Task 630c3472: Authentik OIDC PKCE login and refusal handling #188

2026-09-23T17:19:22-04:00

dev_agent commented

2026-09-23 17:19:22 -04:00

Maestro task 630c3472 (Authentik OIDC PKCE login and refusal handling), Feature 19 - Admin PWA.

Adds authorization-code + PKCE login against Authentik (public client, no secret): pkce.ts (S256), oidc.ts (authorize URL, state check, token exchange, sessionStorage store, refresh/logout), api/client.ts (Bearer attach; 401 -> login, 403 -> ApiForbiddenError), AppRoutes.tsx (minimal path routing for / and /auth/callback, login/loading/config-error/explicit-refusal screens), and a committed admin/.env.example. Tests stub the provider (no real network).

Evidence (developer): npm run build exit 0; npm test 20 tests passed incl. the existing four-tab suite.

Maestro task 630c3472 (Authentik OIDC PKCE login and refusal handling), Feature 19 - Admin PWA. Adds authorization-code + PKCE login against Authentik (public client, no secret): pkce.ts (S256), oidc.ts (authorize URL, state check, token exchange, sessionStorage store, refresh/logout), api/client.ts (Bearer attach; 401 -> login, 403 -> ApiForbiddenError), AppRoutes.tsx (minimal path routing for `/` and `/auth/callback`, login/loading/config-error/explicit-refusal screens), and a committed admin/.env.example. Tests stub the provider (no real network). Evidence (developer): `npm run build` exit 0; `npm test` 20 tests passed incl. the existing four-tab suite.

dev_agent added 1 commit 2026-09-23 17:19:22 -04:00

Add Authentik OIDC PKCE login and refusal handling to admin PWA ad54275875

review_agent approved these changes

2026-09-23 18:20:43 -04:00

Dismissed

review_agent left a comment

Independent Claude Sonnet 5 review completed for this exact commit.

overseer added 1 commit 2026-09-23 18:27:05 -04:00

Fix review findings: OIDC discovery endpoints, dead 403 branch, retry error labeling 482e254f3f

- config.ts: resolve authorize/token/userinfo/end-session/jwks endpoints from
  the issuer's OIDC discovery document (cached per session) instead of
  hardcoding the production host; non-default issuers now resolve all
  endpoints from their own discovery document, and discovery failures surface
  a clear ConfigError with no silent fallback.
- auth/oidc.ts: all flows (buildAuthorizeUrl, handleCallback,
  refreshAccessToken, logout) resolve endpoints via discovery; logout is now
  async.
- AppRoutes.tsx: remove the dead response.status === 403 branch in probeApi
  (apiFetch already throws ApiForbiddenError) and surface ConfigError as the
  configuration error screen.
- api/client.ts: post-refresh retry maps only 401 to ApiUnauthorizedError and
  preserves other statuses (e.g. 500) on the returned response.

Tests: add discovery resolution tests (config.test.ts), discovery-based
authorize URL test (oidc.test.ts), and retry-500 labeling test
(client.test.ts); adapt logout test to the async signature.

review_agent approved these changes

2026-09-23 18:29:36 -04:00

review_agent left a comment

Independent Claude Sonnet 5 review completed for this exact commit.

dev_agent merged commit 75ad9892b8 into feature/24ce7ebf-40cc-432f-976d-f0814b8a375c-admin-pwa

2026-09-23 18:30:07 -04:00

dev_agent referenced this pull request

2026-09-23 23:55:34 -04:00

Feature 19: Admin PWA (#187-#210) #211

Sign in to join this conversation.