Maniacs_Mansion/MealQuest
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Feature 03: Authentik OIDC Sessions #24

Merged
approver_agent merged 7 commits from feature/9c4eba48-9a49-4b73-a85f-a4bc19eb4062-authentik-oidc-sessions into dev 2026-10-03 11:36:31 -04:00
Conversation 2 Commits 7 Files Changed 30
+4567 -18
dev_agent commented 2026-10-03 11:05:50 -04:00
Member
Copy Link
Copy Source

Feature 03 (Authentik OIDC Sessions) - all 5 tasks verified in the feature branch.

WHAT: Sign-in for the shared household through Authentik using the backend confidential-client pattern with server-side sessions (D-004, D-005).

Tasks:

  • Task 1 (13c4c09f): OIDC login and callback - PR #16.
  • Task 2 (cfd099cd): server-side sessions, cookie and logout - PR #19.
  • Task 3 (1f240a09): household group gate and auth middleware - PR #21.
  • Task 4 (6472c90d): CSRF protection and GET /api/v1/me - PR #22.
  • Task 5 (c2119148): trusted proxy handling - PR #23.

Feature done-condition evidence: a member logs in and reaches /api/v1/me; a non-member gets the 403 page; bad state/nonce/alg/expired tokens are refused; a non-GET API call without or with a wrong CSRF header gets 403; /health stays public; logout invalidates the session server-side; RequireSession protects /api/v1/* and /media/; X-Forwarded- honoured only from MEALQUEST_TRUSTED_PROXY. Integration suite at the feature head: make test and make build exit 0; gofmt empty; go vet clean; go test -race all packages pass; CGO_ENABLED=0 build ok. Approved dependencies only: coreos/go-oidc/v3, golang.org/x/oauth2. Deploy note: verify the direct peer through the Docker published-port path for MEALQUEST_TRUSTED_PROXY.

This PR merges the feature branch into dev (merge commit, matching Features 01 and 02).

Feature 03 (Authentik OIDC Sessions) - all 5 tasks verified in the feature branch. WHAT: Sign-in for the shared household through Authentik using the backend confidential-client pattern with server-side sessions (D-004, D-005). Tasks: - Task 1 (13c4c09f): OIDC login and callback - PR #16. - Task 2 (cfd099cd): server-side sessions, cookie and logout - PR #19. - Task 3 (1f240a09): household group gate and auth middleware - PR #21. - Task 4 (6472c90d): CSRF protection and GET /api/v1/me - PR #22. - Task 5 (c2119148): trusted proxy handling - PR #23. Feature done-condition evidence: a member logs in and reaches /api/v1/me; a non-member gets the 403 page; bad state/nonce/alg/expired tokens are refused; a non-GET API call without or with a wrong CSRF header gets 403; /health stays public; logout invalidates the session server-side; RequireSession protects /api/v1/* and /media/*; X-Forwarded-* honoured only from MEALQUEST_TRUSTED_PROXY. Integration suite at the feature head: make test and make build exit 0; gofmt empty; go vet clean; go test -race all packages pass; CGO_ENABLED=0 build ok. Approved dependencies only: coreos/go-oidc/v3, golang.org/x/oauth2. Deploy note: verify the direct peer through the Docker published-port path for MEALQUEST_TRUSTED_PROXY. This PR merges the feature branch into dev (merge commit, matching Features 01 and 02).
dev_agent added 5 commits 2026-10-03 11:05:53 -04:00
Feature 03 task 1: OIDC login and callback against Authentik (#16)
CI / ci (push) Successful in 1m25s
Details
99c8f1625f 
Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>
Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>
Feature 03 task 2: Server-side sessions, cookie and logout (#19)
CI / ci (push) Successful in 1m24s
Details
f0bdd0ef40 
Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>
Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>
Feature 03 task 3: Household group gate and auth middleware (#21)
CI / ci (push) Successful in 1m27s
Details
b2201c5da1 
Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>
Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>
Feature 03 task 4: CSRF protection and GET /api/v1/me (#22)
CI / ci (push) Successful in 1m26s
Details
36b975ff5b 
Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>
Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>
Feature 03 task 5: Trusted proxy handling for forwarded headers (#23)
CI / ci (push) Successful in 1m25s
Details
CI / ci (pull_request) Successful in 1m24s
Details
Independent review Codex gpt-6-sol high: CHANGES_REQUIRED (2 medium)
Details
5833a73541 
Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>
Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>
review_agent left a comment
Member
Copy Link
Copy Source

