Add OIDC auth with role-based app permissions

.dockerignore

@@ -28,6 +28,7 @@ coverage.xml
 .mypy_cache
 .pytest_cache
 .hypothesis
+.tests/
 
 # OS
 .DS_Store

.env.template

@@ -10,7 +10,24 @@ AZURE_CLIENT_ID=your-client-id-here
 # Your Azure AD App Registration Client Secret
 AZURE_CLIENT_SECRET=your-client-secret-here
 
+# Optional Microsoft Entra sign-in (uses a separate App Registration)
+# Use "simple" for the password-based admin flow or "oidc" for Microsoft sign-in.
+# For OIDC, set "Assignment required?" to Yes on the Enterprise Application.
+AUTH_TYPE=simple
+OIDC_TENANT_ID=your-tenant-id-here
+OIDC_CLIENT_ID=your-auth-app-client-id-here
+OIDC_CLIENT_SECRET=your-auth-app-client-secret-here
+
+# Access is denied unless the user belongs to one of these groups.
+OIDC_READER_GROUP_ID=your-org-chart-reader-group-object-id
+OIDC_PRIVILEGED_GROUP_ID=your-sync-reports-group-object-id
+OIDC_ADMIN_GROUP_ID=your-full-admin-group-object-id
+
+# Optional override. Must exactly match the auth app's Web redirect URI.
+# OIDC_REDIRECT_URI=https://org-chart.example.com/auth/callback
+
 # Security Configuration
+# Required only when AUTH_TYPE=simple
 ADMIN_PASSWORD=your-admin-password-here
 SECRET_KEY=generate-a-64-character-random-string
 

.github/workflows/tests.yml

@@ -33,4 +33,4 @@ jobs:
           pip install pytest
 
       - name: Run tests
-        run: python -m pytest tests/ -v --tb=short
+        run: python -m pytest .tests/ -v --tb=short

tests/conftest.py → .tests/conftest.py

@@ -4,6 +4,7 @@
 
 import json
 import os
+import shutil
 import sys
 import tempfile
 from pathlib import Path
@@ -20,6 +21,14 @@
 os.environ.setdefault("ADMIN_PASSWORD", "test-password-for-ci-only")
 os.environ.setdefault("SECRET_KEY", "test-secret-key")
 
+_TEST_RUNTIME_DIR = Path(tempfile.mkdtemp(prefix="simple-org-chart-tests-"))
+os.environ["SIMPLE_ORG_CHART_DATA_DIR"] = str(_TEST_RUNTIME_DIR / "data")
+os.environ["SESSION_FILE_DIR"] = str(_TEST_RUNTIME_DIR / "flask_session")
+
+
+def pytest_sessionfinish(session, exitstatus):
+    shutil.rmtree(_TEST_RUNTIME_DIR, ignore_errors=True)
+
 
 @pytest.fixture()
 def sample_employees() -> List[Dict[str, Any]]: