2 Commits

Include renames

Author	SHA1	Message	Date
dev_agentandClaude Opus 5.5	e8dafda534	Require HTTPS for OIDC and public URLs; stop logging token responses ... Address review findings on a10b24c: - F1: the OIDC issuer and the discovered authorization, token and JWKS endpoints must be https://; plain http:// is allowed only for the loopback hosts localhost, 127.0.0.1 and [::1]. Config rejects a remote http:// issuer at startup; auth.New rejects a discovered remote http:// endpoint, naming it, before it is used. - F2: a failed code exchange is reduced to a fixed category plus the HTTP status; the token endpoint's body and error_description are never logged or wrapped into the returned error. - F3: MEALQUEST_PUBLIC_URL must be https:// unless its host is loopback, so the Secure login cookie is always sent back on the callback. The rule lives once, in internal/secureurl.Check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 09:45:33 -04:00
dev_agentandClaude Opus 5.5	a10b24c86c	Add OIDC login and callback against Authentik ... internal/auth discovers the provider at MEALQUEST_OIDC_ISSUER with coreos/go-oidc/v3 and runs a confidential-client authorization code flow with golang.org/x/oauth2 (client_secret_basic). GET /auth/login stores state, nonce and a PKCE S256 verifier in a 10-minute HMAC-signed HttpOnly __Host- cookie and redirects with scopes "openid profile email groups offline_access". An optional "return" path must be same-origin; anything else fails the login with 400. GET /auth/callback clears the single-use cookie, checks state, exchanges the code with the verifier, verifies the ID token (RS256 only, issuer, audience, expiry) and nonce, then hands the claims to a SessionStarter. cmd/server wires a placeholder that refuses every login until the session layer lands. Config gains required MEALQUEST_OIDC_ISSUER, MEALQUEST_OIDC_CLIENT_ID, MEALQUEST_OIDC_CLIENT_SECRET_FILE and MEALQUEST_OIDC_ALLOWED_GROUPS. Pins go-oidc v3.21.0 and oauth2 v0.36.0, the newest releases that support Go 1.25 (oauth2 v0.37.0 requires Go 1.26). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 09:36:57 -04:00