admin/0pt

feat(auth): Zitadel OIDC-inloggning för portalen #433

Merged

admin merged 2 commits from feat/portal-oidc-login into main

2026-11-02 14:54:55 +00:00

Author	SHA1	Message	Date
admin	71391db132	fix(auth): fall back to the verified access token for the tenant claim CI (SIAX Cloud) / integration (push) Skipped Details CI (SIAX Cloud) / sonar (push) Skipped Details masterplan-lock / check (push) Successful in 4s Details masterplan-lock / check (pull_request) Successful in 4s Details Security Scan (SIAX Cloud) / security (push) Successful in 14s Details CI (SIAX Cloud) / security (push) Successful in 15s Details Security Scan (SIAX Cloud) / security (pull_request) Successful in 19s Details CI (SIAX Cloud) / quality (push) Successful in 1m8s Details CI (SIAX Cloud) / sonar (pull_request) Skipped Details CI (SIAX Cloud) / security (pull_request) Successful in 14s Details CI (SIAX Cloud) / integration (pull_request) Successful in 27s Details CI (SIAX Cloud) / quality (pull_request) Successful in 1m3s Details Zitadel does not always copy urn:zitadel:iam:org:id into the id_token; the access token always carries it. Verify that token (issuer) before trusting its tenant.	2026-11-02 15:48:51 +01:00
admin	023406c9b6	feat(auth): Zitadel OIDC login for the portal CI (SIAX Cloud) / integration (push) Skipped Details CI (SIAX Cloud) / sonar (push) Skipped Details masterplan-lock / check (push) Successful in 3s Details CI (SIAX Cloud) / sonar (pull_request) Skipped Details masterplan-lock / check (pull_request) Successful in 5s Details Security Scan (SIAX Cloud) / security (push) Successful in 14s Details CI (SIAX Cloud) / security (push) Successful in 21s Details Security Scan (SIAX Cloud) / security (pull_request) Successful in 19s Details CI (SIAX Cloud) / security (pull_request) Successful in 23s Details CI (SIAX Cloud) / integration (pull_request) Successful in 28s Details CI (SIAX Cloud) / quality (push) Successful in 48s Details CI (SIAX Cloud) / quality (pull_request) Successful in 45s Details The portal had no way to obtain a verified principal: /api/0pt/* requires a Bearer token, but the browser only had the dev-only HMAC cookie. - GET /api/auth/login: Authorization Code + PKCE against Zitadel. - GET /api/auth/callback: code exchange, id_token verification (issuer, audience, nonce) and a signed session cookie with sub + tenant. - middleware accepts the signed session as a verified principal; Bearer wins. - dev login POST is refused in production. - Sign-in link in the portal shell.	2026-11-02 15:48:02 +01:00