Fusion
2ce7862058
Replace complex JWT + refresh token authentication with simple session-based auth using signed cookies. **Removed:** - JWT token service (jwt_service.py) - Refresh token store (refresh_store.py) - Refresh token model and database table - JWKS fetching and OIDC token verification - python-jose dependency **Added:** - Session service (session.py) with HMAC-SHA256 signed cookies - Auth dependencies module for shared auth logic - Session-based auth endpoints **Updated:** - All API endpoints to use session-based auth - Config: removed JWT settings, added SESSION_SECRET/SESSION_TTL_HOURS - Tests: rewritten for session-based flow - Frontend: no changes needed (already uses cookies) Quality gates: ruff ✓, mypy ✓, typecheck ✓, lint ✓
50 lines
1.8 KiB
Markdown
50 lines
1.8 KiB
Markdown
# Simplify Authentik Auth Flow
|
|
|
|
## Problem
|
|
|
|
The current authentication implementation is overly complex for our needs:
|
|
|
|
- **Multiple layers**: OIDC token exchange, refresh token rotation, complex cookie management
|
|
- **Difficult to debug**: Many moving parts make deployment issues hard to diagnose
|
|
- **Over-engineered**: We don't need the full OIDC flow complexity for our use case
|
|
- **Maintenance burden**: The sophisticated approach requires deep understanding of OAuth2/OIDC internals
|
|
|
|
## Solution
|
|
|
|
Replace the current complex auth flow with a simplified approach:
|
|
|
|
1. **Authentik OAuth**: Keep OAuth2 authentication via Authentik
|
|
2. **Session-based**: Use simple session cookies instead of JWT + refresh tokens
|
|
3. **Authentik as source of truth**: User profiles synced from Authentik on login
|
|
4. **Simpler implementation**: Reduce auth-related code by ~70%
|
|
|
|
## Benefits
|
|
|
|
- **Easier to deploy**: Fewer configuration variables and moving parts
|
|
- **Easier to debug**: Clear flow: Login → Authentik → Session Cookie
|
|
- **Less code**: Remove JWT service, refresh token store, complex OIDC logic
|
|
- **Future-proof**: Still supports teams/groups via Authentik's user info endpoint
|
|
- **Better UX**: No token refresh issues, simpler logout
|
|
|
|
## Scope
|
|
|
|
### What stays:
|
|
- OAuth2 authentication via Authentik
|
|
- User model in database (synced from Authentik)
|
|
- Protected routes requiring authentication
|
|
- Frontend auth state management
|
|
|
|
### What goes:
|
|
- JWT access tokens
|
|
- Refresh token rotation
|
|
- Complex OIDC token verification
|
|
- Multiple cookie types (access_token, refresh_token)
|
|
- Token expiry/refresh logic
|
|
- JWKS fetching and validation
|
|
|
|
### What's new:
|
|
- Simple session cookie (httpOnly, secure, SameSite)
|
|
- Authentik user info endpoint integration
|
|
- Simplified auth middleware
|
|
- Cleaner logout (just delete session)
|