timothyandClaude Opus 4.8
0b23d4b6b1
Build ErsatzTV Image / Docs update reminder (pull_request) Successful in 7s
Build ErsatzTV Image / EF migration integrity (SQLite + MySql) (pull_request) Successful in 4m28s
Build ErsatzTV Image / Build & test (.NET) (pull_request) Successful in 5m42s
Build ErsatzTV Image / Build & push image (amd64) (pull_request) Has been skipped
Implements the ratified #295 design (PR1, server-only, backward compatible). The /api surface now accepts a valid X-Api-Key (machine) OR an authenticated session (browser cookie, local login or OIDC), gated by the evolved ApiAuthorizationFilter (renamed from ApiKeyAuthorizationFilter; same fail-closed EndpointRequiresKey predicate). Machine/key behavior is byte-identical and the SPA keeps working via its stored key — the SPA login flow lands in PR2. - ApiAuthorizationFilter: key-first (CSRF-immune) then session; session-authed mutations require the X-CSRF header (403 otherwise). Attributes renamed [RequiresApiKey]->[RequiresAuthentication], [SkipApiKeyAuthorization]->[SkipApiAuthorization]. - Cookie scheme ctv-session always registered (Lax/SameAsRequest/14d sliding, 401 not redirect for /api); OIDC handler revived when configured (profile scope, userinfo, auth-method claim); UseAuthentication/UseAuthorization/UseRateLimiter revived in the legacy MapWhen branch. - Local admin = single credential in ConfigElement rows (username / PBKDF2 hash via Microsoft.Extensions.Identity.Core / rotating security stamp) — NO DB migration. Password change rotates the stamp; CookieSecurityStampValidator revokes stale local sessions. Env-seed recovery (Auth:LocalAdmin:*) via LocalAdminSeedService. - AuthController /api/auth/{config,session,setup,login,logout,password} + browser-nav GET /auth/oidc/login; excluded from OpenAPI (machine-audience spec). Per-IP rate limit on login/setup/password; dummy-hash verify (no user enumeration). - ForwardedHeaders now strict opt-in: X-Forwarded-* ignored unless KnownProxies/Networks configured (rate-limiter IP + cookie-Secure integrity). Deployment: operators behind a proxy must set ForwardedHeaders:KnownProxies. - Tests: session/CSRF filter cases + 17 Application/Auth handler tests; full ErsatzTV.Tests green (1499). No OpenAPI/generated-artifact drift. - Docs: api-conventions section 9 rewritten; decisions.md entry (supersedes #206 inert-OIDC note). Refs #295 #197 #206 #58 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
29 lines
1.3 KiB
C#
29 lines
1.3 KiB
C#
namespace ErsatzTV.Application.Auth;
|
|
|
|
/// <summary>
|
|
/// Shared constants for the browser-SPA session authentication (issue #295): the cookie scheme name,
|
|
/// the custom claim types the local-login path stamps onto the principal, and the auth-method marker
|
|
/// values. The web host (cookie <c>OnValidatePrincipal</c>, <c>AuthController</c>) and the Application
|
|
/// handlers both reference these so the claim contract has a single definition.
|
|
/// </summary>
|
|
public static class AuthConstants
|
|
{
|
|
/// <summary>The cookie authentication scheme name shared by local login and the OIDC callback.</summary>
|
|
public const string CookieScheme = "cookie";
|
|
|
|
/// <summary>The OIDC challenge scheme name.</summary>
|
|
public const string OidcScheme = "oidc";
|
|
|
|
/// <summary>Claim type recording how the principal signed in (<see cref="MethodLocal" /> / <see cref="MethodOidc" />).</summary>
|
|
public const string AuthMethodClaim = "etv:auth_method";
|
|
|
|
/// <summary>Claim type carrying the local admin's security stamp (checked on every request to revoke sessions).</summary>
|
|
public const string SecurityStampClaim = "etv:security_stamp";
|
|
|
|
public const string MethodLocal = "local";
|
|
public const string MethodOidc = "oidc";
|
|
|
|
/// <summary>Minimum length for a local admin password.</summary>
|
|
public const int MinPasswordLength = 8;
|
|
}
|