28 lines
1.4 KiB
Markdown
28 lines
1.4 KiB
Markdown
## Why
|
|
|
|
The project has database foundations in place but still lacks production-ready user authentication. We need a secure OAuth2/OIDC integration with Authentik that issues internal session credentials and supports reliable logout and token revocation.
|
|
|
|
## What Changes
|
|
|
|
- Implement backend OAuth2/OIDC login and callback flow against Authentik.
|
|
- Verify Authentik-issued tokens via JWKS before minting local credentials.
|
|
- Mint short-lived internal JWT access tokens and store refresh tokens server-side.
|
|
- Add refresh-token rotation, revocation, and explicit logout semantics.
|
|
- Apply environment-aware secure cookie policy (strict in production, relaxed for localhost development).
|
|
- Add auth endpoints, supporting services, and test coverage for auth flows.
|
|
|
|
## Capabilities
|
|
|
|
### New Capabilities
|
|
- `auth-session-tokens`: Internal JWT access-token issuance, opaque refresh-token storage, rotation, and revocation.
|
|
|
|
### Modified Capabilities
|
|
- `auth-oauth`: Extend OAuth/OIDC behavior to require JWKS validation, internal JWT minting, cookie policy by environment, and DB-backed refresh lifecycle.
|
|
|
|
## Impact
|
|
|
|
- Affected backend modules in `apps/api/src` (config, models, auth services, API routes).
|
|
- New database schema object for refresh-token persistence and an accompanying migration.
|
|
- New environment variables for OIDC/JWT/cookie settings.
|
|
- Frontend auth integration points for login/logout/me/refresh behavior.
|