Add OIDC login, sessions and CSRF protection #2

Merged

mcp-bot merged 1 commit from feature/auth into develop

2026-11-01 19:57:08 +01:00

mcp-bot commented

2026-11-01 19:54:49 +01:00

Member

Why

Everything in Notenwart depends on knowing who is asking. There are no local passwords by design, so the OIDC flow has to work before groups and roles can exist. CSRF protection comes along now so that no state-changing route is ever written without it.

What

OIDC Authorization Code Flow with PKCE (S256) and nonce through Authlib
Users are created on first login by sub, profile fields refresh on every login
Superadmin only if the address is in BOOTSTRAP_ADMIN_EMAILS and email_verified is true, re-evaluated on every login
Signed session cookie: HttpOnly, SameSite=Lax, Secure derived from BASE_URL
App-wide CSRF check (header or form field) plus Origin check
Local return targets only after login (no open redirect)
German error pages
Dex as local OIDC provider for development (compose.dev.yaml)
httpx2 instead of httpx: Authlib and Starlette deprecated the old package

Verification

make lint and pytest pass (59 tests)
Tested in the browser against Dex: login with PKCE, superadmin flag set in the database, logout, no console or CSP errors
Not verified: login against the real PocketID instance

## Why Everything in Notenwart depends on knowing who is asking. There are no local passwords by design, so the OIDC flow has to work before groups and roles can exist. CSRF protection comes along now so that no state-changing route is ever written without it. ## What - OIDC Authorization Code Flow with PKCE (S256) and nonce through Authlib - Users are created on first login by `sub`, profile fields refresh on every login - Superadmin only if the address is in `BOOTSTRAP_ADMIN_EMAILS` and `email_verified` is true, re-evaluated on every login - Signed session cookie: `HttpOnly`, `SameSite=Lax`, `Secure` derived from `BASE_URL` - App-wide CSRF check (header or form field) plus Origin check - Local return targets only after login (no open redirect) - German error pages - Dex as local OIDC provider for development (`compose.dev.yaml`) - `httpx2` instead of `httpx`: Authlib and Starlette deprecated the old package ## Verification - `make lint` and `pytest` pass (59 tests) - Tested in the browser against Dex: login with PKCE, superadmin flag set in the database, logout, no console or CSP errors - Not verified: login against the real PocketID instance

mcp-bot added 1 commit

2026-11-01 19:54:49 +01:00