE parameters
- AND after successful authentication, Authentik redirects back with an authorization code
- AND the system exchanges the code for tokens
- AND the user is redirected to the dashboard
Scenario: Automatic user provisioning
- WHEN a user authenticates for the first time
- THEN the backend creates a User record automatically
- AND the user can access their projects immediately
Scenario: Logout
- WHEN an authenticated user clicks "Sign Out"
- THEN the system clears all session data
- AND redirects to Authentik's end_session_endpoint
- AND the user is redirected back to the login page
Requirement: Auth state is managed globally
The system SHALL maintain authentication state accessible throughout the application.
Scenario: Auth context available
- WHEN the application loads
- THEN an auth context provider wraps the component tree
- AND child components can read the current auth state (loading, authenticated, unauthenticated, error)
Scenario: Token refresh
- WHEN an API request returns 401 due to expired token
- THEN the system attempts token refresh
- AND retries the original request with the new token
- AND if refresh fails, redirects to login