feat(backend): sign-in with local accounts and Keycloak #97

2026-10-24T19:53:36Z

mariusz.pacek commented

2026-10-24 19:53:36 +00:00

Backend login (ADR-014): local accounts and OIDC with PKCE, independent so Keycloak down never locks users out; signed session cookie; all other /api/* need a session; AUTH_DISABLED=true required for open mode.

mariusz.pacek added 2 commits 2026-10-24 19:53:36 +00:00

feat(backend): sign-in with local accounts and Keycloak (ADR-014) 24b7946df1

The backend now authenticates itself: local accounts from USERS_FILE
(PBKDF2-SHA256, throttled) and OIDC code flow with PKCE, independent of
each other, so Keycloak being down never locks the family out. A signed
stateless cookie carries the session; its user replaces Remote-User as
the requester. Without any sign-in configured the backend refuses to
start unless AUTH_DISABLED=true. /api/live serves the healthcheck.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test(backend): rename test key constants so the secret scan passes

CI / Check (gateway, backend, frontend) (push) Successful in 59s

Details

b7b26d83b2

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

mariusz.pacek added 1 commit 2026-10-24 20:05:38 +00:00

fix(backend): atomic login throttle, revoked accounts, log hygiene

CI / Check (gateway, backend, frontend) (push) Successful in 55s

Details

f92307d9e1

The throttle now counts an attempt before the password is hashed, so
parallel guesses cannot outrun it, and at most 4 hashes run at once.
A local session ends when its account leaves USERS_FILE. The provider's
error text is sanitized before logging, a missing OIDC_REQUIRED_ROLE is
warned about, OIDC discovery and keys are fetched outside the lock and
an unreadable JWK is skipped. Ops notes: nginx header, compose example,
/api/live for monitors.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

mariusz.pacek added 1 commit 2026-10-24 21:14:38 +00:00

feat(backend): first-account setup and account management in the app

CI / Check (gateway, backend, frontend) (push) Successful in 1m8s

Details

4e8ffc2ec3

With USERS_FILE set but empty or missing the backend starts in setup
mode and the first visitor creates the account, once, under a lock.
Signed-in users list, add and remove accounts and change their own
password; removed accounts lose their sessions at once. USERS_FILE is
rewritten atomically (temp, fsync, rename, mode 600).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

mariusz.pacek referenced this issue from a commit

2026-10-24 21:18:00 +00:00

Merge PR #97: feat(backend): sign-in with local accounts and Keycloak (ADR-014)

All checks were successful

CI / Check (gateway, backend, frontend) (push) Successful in 1m8s

Details

This branch is already included in the target branch. There is nothing to merge.

This branch is out-of-date with the base branch

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin refs/pull/97/head:mariusz.pacek/feat/auth-backend

git checkout mariusz.pacek/feat/auth-backend

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mariusz.pacek/home-pump#97