feat: operator login and logout on tenant and console hosts - #147
Merged
Conversation
Login and logout forms on both host kinds, authenticating Operator via a form that lowercases the submitted email before authenticate(). Anonymous requests to a protected admin path redirect to login with next; authenticated-without-membership still returns 404 on a surface and a neutral landing on the admin index, identical regardless of memberships held on other tenants. Session and CSRF cookies pinned host-only, HttpOnly, SameSite Lax, and Secure behind a new OSDS_SECURE_COOKIES variable rather than DEBUG. SECURE_PROXY_SSL_HEADER set so the CSRF origin check works behind TLS termination. A middleware drops Secure from the session and CSRF cookies on setup routes while setup is incomplete, without which first boot over plain http cannot pass CSRF. Slashless /admin redirects with the query string preserved. Verified in a browser on non-loopback hosts over plain http. Closes #127 Signed-off-by: Matthew Wren <info@origindev.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #127. Blocks nothing else in block 2; PR 4 follows.
Login and logout on both host kinds, authenticating Operator through a form that lowercases the email before authenticate(). Anonymous requests to a protected admin path redirect to login with next preserved; authenticated-without-membership keeps returning 404 on a surface, and the admin index shows a neutral landing that renders identically regardless of memberships held on other tenants.
Cookies pinned host-only, HttpOnly, SameSite Lax. Secure is gated on a new OSDS_SECURE_COOKIES variable rather than DEBUG, so an HTTP-only install has a deliberate way out. SECURE_PROXY_SSL_HEADER is set, without which the CSRF origin check compares https against http behind TLS termination and every login POST is a 403.
SetupCookieSecurityMiddleware drops Secure from the session and CSRF cookies on setup routes while setup is incomplete. Without it the first wizard POST is a 403 and the unlock flag never persists, making first boot impossible over plain http. The gate is the route plus incomplete setup, with no request.is_secure() reference, and it self-destructs when completion stops the setup URLconf resolving.
Three rows added to decisions.md section 4: authentication writes to no log, SECURE_PROXY_SSL_HEADER set while CSRF_TRUSTED_ORIGINS is not, and the wizard cookie relaxation.
23 new tests, 263 total. Verified in a browser on non-loopback hosts over plain http, which is the only way to see the Secure-flag behaviour — the test client ignores it. That pass also produced #142, #143, #144, #145 and #146, none of which block this.