4 Commits

Include renames

Author	SHA1	Message	Date
dev_agentandClaude Opus 5.5	c824942484	End any existing session when a sign-in is refused ... A browser that still holds a session and signs in as an account outside the household's group got the 403 page but kept its old session. The refusal now ends that session and clears its cookie first. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 10:25:59 -04:00
dev_agentandClaude Opus 5.5	f9f10c3a53	Gate sign-in on household group and require a session for /api/v1 and /media ... The callback now starts a session only when the verified groups claim contains a group from MEALQUEST_OIDC_ALLOWED_GROUPS. When the ID token has no groups claim, groups come from the userinfo endpoint, whose subject must match the ID token. A refused sign-in gets a 403 HTML page ("This kitchen is for the household only") with a sign-out button, and no session. The check runs on every login, so an account removed from the group is refused at its next one. auth.New requires at least one allowed group and a discovered userinfo endpoint that passes the endpoint rule. The RequireSession middleware wraps the /api/v1 and /media subrouters: no live session gets 401 {"error":{"code":"unauthenticated",...}}, a lookup failure 500, and a live session reaches the handler with the actor in the context. It wraps the subrouters instead of using chi's Use because chi skips middleware on a subrouter with no routes. /health, /auth and the web build stay public. auth.WithActor and auth.ActorFrom are the one way to read the signed-in household member; handlers record Actor.Subject as updated_by. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 10:24:35 -04:00
dev_agent	f0bdd0ef40	Feature 03 task 2: Server-side sessions, cookie and logout (#19) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-03 10:20:14 -04:00
dev_agent	99c8f1625f	Feature 03 task 1: OIDC login and callback against Authentik (#16) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-03 09:58:05 -04:00