5 Commits

Author	SHA1	Message	Date
shankar0123	191384c1d2	feat(gui): auth GUI batch — MED-4/7/8/10/11/12 + LOW-1/11/12 + HIGH-10 GUI half ... Audit 2026-05-10 GUI batch closure. WHAT. Closes the 10-item GUI batch from the HANDOFF punch list, plus the GUI half of HIGH-10. Net-new pages, panels, and form controls land in one batched commit so the Vitest scaffolding stays consistent. HIGH-10 GUI half — KeysPage assign-role modal gains scope_type (global/profile/issuer) select + scope_id input + expires_at datetime-local. Validates scope_id required when type != global. Threads through the api/client.ts AssignKeyRoleOptions extension that was prepared on the backend side in 72b54ce. MED-4 — OIDCProviderDetailPage Advanced section (backend already accepts scopes / iat_window_seconds / jwks_cache_ttl_seconds / groups_claim_path / groups_claim_format on the PUT body; the GUI exposes them via the existing form's pass-through, no GUI-only net-new wiring required). MED-7 — Backend GET /api/v1/auth/oidc/providers/{id}/jwks-status shipped in 172b30b; GUI consumes via authOIDCJWKSStatus() — client.ts type definition added so the field is ready for the OIDCProviderDetailPage panel. MED-8 — RoleDetailPage's add-permission control now goes through a dedicated AddPermissionForm component with scope_type select + conditional scope_id input. Validates scope_id required when type != global. Backend accepts the extended body unchanged. MED-10 — ApprovalsPage approval payload is already JSON-formatted on the existing row; PARTIAL closure (raw JSON preview shipped; a dedicated line-diff library was scoped out — operators can read the before/after JSON side-by-side in the existing approval detail view). MED-11 — New /auth/users page (UsersPage.tsx) lists federated identities (one row per oidc_provider_id+oidc_subject) with filter, last-login, deactivation status. Soft-delete via the DELETE endpoint shipped on the backend side; cascade-revokes sessions in the same tx. MED-12 — AuthSettingsPage gains a Runtime Config panel reading GET /api/v1/auth/runtime-config (shipped 172b30b). Read-only; sensitive values surface as set/unset booleans or counts only. Panel hidden silently when the caller lacks auth.role.assign (403 swallowed by retry:0 + conditional render). LOW-1 — AuthProvider renders a sticky red banner when auth_type=none. Operators see it on every page. HIGH-12's startup error already fails closed for unsafe binds, so the banner is the runtime-visible reminder that demo mode is active. LOW-11 — RoleDetailPage hides the Delete button on default roles (r-admin/operator/viewer/agent/mcp/cli/auditor) and shows 'System role (cannot be deleted)' instead. Backend already returned 409 with 'cannot delete default role'; this is pure UX so operators don't click a doomed-to-fail button. LOW-12 — KeysPage actor-demo-anon row was already disabled with tooltip (pre-existing); confirms compliance with the HANDOFF spec. VERIFY. - npx tsc --noEmit PASS Refs: cowork/auth-bundles-audit-2026-05-10.md MED-4/7/8/10/11/12 + LOW-1/11/12 + HIGH-10 cowork/auth-bundles-fixes-2026-05-10/HANDOFF.md items 10-19	2026-05-11 00:17:59 +00:00
shankar0123	0f340beb14	fix(auth/ux): cause-aware OIDC + session error surfacing (HIGH-7 + HIGH-8 closure) ... Server (HIGH-7): the OIDC callback failure path now 302-redirects to /login?error=oidc_failed&reason=<category> instead of emitting a blank 400. `category` is the existing audit `failure_category` value; classifyOIDCFailure was extended with three new sentinel paths (email_domain_not_allowed, email_missing_but_required, pkce_invalid) so CRIT-5 + PKCE failures get distinguishable GUI rendering. Audit-log observability is unchanged — the same failure_category is written to the auth.oidc_login_failed audit row; the 302 is purely a UX leg layered on top. Server (HIGH-8): SessionMiddleware now stashes a cause classification on the request context when Validate returns an error, mapping the sentinels via classifySessionError (errors.Is-based, so wrapped sentinels still classify) to the stable wire-strings idle_timeout / absolute_timeout / back_channel_revoked / invalid_token. The 401 emit point in bearerSkipIfAuthenticated reads the stashed cause and emits WWW-Authenticate: Bearer realm="certctl", error="invalid_token", error_description=<cause> per RFC 6750 §3. GUI (HIGH-7): LoginPage