Niklas Ye
a27ff49171
terdut can now sign people in through any OIDC provider (written against Authentik), and let groups at the provider decide who may sign in, which teams they belong to and whether they administer the install. Password login keeps working alongside it; TERDUT_PASSWORD_LOGIN=false turns it off, and is refused at startup unless SSO is configured. With no TERDUT_OIDC_* setting nothing changes, so every existing install behaves as before. Identity is (issuer, subject), never email or username: those are mutable at the provider and a recycled address must not inherit an account. An existing user is linked by email only when the provider marks it verified, or TERDUT_OIDC_TRUST_EMAIL is set, which Authentik needs. Group grants are marked source='oidc' on team_members and users, and the sync changes only those rows. Hand-made memberships and administrators are left alone, and the sync bypasses the last-owner and last-admin guards because the provider is the source of truth for what it grants. Editing managed access by hand is refused with 409, since the next sign-in would undo it. The web UI badges it as SSO and disables the controls. Groups are read only at sign-in, so an SSO session carries a hard ceiling (sessions.max_expires_at, 12h by default) that sliding never extends. There is no refresh token, which means API keys of somebody removed at the provider stay valid until an administrator disables the user. That is accepted and documented, not fixed. A client with no browser, the TUI over SSH, signs in with a device code run by terdut itself (POST /api/oidc/device and /device/token), so the terminal never talks to the provider and ends up with the ordinary terdut_session cookie. Only a browser session can approve a code; an API key cannot. /device?code= sends a signed-out visitor through sign-in and back, which is what oidc_logins.next is for. oauth2 is pinned to v0.36.0: v0.37 needs Go 1.26 and the Dockerfile builds on 1.25. Migrations 011 and 012 add tables and defaulted columns only.
41 lines
2.1 KiB
SQL
41 lines
2.1 KiB
SQL
-- Signing in from a terminal, for clients that cannot open a browser on the
|
|
-- machine they run on (the TUI over SSH is the reason).
|
|
--
|
|
-- The flow is the OAuth device authorization grant, run by terdut itself rather
|
|
-- than the identity provider, so the terminal never talks to the provider and
|
|
-- the server issues its ordinary session at the end:
|
|
--
|
|
-- 1. The terminal asks for a login and gets two secrets: a device code it
|
|
-- keeps and polls with, and a short user code it shows the person.
|
|
-- 2. The person opens the verification URL on any device, signs in by whatever
|
|
-- means the server offers, sees the user code, and approves it.
|
|
-- 3. The terminal's next poll finds the row approved and is given a session.
|
|
--
|
|
-- Only the hash of the device code is stored, like every other token here: the
|
|
-- device code is what earns a session, so a database read must not yield one.
|
|
-- The user code is shown on screens and typed by people, so it is stored as is;
|
|
-- on its own it can only be approved, never redeemed.
|
|
--
|
|
-- user_id is the person who approved. It is empty until then, and the session
|
|
-- is minted at redemption, not at approval: an approval nobody collects must not
|
|
-- leave a live session lying about.
|
|
--
|
|
-- last_polled_at lets the server refuse a client that polls faster than the
|
|
-- interval it was told.
|
|
CREATE TABLE device_logins (
|
|
device_hash TEXT PRIMARY KEY,
|
|
user_code TEXT NOT NULL UNIQUE,
|
|
status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'approved', 'denied')),
|
|
user_id BIGINT REFERENCES users(id) ON DELETE CASCADE,
|
|
expires_at BIGINT NOT NULL,
|
|
last_polled_at BIGINT NOT NULL DEFAULT 0
|
|
);
|
|
|
|
CREATE INDEX device_logins_expires_idx ON device_logins (expires_at);
|
|
|
|
-- Where to send the browser once a single sign-on login completes. A person who
|
|
-- opens /device?code=... without a session has to sign in first and then come
|
|
-- back to it, and the same is true of any other deep link. Validated when it is
|
|
-- stored: only a path on this server is ever kept.
|
|
ALTER TABLE oidc_logins ADD COLUMN next TEXT NOT NULL DEFAULT '/';
|