39 lines
2.1 KiB
Markdown
39 lines
2.1 KiB
Markdown
## 1. Configuration and schema foundation
|
|
|
|
- [x] 1.1 Add auth/OIDC/JWT/cookie settings to backend config with environment-aware defaults.
|
|
- [x] 1.2 Add refresh token SQLAlchemy model and relationships to user model.
|
|
- [x] 1.3 Add Alembic migration for refresh token table and indexes.
|
|
- [x] 1.4 Add/adjust tests that fail first for config and refresh-token model metadata.
|
|
|
|
## 2. Auth provider and token services
|
|
|
|
- [x] 2.1 Implement Authentik OIDC client helpers for login URL build and callback token exchange.
|
|
- [x] 2.2 Implement JWKS-based token verification helper for provider tokens.
|
|
- [x] 2.3 Implement internal JWT mint/verify helper with configured TTL.
|
|
- [x] 2.4 Implement refresh token store service (hashing, create, rotate, revoke, reuse detection).
|
|
- [x] 2.5 Add unit tests for provider verification, JWT helpers, cookie options, and refresh lifecycle.
|
|
|
|
## 3. Auth HTTP endpoints
|
|
|
|
- [x] 3.1 Implement `GET /auth/login` redirect endpoint.
|
|
- [x] 3.2 Implement `GET /auth/callback` with state validation, token exchange, user upsert, and cookie set.
|
|
- [x] 3.3 Implement `POST /auth/refresh` with DB validation and rotation.
|
|
- [x] 3.4 Implement `POST /auth/logout` to revoke refresh state and clear cookies.
|
|
- [x] 3.5 Implement `GET /auth/me` returning authenticated user payload via internal JWT.
|
|
- [x] 3.6 Add integration tests for callback, refresh rotation, logout, and unauthorized cases.
|
|
|
|
## 4. Verification and OpenSpec tracking
|
|
|
|
- [x] 4.1 Run auth-focused and full backend checks (`pytest`, `ruff check`, `mypy`) and fix findings.
|
|
- [x] 4.2 Run migration verification against local Postgres and confirm current revision.
|
|
- [x] 4.3 Update this task list with completed checkboxes and note any blockers/follow-ups.
|
|
|
|
## Blockers / Follow-ups
|
|
|
|
- No blocking items remain for this change.
|
|
|
|
## Runtime verification
|
|
|
|
- `DATABASE_URL=postgresql+asyncpg://headquarter:headquarter@localhost:5432/headquarter .venv/bin/alembic -c alembic.ini upgrade head` succeeded.
|
|
- `DATABASE_URL=postgresql+asyncpg://headquarter:headquarter@localhost:5432/headquarter .venv/bin/alembic -c alembic.ini current` returned `0002_refresh_tokens (head)`.
|