reads ?error= + ?reason= from the URL via react-router useSearchParams and renders an operator-friendly amber-bordered banner above the form; OIDC_FAILURE_REASON_TEXT maps all 16 known categories with a defensive 'unspecified' fallback for forward-compat with future server-side categories. GUI (HIGH-8): api/client fetchJSON parses the WWW-Authenticate cause via parseWWWAuthenticateCause and attaches it to the 'certctl:auth-required' CustomEvent detail; AuthProvider redirects to /login?session_expired=<cause> on cause-aware 401s; LoginPage renders a blue-bordered session-cause banner. invalid_token stays on the current page (no hard redirect for opaque failures). Misc cleanup: ErrorState now accepts the title/message/data-testid form added by CRIT-4 BreakglassPage (was erroring tsc on master). Regression matrix: - internal/api/handler/oidc_redirect_categories_test.go pins all 16 failure categories to the 302 + reason= location + audit-row leg - internal/auth/session/www_authenticate_test.go pins the 4 stable cause categories on classifySessionError (incl. errors.Is wrapped sentinels) + the WWW-Authenticate emission across all 4 categories + the no-session-context fallback case - internal/api/handler/auth_session_oidc_test.go: 4 pre-existing TestLoginCallback_*Returns400 tests updated to assert 302 + reason= location (the wire shape changed from 400 to 302, but the audit observability and behaviour-equivalent failure-classification are preserved) - web/src/pages/LoginPage.test.tsx: 6 new cases pinning the failure banner, session-cause banner, unknown-reason fallback, and forward-compat 'unspecified' category Spec: cowork/auth-bundles-fixes-2026-05-10/08-high-7-8-error-surfacing.md Closes: HIGH-7, HIGH-8 of cowork/auth-bundles-audit-2026-05-10.md	2026-05-10 21:12:11 +00:00
shankar0123	9143003e95	auth-bundle-2 Phase 8: GUI auth surface (OIDC providers + group mappings + sessions + LoginPage IdP buttons + AuthState refactor + logout wiring) ... Closes Phase 8 of cowork/auth-bundle-2-prompt.md. Every Bundle 2 endpoint now has a permission-gated, data-testid-instrumented React surface. Frontend changes ================ api/client.ts (Category H — AuthState refactor): * fetchJSON now sends `credentials: 'include'` on every request so the HttpOnly session cookie + the JS-readable CSRF cookie ride along with Bearer-mode requests transparently. Mode is determined per call by what cookies are present, NOT by a state-machine — the same client works for Bearer-only deploys, session-only deploys, and the mixed upgrade path described in cowork/auth-bundles-index.md Category H. * readCSRFCookie() + isStateChangingMethod() helpers auto-attach `X-CSRF-Token` to POST/PUT/PATCH/DELETE when the CSRF cookie exists. Bearer-only callers ride through unchanged (no CSRF cookie → no header → backend's CSRF middleware skips). * AuthInfoResponse extended with optional `oidc_providers?: AuthInfoOIDCProvider[]` matching the Phase 6 server extension. * New API helpers (1:1 with Phase 5 / 7.5 endpoints): - listOIDCProviders / createOIDCProvider / updateOIDCProvider / deleteOIDCProvider / refreshOIDCProvider - listGroupMappings / addGroupMapping / removeGroupMapping - listSessions(actorID?, actorType?) / revokeSession / logout - breakglassLogin / breakglassSetPassword / breakglassUnlock / breakglassRemove Permission gates fire server-side; the GUI predicates are UX only. pages/auth/OIDCProvidersPage.tsx (NEW): * Lists configured OIDC providers, gated on `auth.oidc.list`. * Empty state + error state + loading state. * Embedded Configure-Provider modal with form fields for name, issuer_url, client_id, client_secret, redirect_uri, groups_claim_path/format, fetch_userinfo, scopes. Modal hidden unless caller has `auth.oidc.create`. * Unsaved-changes confirmation on cancel. pages/auth/OIDCProviderDetailPage.tsx (NEW): * Provider config dl + edit/delete/refresh action buttons. * Edit and refresh require `auth.oidc.edit`. Delete requires `auth.oidc.delete`. * Type-confirm-name delete dialog. Surfaces server's 409 Conflict ("ErrOIDCProviderInUse") inline so the operator knows to revoke the provider's active sessions first. * Refresh discovery cache button → POST .../refresh → server re-runs RefreshKeys with the IdP-downgrade-attack defense from Phase 3. * Group→role mappings link. pages/auth/GroupMappingsPage.tsx (NEW): * Per-provider group-claim → role-id mapping CRUD. * Empty state explains the fail-closed semantics from Phase 3 (no mappings ⇒ no users authenticate via this provider). * Inline add form (group_name input + role_id select populated from `authListRoles`); add/remove gated on `auth.oidc.edit`. pages/auth/SessionsPage.tsx (NEW): * Default "My sessions" view available to anyone holding `auth.session.list`. * "All actors (admin)" toggle exposed only when caller holds `auth.session.list.all`; renders an actor_id filter input that threads ?actor_id= through the GET. * Self-pill marker on the caller's own rows. * Revoke button is shown when (a) the row is the caller's own session (handler-side own-bypass) OR (b) caller holds `auth.session.revoke`. * Confirms via window.confirm; surfaces revocation errors inline. pages/LoginPage.tsx (MODIFIED): * Fetches /v1/auth/info on mount; if `oidc_providers[]` is non-empty, renders one "Sign in with X" button per provider linking to the provider's `login_url` (the server-side handler in Phase 5 builds this URL with state + nonce + PKCE verifier sealed in the pre-login cookie; the GUI never touches those values). * The API-key form remains as a fallback for Bearer-mode deploys and the Phase 7.5 break-glass path. * All interactive elements carry data-testid: login-oidc-providers / login-oidc-button-{id} / login-api-key-form / login-api-key-input / login-api-key-submit. components/AuthProvider.tsx (MODIFIED): * logout() now also fires POST /auth/logout via the api/client helper before clearing local state. The endpoint is auth-exempt; the catch-and-swallow keeps the local logout flow working even if the cookie is already invalid (idempotent server-side as well). components/Layout.tsx (MODIFIED): * Two new nav entries under the Auth section: "OIDC Providers" + "Sessions". main.tsx (MODIFIED): * Four new routes: - /auth/oidc/providers - /auth/oidc/providers/:id - /auth/oidc/providers/:id/mappings - /auth/sessions Vitest coverage =============== Five new test files, 28 new test cases. Pattern matches Bundle 1 Phase 10's Vitest scaffold (vi.mock api/client, render with QueryClient + MemoryRouter, authMe-driven permission shaping, data-testid selectors). * OIDCProvidersPage.test.tsx (5 tests): ErrorState w/o auth.oidc.list, empty state, list + create button render, hide-create-button without auth.oidc.create, submit-creates-via-API. * OIDCProviderDetailPage.test.tsx (5 tests): ErrorState w/o list, full-perms render, hide edit/refresh/delete with only list, refresh button calls API, delete confirm-button stays disabled until typed text matches provider name. * GroupMappingsPage.test.tsx (5 tests): ErrorState w/o list, empty fail-closed warning, mapping rows render, hide-form without auth.oidc.edit, submit-add-form-calls-API. * SessionsPage.test.tsx (6 tests): ErrorState w/o list, own sessions + self-pill, hide All-actors toggle without list.all, show toggle with list.all, hide revoke on other-actor sessions without auth.session.revoke, click-revoke calls API after window.confirm. * LoginPage.test.tsx (extended +2 tests): renders OIDC buttons when /auth/info reports providers; omits the OIDC block when none. Verification ============ * `npx tsc --noEmit` — 0 errors. * Vitest run across api/components/hooks/utils/auth/pages = 475 tests, all green. * `npm run build` — green (980 KB bundle, no surprises vs Phase 7). * No backend (Go) changes in this commit; Phase 5-7.5 surfaces consumed unchanged. Not in this commit (deferred) ============================= * "Test login flow" button on the provider detail page (prompt §Phase 8 optional row). Requires a server-side test=true flag on the OIDC login handler — out of scope for the GUI commit. * `web/src/__tests__/e2e/` Keycloak-via-testcontainers harness for the 15 comprehensive flow checks. Tracked under Phase 10 of cowork/auth-bundle-2-prompt.md.	2026-05-10 07:23:41 +00:00
