feat(auth): Zitadel OIDC-inloggning för portalen #433

Merged

admin merged 2 commits from feat/portal-oidc-login into main 2026-11-02 14:54:55 +00:00

Conversation 0 Commits 2 Files Changed 8

+400 -58

admin commented 2026-11-02 14:48:18 +00:00

Owner

Copy Link

Copy Source

Portalen saknade en väg till en verifierad principal: /api/0pt/* kräver Bearer, men webbläsaren hade bara dev-cookien.

• GET /api/auth/login: Authorization Code + PKCE mot Zitadel.
• GET /api/auth/callback: kodväxling, id_token-verifiering (issuer, audience, nonce) och signerad sessionscookie med sub + tenant.
• Middleware accepterar sessionen som verifierad principal; Bearer vinner.
• Dev-login nekas i produktion.

Verifierat: typecheck, build; OIDC-app skapad i Zitadel-projektet 0pt.

Portalen saknade en väg till en verifierad principal: `/api/0pt/*` kräver Bearer, men webbläsaren hade bara dev-cookien. - `GET /api/auth/login`: Authorization Code + PKCE mot Zitadel. - `GET /api/auth/callback`: kodväxling, id_token-verifiering (issuer, audience, nonce) och signerad sessionscookie med sub + tenant. - Middleware accepterar sessionen som verifierad principal; Bearer vinner. - Dev-login nekas i produktion. Verifierat: typecheck, build; OIDC-app skapad i Zitadel-projektet `0pt`.

admin added 1 commit 2026-11-02 14:48:18 +00:00

feat(auth): Zitadel OIDC login for the portal ... 023406c9b6

The portal had no way to obtain a verified principal: /api/0pt/* requires a
Bearer token, but the browser only had the dev-only HMAC cookie.

- GET /api/auth/login: Authorization Code + PKCE against Zitadel.
- GET /api/auth/callback: code exchange, id_token verification (issuer,
  audience, nonce) and a signed session cookie with sub + tenant.
- middleware accepts the signed session as a verified principal; Bearer wins.
- dev login POST is refused in production.
- Sign-in link in the portal shell.

CODEOWNERS rules requested review from sax3l 2026-11-02 14:48:18 +00:00

admin added 1 commit 2026-11-02 14:48:53 +00:00

fix(auth): fall back to the verified access token for the tenant claim ... 71391db132

Zitadel does not always copy urn:zitadel:iam:org:id into the id_token; the
access token always carries it. Verify that token (issuer) before trusting its
tenant.

admin merged commit bc7868c789 into main 2026-11-02 14:54:55 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

sax3l

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

siax-bot siax-ci siax-healer (siax-healer (CI self-healing agent)) admin (Simon Axelsson)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: admin/0pt#433