feat: auth hardening Sprint 19 (v0.7.0)#135
Merged
Conversation
- Remove RegisterRoutes() (unprotected variant) - All routes now use RegisterProtectedRoutes() with RBAC - Add missing import routes to protected registration - BREAKING: CLOUDPAM_AUTH_ENABLED env var removed - First boot always shows setup wizard - Hardcode auth_enabled=true in /healthz response Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ymous Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ivileges than their own role Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add TrustedProxyConfig with CIDR-based proxy validation - clientKey() now ignores X-Forwarded-For by default (secure default) - Only trust XFF when direct peer is in CLOUDPAM_TRUSTED_PROXIES - Add per-IP login rate limiting (5 attempts/min default) - Login handler wrapped with LoginRateLimitMiddleware Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove Strategy 3 (Bearer token as session ID) from DualAuthMiddleware - Sessions use cookies only; API keys use Bearer tokens (clean separation) - Password minimum increased to 12 chars (NIST 800-63B) - Password maximum enforced at 72 chars (bcrypt truncation boundary) - ValidatePassword() used consistently in setup, user creation, and password change Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- SecuritySettings domain type with safe defaults - SettingsStore interface with memory and SQLite implementations - Migration 0016: settings table (key-value with JSON) - GET/PATCH /api/v1/settings/security with RBAC (admin only) - Full input validation on PATCH with bounds checking - ResourceSettings added to RBAC permission model Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add ListByUserID to SessionStore interface (memory, SQLite, PostgreSQL)
- Enforce max 10 concurrent sessions per user (evict oldest on overflow)
- POST /api/v1/auth/users/{id}/revoke-sessions endpoint
- Admin or self-service session revocation with audit logging
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Double-submit cookie pattern: csrf_token cookie + X-CSRF-Token header - API key requests exempt (no cookies = no CSRF risk) - Login and setup endpoints exempt (no session yet) - Frontend API client sends CSRF token on all state-changing requests Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- SecuritySettingsPage with session, password, login, network sections - useSecuritySettings hook for GET/PATCH /api/v1/settings/security - Sidebar link with Shield icon (admin only) - Coming soon placeholders for Roles & Permissions and SSO/OIDC Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Auth hardening sprint implementing 13 security improvements for production readiness:
CLOUDPAM_AUTH_ENABLEDtoggle — authentication is now always required, with first-boot setup wizard for initial admin creationBreaking Changes
CLOUDPAM_AUTH_ENABLEDenv var removed — auth is always oncpam_are now rejected (previously treated as session tokens)New Endpoints
GET/PATCH /api/v1/settings/security— security settings managementPOST /api/v1/auth/users/{id}/revoke-sessions— revoke all sessions for a userNew Environment Variables
CLOUDPAM_TRUSTED_PROXIES— comma-separated CIDRs for trusted reverse proxiesTest Plan
-tags sqlite)Closes phase 1 of auth hardening. Phase 2 (SSO/OIDC) tracked in #130-#134.
🤖 Generated with Claude Code