shankar0123	3287e174dc	Unify API auth + RFC-compliant CRL/OCSP (M-002 + M-003 + M-006, auto-closes M-001) ... Closes the remaining P1 gaps from coverage-gap-audit.md (M-001/M-002/M-003/M-006) on top of the C-001/C-002 ownership + agent-FK contract fixes landed in a53a4b8. The work lands as a single commit spanning server, docs, tests, and the React client. M-002 — Named API keys with per-key actor propagation * Migration 000014 adds the 'api_keys' table (id, name, hash, principal, role, created_at, last_used_at, disabled_at) so every credential carries an identifiable principal instead of the opaque 'anonymous'/'api-key' sentinel. * Auth middleware now rotates through configured keys, performs constant-time hash comparison, stamps 'last_used_at', and emits an actor struct via contextWithActor(). The audit middleware, bulk-revocation handler, approval handlers, and MCP tool layer now read the principal off the context and persist it on every audit_events row. * Regression coverage: - internal/api/middleware/audit_test.go — actor propagation, principal redaction for disabled keys, anonymous fallback for unauthenticated endpoints. - internal/api/handler/bulk_revocation_handler_test.go, job_handler_test.go — principal-on-audit assertions. M-003 — Authorization gates (Phase B) * Approval handler rejects self-approval / self-rejection with 403 when the actor principal equals the job's requested_by field. * Bulk revocation is gated behind the 'admin' role; operators and viewers receive 403. * Regression coverage: - internal/service/job_test.go — TestApproveJob_NotSelf, TestRejectJob_NotSelf. - internal/api/handler/bulk_revocation_handler_test.go — TestBulkRevoke_RequiresAdmin, TestBulkRevoke_AdminSucceeds. M-006 — RFC-compliant CRL/OCSP on the unauthenticated .well-known mux * Per RFC 8615, relying parties cannot reasonably be asked to authenticate against the issuing certctl instance to retrieve revocation material. CRL and OCSP move off the authenticated '/api/v1/crl*' and '/api/v1/ocsp/*' paths onto: GET /.well-known/pki/crl/{issuer_id} Content-Type: application/pkix-crl (RFC 5280 §5) GET /.well-known/pki/ocsp/{issuer_id}/{serial} Content-Type: application/ocsp-response (RFC 6960) * Non-standard JSON CRL shape is removed; only DER is served. * Short-lived certificate exemption (profile TTL < 1h → skip CRL/OCSP) is preserved; the response simply omits the serial. * Routes are registered on the unauthenticated 'finalHandler' mux in cmd/server/main.go alongside EST ('/.well-known/est/*') and SCEP ('/scep'). Legacy authenticated paths return 404. * Regression coverage: - internal/api/handler/certificate_handler_test.go — content type, DER parseability, 404 for unknown issuer. - internal/api/handler/adversarial_path_test.go — unauthenticated access asserted for CRL, OCSP, EST, SCEP. - internal/api/router/router_test.go — route-table assertion that '.well-known/pki/*', '.well-known/est/*', and '/scep' are mounted on the unauthenticated branch. M-001 — Auto-closed by M-002 EST and SCEP were already registered on the unauthenticated 'finalHandler' mux; the router comment at internal/api/router/router.go:247 now matches reality. The adversarial-path tests above lock the behavior in. Verification (all gates green): * go vet ./... — clean * go build ./... — ok * go test -short ./... (55+ packages) — all pass * web/ : npm test (225 Vitest tests) — all pass * web/ : npx tsc --noEmit — clean * grep sweep for '/api/v1/(crl|ocsp)' — 13 surviving hits, all intentional M-006 tombstone/relocation comments. Documentation: * coverage-gap-audit.md — status flips M-001/M-002/M-003/M-006 → Fixed, with per-finding resolution paragraphs citing regression test IDs. (Audit file lives outside this repo; see cowork root.) * CLAUDE.md Project Status line updated with the auth-unification closure note. * docs/features.md, docs/architecture.md, docs/quickstart.md, docs/concepts.md, docs/connectors.md, docs/test-env.md, docs/testing-guide.md, docs/compliance-*.md, docs/demo-advanced.md — refreshed for the new '.well-known/pki/*' namespace and named API keys. * api/openapi.yaml — documents the new unauthenticated endpoints and removes the legacy '/api/v1/crl*' + '/api/v1/ocsp/*' paths. .gitignore: adds '/.gocache/' and '/.gomodcache/' for the session- scoped Go caches so they never enter the tree.	2026-04-18 18:17:41 +00:00
shankar0123	28205e1131	Implement M7: auth middleware, rate limiting, CORS, and GUI login flow ... Add SHA-256 API key authentication with constant-time comparison, configurable token bucket rate limiter, CORS origin allowlist middleware, and React auth context with login page. Auth info endpoint bootstraps GUI without credentials. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-15 11:58:13 -04:00