Add backend OIDC: /api/v1/auth/oidc/status|login|callback (authorization code +
PKCE, state+nonce cookies, ID-token verification via go-oidc) and admin
/auth/oidc/config (GET/PUT, validates the issuer via discovery on enable).
Config resolves app_settings (UI) > env > default, so SSO can be configured from
the UI while env still seeds it. LoginOIDC provisions/links federated users by
the stable (issuer, subject) pair, refusing to reuse a username held by a
different account. Verified: discovery + real authorize redirect + PKCE cookies;
config API with DB-over-env precedence; provisioning unit-tested.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add runtime TLS modes resolved via settings (UI wins over env): auto
(self-managed), provided (bring-your-own upload), and windows-store (Windows
cert store, enumeration/serving scaffolded). New /api/v1/tls endpoints: status,
mode, certificate upload, and windows-store list; changes reload the live
manager without a restart, falling back to the self-managed cert if a configured
source is unavailable. Auto SANs now cover the hostname (CN), localhost, every
non-loopback IP, and host.<suffix> + the suffix for each detected DNS suffix
(Windows registry / resolv.conf). Bring-your-own is validated and unit-tested.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add internal/pki: generate a Root CA -> Intermediate CA -> server leaf, re-issue
leaves under a persisted CA for renewal, and export the chain as PEM
(cert/key/fullchain), DER (.cer), and PKCS#12 (.pfx). Unit-tested: the chain
verifies, the PFX decodes with the CA chain, and a reloaded CA re-issues a
valid leaf.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Replace mattn/go-sqlite3 (CGO) with modernc.org/sqlite and the modernc-based
golang-migrate driver, translating the DSN pragmas. This lets every target
(win/mac/linux, amd64/arm64) cross-compile from one runner with no C toolchain,
so the Docker build now sets CGO_ENABLED=0 and drops gcc/musl-dev. Verified:
DB opens (WAL + foreign keys), migrations run, bootstrap seeds admin.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- API response helpers and error codes
- Authentication handlers (login, logout, me, csrf)
- Auth middleware (session validation, role checks, CSRF)
- LDAP client with TLS/StartTLS support
- LDAP filter construction from conditions
- AD operations (group membership, move, create group/OU)
- Credentials repository (CRUD, test results, usage check)
- AD connections repository (CRUD, test results)
- Schedules repository (CRUD, next run tracking)
- Rules repository with nested condition groups and actions
- go-ldap/ldap/v3 dependency added
Phase 1 foundations:
- Go backend with Chi router framework
- SQLite database with WAL mode and foreign keys
- Database migrations for users, roles, credentials, AD connections, schedules, rules, and audit
- CLI commands: init, run, install, uninstall, start, stop, migrate, backup, restore, doctor
- Configuration loading from environment variables
- Centralized logging with file rotation (lumberjack)
- Crypto package for Argon2id password hashing and AES-GCM encryption
- Auth service with session management
- Audit service for event logging
- Scheduler with 6-field cron support
- REST API routes scaffolded for all major resources
- CORS support with localhost defaults for development
- Docker support with Dockerfile and docker-compose.yml
- Multi-platform build script (PowerShell)
- Project structure per design specification
Version format: yyyy.MM.dd.HHmm
All PKs are UUIDv4, all timestamps UTC
Alphaeus Mote