6 Commits

Include renames

Author	SHA1	Message	Date
dev_agentandClaude Opus 5.5	17d5152247	Stop refusing sign-in over a scheme other than the public URL's ... The auth routes no longer return 400 when the resolved request scheme differs from MEALQUEST_PUBLIC_URL's. If Docker's published-port path presents its bridge gateway instead of Traefik as the direct peer, the forwarded headers are rightly ignored, but sign-in must still work: the OIDC redirect URI and the Secure cookies are fixed by MEALQUEST_PUBLIC_URL, not by the request. internal/auth is back to its state before the trusted-proxy change; client IP and scheme resolution stays in the router. Add TestLoginThroughRouter: it wires the real auth flow and session manager through server.NewRouter, trusting Traefik only, and checks that a login from Traefik and from an untrusted peer both redirect with the redirect URI from MEALQUEST_PUBLIC_URL and set a Secure login cookie. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 11:01:25 -04:00
dev_agentandClaude Opus 5.5	7e49b72ad4	Honour forwarded headers only from MEALQUEST_TRUSTED_PROXY ... Add internal/forwarded: parse the trusted proxy list (comma-separated IPs and CIDRs, validated at load), resolve each request's client IP and scheme, and expose them through context helpers. X-Forwarded-For and X-Forwarded-Proto are honoured only when the TCP peer is trusted; the client is the rightmost X-Forwarded-For address that is not a trusted proxy. Malformed forwarded headers from a trusted peer get 400. The router resolves every request first; a slog handler adds client_ip to request-scoped log lines. The auth routes refuse requests whose resolved scheme differs from MEALQUEST_PUBLIC_URL's, so a proxy that is not trusted fails loudly instead of breaking Secure cookies. The OIDC redirect URI is still built only from MEALQUEST_PUBLIC_URL. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 10:57:23 -04:00
dev_agent	36b975ff5b	Feature 03 task 4: CSRF protection and GET /api/v1/me (#22) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-03 10:51:26 -04:00
dev_agent	b2201c5da1	Feature 03 task 3: Household group gate and auth middleware (#21) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-03 10:30:07 -04:00
dev_agent	f0bdd0ef40	Feature 03 task 2: Server-side sessions, cookie and logout (#19) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-03 10:20:14 -04:00
dev_agent	99c8f1625f	Feature 03 task 1: OIDC login and callback against Authentik (#16) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-03 09:58:05 -04:00