makiolaj/GearBox
1
0
Fork 0
Code Issues 8 Pull Requests Actions Packages Projects Releases 10 Wiki Activity

Merge branch 'worktree-agent-a9901af2' into Develop

Browse Source 
# Conflicts:
#	.planning/REQUIREMENTS.md
#	.planning/ROADMAP.md
#	.planning/STATE.md
#	bun.lock
#	package.json
#	src/server/middleware/auth.ts
#	src/server/routes/auth.ts
#	src/server/routes/oauth.ts
#	src/server/services/auth.service.ts
This commit is contained in:
Jean-Luc Makiola
2026-04-04 20:48:38 +02:00
parent e3659a23f1 82eb9e7286
commit 3158274c6a
12 changed files with 257 additions and 369 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
.planning/REQUIREMENTS.md
View File

@@ -9,18 +9,18 @@ Requirements for this milestone. Each maps to roadmap phases.
### Database Migration
- [x] **DB-01**: Application runs on PostgreSQL instead of SQLite
- [x] **DB-02**: All service functions use async database operations
- [x] **DB-03**: Test infrastructure uses PGlite instead of bun:sqlite in-memory databases
- [x] **DB-04**: Existing SQLite data can be migrated to Postgres via a one-time script
- [ ] **DB-01**: Application runs on PostgreSQL instead of SQLite
- [ ] **DB-02**: All service functions use async database operations
- [ ] **DB-03**: Test infrastructure uses PGlite instead of bun:sqlite in-memory databases
- [ ] **DB-04**: Existing SQLite data can be migrated to Postgres via a one-time script
- [ ] **DB-05**: Docker Compose provides Postgres for local development
### Authentication
- [ ] **AUTH-01**: User can register an account via external OIDC auth provider
- [ ] **AUTH-02**: User can log in via external auth provider and access their data
- [ ] **AUTH-03**: API keys remain functional for programmatic access (MCP, scripts)
- [x] **AUTH-04**: Auth provider runs self-hosted alongside the application
- [x] **AUTH-01**: User can register an account via external OIDC auth provider
- [x] **AUTH-02**: User can log in via external auth provider and access their data
- [x] **AUTH-03**: API keys remain functional for programmatic access (MCP, scripts)
- [ ] **AUTH-04**: Auth provider runs self-hosted alongside the application
- [ ] **AUTH-05**: E2E tests authenticate via API keys without depending on the auth provider
### Multi-User Data Model
@@ -116,15 +116,15 @@ Which phases cover which requirements. Updated during roadmap creation.
| Requirement | Phase | Status |
|-------------|-------|--------|
| DB-01 | Phase 14 | Complete |
| DB-02 | Phase 14 | Complete |
| DB-03 | Phase 14 | Complete |
| DB-04 | Phase 14 | Complete |
| DB-01 | Phase 14 | Pending |
| DB-02 | Phase 14 | Pending |
| DB-03 | Phase 14 | Pending |
| DB-04 | Phase 14 | Pending |
| DB-05 | Phase 14 | Pending |
| AUTH-01 | Phase 15 | Pending |
| AUTH-02 | Phase 15 | Pending |
| AUTH-03 | Phase 15 | Pending |
| AUTH-04 | Phase 15 | Complete |
| AUTH-01 | Phase 15 | Complete |
| AUTH-02 | Phase 15 | Complete |
| AUTH-03 | Phase 15 | Complete |
| AUTH-04 | Phase 15 | Pending |
| AUTH-05 | Phase 15 | Pending |
| MULTI-01 | Phase 16 | Pending |
| MULTI-02 | Phase 16 | Pending |

