steveandClaude Opus 4.8
84edf3e42a
OIDC is pansy's primary login path (Authentik the target IdP); local auth (#4) remains the fallback and both issue the same session cookie. - deps: github.com/coreos/go-oidc/v3 + golang.org/x/oauth2 (both pure Go; CGO stays off). - api/oidc.go: lazy issuer discovery (retried per-request, never crashes a server that also serves local auth), GET /auth/oidc/login builds an authorization-code URL with PKCE S256 + random state + nonce stashed in a short-lived HttpOnly cookie, GET /auth/oidc/callback verifies state (constant-time), exchanges the code with the PKCE verifier, verifies the ID token + nonce, and starts a pansy session. Failures redirect to /login?error=... ; success to /gardens. - service.LoginOIDC: (issuer,subject) match -> login; else *verified* email match -> link onto the existing account; else JIT-create (the IdP gates access, so PANSY_REGISTRATION doesn't apply). Unverified email colliding with an existing account is refused (takeover guard); no email is refused (email is the account key). Reuses the atomic CreateUser. - store: GetUserByOIDC + LinkOIDC (unique-pair backstop). - config: OIDCReady() (needs issuer+client+BaseURL for the redirect URI); /auth/providers now reports oidc from it and defaults the button label to "Sign in with Authentik". OIDC routes are only registered when ready, so an unconfigured instance 404s them. - PANSY_LOCAL_AUTH=false rejects/hides local auth but not OIDC. Tests: service provisioning (JIT, repeat login, link, unverified-collision refusal, no-email, name fallback, works with local auth off); api (routes-absent-when-unconfigured, providers reporting, login redirect with PKCE params + tx cookie via a fake discovery server, callback state/error paths). Smoke-tested: unreachable issuer degrades to error=oidc_unavailable with the server still up and local auth working. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi
55 lines
2.2 KiB
AMPL
55 lines
2.2 KiB
AMPL
module gitea.stevedudenhoeffer.com/steve/pansy
|
|
|
|
go 1.26.2
|
|
|
|
require (
|
|
github.com/coreos/go-oidc/v3 v3.20.0
|
|
github.com/gin-gonic/gin v1.10.1
|
|
github.com/samber/slog-gin v1.15.0
|
|
golang.org/x/crypto v0.31.0
|
|
golang.org/x/oauth2 v0.36.0
|
|
modernc.org/sqlite v1.34.4
|
|
)
|
|
|
|
require (
|
|
github.com/bytedance/sonic v1.11.9 // indirect
|
|
github.com/bytedance/sonic/loader v0.1.1 // indirect
|
|
github.com/cloudwego/base64x v0.1.4 // indirect
|
|
github.com/cloudwego/iasm v0.2.0 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/gabriel-vasile/mimetype v1.4.4 // indirect
|
|
github.com/gin-contrib/sse v0.1.0 // indirect
|
|
github.com/go-jose/go-jose/v4 v4.1.4 // indirect
|
|
github.com/go-playground/locales v0.14.1 // indirect
|
|
github.com/go-playground/universal-translator v0.18.1 // indirect
|
|
github.com/go-playground/validator/v10 v10.22.0 // indirect
|
|
github.com/goccy/go-json v0.10.3 // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.2.8 // indirect
|
|
github.com/leodido/go-urn v1.4.0 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
|
github.com/ncruces/go-strftime v0.1.9 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.2.2 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
|
|
github.com/ugorji/go/codec v1.2.12 // indirect
|
|
go.opentelemetry.io/otel v1.29.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.29.0 // indirect
|
|
golang.org/x/arch v0.8.0 // indirect
|
|
golang.org/x/net v0.33.0 // indirect
|
|
golang.org/x/sys v0.28.0 // indirect
|
|
golang.org/x/text v0.21.0 // indirect
|
|
google.golang.org/protobuf v1.34.2 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
modernc.org/gc/v3 v3.0.0-20240107210532-573471604cb6 // indirect
|
|
modernc.org/libc v1.55.3 // indirect
|
|
modernc.org/mathutil v1.6.0 // indirect
|
|
modernc.org/memory v1.8.0 // indirect
|
|
modernc.org/strutil v1.2.0 // indirect
|
|
modernc.org/token v1.1.0 // indirect
|
|
)
|