headquarter/openspec/changes/simplify-authentik-auth/.openspec.yaml at d724a92d34a7e2e63175ecf6ff10e30cb8f872ea - headquarter - Gitea: Git with a cup of tea

alex/headquarter

Files

T

Fusion 2ce7862058 feat: simplify auth flow - replace JWT with session cookies

Replace complex JWT + refresh token authentication with simple
session-based auth using signed cookies.

**Removed:**
- JWT token service (jwt_service.py)
- Refresh token store (refresh_store.py)
- Refresh token model and database table
- JWKS fetching and OIDC token verification
- python-jose dependency

**Added:**
- Session service (session.py) with HMAC-SHA256 signed cookies
- Auth dependencies module for shared auth logic
- Session-based auth endpoints

**Updated:**
- All API endpoints to use session-based auth
- Config: removed JWT settings, added SESSION_SECRET/SESSION_TTL_HOURS
- Tests: rewritten for session-based flow
- Frontend: no changes needed (already uses cookies)

Quality gates: ruff ✓, mypy ✓, typecheck ✓, lint ✓

2026-05-18 22:54:53 +02:00

3 lines

40 B

YAML

Raw Blame History

	`schema: spec-driven`
	`created: 2026-05-18`