4
.planning/ROADMAP.md
View File

@@ -51,7 +51,7 @@
**Milestone Goal:** Transform GearBox from a single-user gear tracker into a multi-user platform where people discover gear, research purchases using crowd-verified data, and share their setups.
- [ ] **Phase 14: PostgreSQL Migration** — Replace SQLite with Postgres, make all operations async, establish new test infrastructure
- [ ] **Phase 15: External Authentication** — Integrate self-hosted OIDC auth provider for user registration and login
- [x] **Phase 15: External Authentication** — Integrate self-hosted OIDC auth provider for user registration and login (completed 2026-04-04)
- [ ] **Phase 16: Multi-User Data Model** — Add user ownership to all entities with cross-user data isolation
- [ ] **Phase 17: Object Storage** — Move images from local filesystem to MinIO (S3-compatible)
- [ ] **Phase 18: Global Items & Public Profiles** — Global item catalog, user profiles, and public setup sharing
@@ -189,7 +189,7 @@ Plans:
| 12. Comparison View | v1.3 | 1/1 | Complete | 2026-03-17 |
| 13. Setup Impact Preview | v1.3 | 0/2 | Not started | - |
| 14. PostgreSQL Migration | v2.0 | 0/? | Not started | - |
| 15. External Authentication | v2.0 | 1/3 | In Progress| |
| 15. External Authentication | v2.0 | 2/1 | Complete | 2026-04-04 |
| 16. Multi-User Data Model | v2.0 | 0/? | Not started | - |
| 17. Object Storage | v2.0 | 0/? | Not started | - |
| 18. Global Items & Public Profiles | v2.0 | 0/? | Not started | - |

46
.planning/STATE.md
View File

@@ -1,16 +1,16 @@
---
gsd_state_version: 1.0
milestone: v2.0
milestone_name: Platform Foundation
milestone: v1.3
milestone_name: Research & Decision Tools
status: planning
stopped_at: null
last_updated: "2026-04-03"
stopped_at: Completed 15-02-PLAN.md
last_updated: "2026-04-04T18:47:52.641Z"
last_activity: 2026-04-03 — v2.0 roadmap created (Phases 14-18)
progress:
total_phases: 5
completed_phases: 0
total_plans: 0
completed_plans: 0
total_phases: 8
completed_phases: 7
total_plans: 13
completed_plans: 12
percent: 0
---
@@ -25,19 +25,20 @@ See: .planning/PROJECT.md (updated 2026-04-03)
## Current Position
Phase: 15 of 18 (External Authentication)
Plan: 1 of 3 in current phase
Status: Executing
Last activity: 2026-04-04 — Completed 15-01 (Logto Docker infrastructure + schema cleanup)
Phase: 14 of 18 (PostgreSQL Migration)
Plan: 0 of ? in current phase
Status: Ready to plan
Last activity: 2026-04-03 — v2.0 roadmap created (Phases 14-18)
Progress: [=---------] 5% (v2.0 milestone)
Progress: [----------] 0% (v2.0 milestone)
## Performance Metrics
**Velocity:**
- Total plans completed: 1 (v2.0 milestone)
- Average duration: 3min
- Total execution time: 3min
- Total plans completed: 0 (v2.0 milestone)
- Average duration: --
- Total execution time: --
*Updated after each plan completion*
@@ -45,15 +46,16 @@ Progress: [=---------] 5% (v2.0 milestone)
### Decisions
Key decisions made during v2.0 planning and execution:
Key decisions made during v2.0 planning:
- Platform pivot: single-user to multi-user with discovery-first approach
- External auth provider (self-hosted, open-source) — Logto selected (D-01)
- External auth provider (self-hosted, open-source) — Logto vs Authentik OPEN decision
- SQLite to Postgres migration — required by auth provider and multi-user concurrency
- Structured UGC only — ratings and predefined fields, no freeform text until moderation
- Separate globalItems table — not a flag on user items table
- Single-user SQLite mode diverges at v2.0 boundary
- Logto shares Postgres instance via separate database created by init script
- OIDC_ISSUER derived from LOGTO_ENDPOINT in docker-compose
- [Phase 15]: OIDC routes at root level (/login, /callback, /logout), API key routes under /api/auth
- [Phase 15]: Three-way auth order: API key -> MCP Bearer -> OIDC session
### Pending Todos
@@ -66,6 +68,6 @@ None active.
## Session Continuity
Last session: 2026-04-04
Stopped at: Completed 15-01-PLAN.md (Logto Docker infrastructure + schema cleanup)
Last session: 2026-04-04T18:47:52.639Z
Stopped at: Completed 15-02-PLAN.md
Resume file: None

119
.planning/phases/15-external-authentication/15-02-SUMMARY.md Normal file
View File