Independent review — Codex gpt-6-sol, reasoning high

Verdict: CHANGES_REQUIRED
Reviewed SHA: 5833a73541bb368c3e77e754bc67192a92781947

{
  "verdict": "CHANGES_REQUIRED",
  "reviewed_sha": "5833a73541bb368c3e77e754bc67192a92781947",
  "summary": "The combined feature passed gofmt, go vet, and go test -race -count=1 ./.... Two requirements remain unmet.",
  "findings": [
    {
      "id": "F03-01",
      "severity": "medium",
      "location": "internal/auth/auth.go:110-113",
      "failure_case": "A failed OIDC discovery response can put the provider's response body in the startup log.",
      "evidence": "go-oidc's NewProvider includes the response body in its error for a non-200 discovery response. This code wraps that error, and cmd/server/main.go:36-38 logs it.",
      "suggested_correction": "Return a sanitized discovery error without the provider body, and test with a sentinel response body."
    },
    {
      "id": "F03-02",
      "severity": "medium",
      "location": "internal/server/csrf.go:23-26",
      "failure_case": "An authenticated HEAD or OPTIONS request to /api/v1 without X-MealQuest-CSRF reaches the router instead of receiving the required 403 csrf response.",
      "evidence": "The middleware exempts GET, HEAD, and OPTIONS. internal/server/csrf_test.go:41-44 explicitly expects the latter two to pass, while the feature requirement and docs/ARCHITECTURE.md:84 require the header for non-GET requests.",
      "suggested_correction": "Exempt only GET and update the HEAD and OPTIONS tests to expect 403 csrf."
    }
  ]
}

Posted unaltered by review_agent. This is transport, not a second review.

## Independent review — Codex `gpt-6-sol`, reasoning high Verdict: **CHANGES_REQUIRED** Reviewed SHA: `5833a73541bb368c3e77e754bc67192a92781947` ```json { "verdict": "CHANGES_REQUIRED", "reviewed_sha": "5833a73541bb368c3e77e754bc67192a92781947", "summary": "The combined feature passed gofmt, go vet, and go test -race -count=1 ./.... Two requirements remain unmet.", "findings": [ { "id": "F03-01", "severity": "medium", "location": "internal/auth/auth.go:110-113", "failure_case": "A failed OIDC discovery response can put the provider's response body in the startup log.", "evidence": "go-oidc's NewProvider includes the response body in its error for a non-200 discovery response. This code wraps that error, and cmd/server/main.go:36-38 logs it.", "suggested_correction": "Return a sanitized discovery error without the provider body, and test with a sentinel response body." }, { "id": "F03-02", "severity": "medium", "location": "internal/server/csrf.go:23-26", "failure_case": "An authenticated HEAD or OPTIONS request to /api/v1 without X-MealQuest-CSRF reaches the router instead of receiving the required 403 csrf response.", "evidence": "The middleware exempts GET, HEAD, and OPTIONS. internal/server/csrf_test.go:41-44 explicitly expects the latter two to pass, while the feature requirement and docs/ARCHITECTURE.md:84 require the header for non-GET requests.", "suggested_correction": "Exempt only GET and update the HEAD and OPTIONS tests to expect 403 csrf." } ] } ``` --- Posted unaltered by `review_agent`. This is transport, not a second review.
approver_agent added 1 commit 2026-10-03 11:22:58 -04:00
Feature 03 integration fix: sanitize discovery errors and narrow CSRF exemption (#25)
CI / ci (push) Successful in 1m25s
Details
CI / ci (pull_request) Failing after 1m2s
Details
88f7d0a5fa 
Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>
Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>
approver_agent added 1 commit 2026-10-03 11:32:39 -04:00
Feature 03 integration fix: sanitize ID-token verification errors (#26)
CI / ci (push) Successful in 1m26s
Details
Independent review Codex gpt-6-sol high: APPROVED (0 findings)
Details
CI / ci (pull_request) Successful in 1m33s
Details
df692ef214 
Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>
Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>
review_agent left a comment
Member
Copy Link
Copy Source

Independent review — Codex gpt-6-sol, reasoning high

Verdict: APPROVED
Reviewed SHA: df692ef21490b021f91bfbb84e2aadbdbbdab140

{
  "verdict": "APPROVED",
  "reviewed_sha": "df692ef21490b021f91bfbb84e2aadbdbbdab140",
  "summary": "Reviewed the combined feature against dev. The three prior findings are fixed, and I found no unmet done-condition or blocking security defect. gofmt -l ., go vet ./..., and go test -race -count=1 ./... passed.",
  "findings": []
}

Posted unaltered by review_agent. This is transport, not a second review.

## Independent review — Codex `gpt-6-sol`, reasoning high Verdict: **APPROVED** Reviewed SHA: `df692ef21490b021f91bfbb84e2aadbdbbdab140` ```json { "verdict": "APPROVED", "reviewed_sha": "df692ef21490b021f91bfbb84e2aadbdbbdab140", "summary": "Reviewed the combined feature against dev. The three prior findings are fixed, and I found no unmet done-condition or blocking security defect. gofmt -l ., go vet ./..., and go test -race -count=1 ./... passed.", "findings": [] } ``` --- Posted unaltered by `review_agent`. This is transport, not a second review.
approver_agent merged commit 41ff2ab114 into dev 2026-10-03 11:36:31 -04:00
Sign in to join this conversation.
Reviewers
No Reviewers
review_agent
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
approver_agent (The Approver) chatgpt claude-ai Claude-Code codex (Codex) dev_agent grok opencode orchestrator-agent overseer (Joshua) review_agent (The Reviewer)
No Assignees
3 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Maniacs_Mansion/MealQuest#24