@@ -0,0 +1,119 @@
---
phase: 15-external-authentication
plan: 02
subsystem: auth
tags: [oidc, hono, logto, @hono/oidc-auth, jose, mcp-oauth]
# Dependency graph
requires:
- phase: 15-external-authentication (plan 01)
provides: Docker Compose with Logto service, env vars, schema without users/sessions tables
provides:
- Three-way auth middleware (API key, MCP Bearer, OIDC session)
- OIDC login/callback/logout routes at root level
- Auth service stripped to API key CRUD only
- MCP OAuth authorize using OIDC session instead of password
affects: [15-external-authentication plan 03, client-side login page, e2e tests]
# Tech tracking
tech-stack:
added: ["@hono/oidc-auth@1.8.1", "jose@6.2.2"]
patterns: [three-way-auth-middleware, oidc-session-validation, consent-form-pattern]
key-files:
created: []
modified:
- src/server/middleware/auth.ts
- src/server/services/auth.service.ts
- src/server/routes/auth.ts
- src/server/routes/oauth.ts
- src/server/mcp/index.ts
- src/server/index.ts
- package.json
key-decisions:
- "OIDC routes (/login, /callback, /logout) placed at root level in index.ts, not under /api/auth"
- "MCP OAuth authorize uses consent-only form (no credentials) backed by OIDC session"
- "Three-way auth order: API key first, Bearer token second, OIDC session third"
patterns-established:
- "Three-way auth: requireAuth checks API key -> MCP Bearer -> OIDC session in order"
- "OIDC routes at root level, API routes under /api/auth"
- "Consent form pattern: MCP OAuth shows authorize button only (no credential fields)"
requirements-completed: [AUTH-01, AUTH-02, AUTH-03]
# Metrics
duration: 4min
completed: 2026-04-04
---
# Phase 15 Plan 02: OIDC Auth Integration Summary
**Three-way auth middleware with @hono/oidc-auth for browser sessions, API keys for programmatic access, and MCP OAuth consent flow**
## Performance
- **Duration:** 4 min
- **Started:** 2026-04-04T18:42:20Z
- **Completed:** 2026-04-04T18:46:35Z
- **Tasks:** 3
- **Files modified:** 8
## Accomplishments
- Replaced custom cookie-session auth with OIDC via @hono/oidc-auth in requireAuth middleware
- Stripped auth service to API key functions only (removed all user/session management)
- Added /login, /callback, /logout OIDC routes at root level for browser auth flow
- Updated MCP OAuth to use OIDC session for authorization consent instead of password verification
- Removed getUserCount bypass from MCP auth middleware
## Task Commits
Each task was committed atomically:
1. **Task 1: Install OIDC dependencies and rewrite auth middleware + service** - `259dc2b` (feat)
2. **Task 2: Rewrite auth routes for OIDC login/callback/logout + API key CRUD** - `1b6a65b` (feat)
3. **Task 3: Update MCP OAuth authorize and MCP auth middleware for OIDC** - `c0e6db5` (feat)
## Files Created/Modified
- `package.json` - Added @hono/oidc-auth and jose dependencies
- `src/server/middleware/auth.ts` - Three-way auth: API key, MCP Bearer, OIDC session
- `src/server/services/auth.service.ts` - API key CRUD only (user/session functions removed)
- `src/server/routes/auth.ts` - GET /me with OIDC claims, API key CRUD routes
- `src/server/routes/oauth.ts` - Consent form replaces login form, getAuth replaces verifyPassword
- `src/server/mcp/index.ts` - Removed getUserCount import and bypass logic
- `src/server/index.ts` - Added root-level /login, /callback, /logout OIDC routes
## Decisions Made
- Placed OIDC browser auth routes (/login, /callback, /logout) at root level in index.ts rather than under /api/auth, keeping API key management at /api/auth/keys
- Auth check order in middleware: API key first (fast path for programmatic), Bearer token second (MCP), OIDC session third (browser)
- MCP OAuth authorize shows consent-only form when user has OIDC session, redirects to /login otherwise
## Deviations from Plan
None - plan executed exactly as written.
## Known Stubs
None - all data paths are wired to real implementations.
## Issues Encountered
None.
## User Setup Required
None - OIDC provider (Logto) configuration was handled in plan 15-01.
## Next Phase Readiness
- Server-side OIDC integration complete
- Client-side login page needs updating (plan 15-03) to redirect to /login instead of showing credential form
- E2E tests will need API key auth strategy (bypassing Logto)
## Self-Check: PASSED
All 6 modified files verified on disk. All 3 task commits verified in git log.
---
*Phase: 15-external-authentication*
*Completed: 2026-04-04*