03c8f40417
CPM can now act as its own forward auth provider for proxied sites. Users authenticate at a login portal (credentials or OAuth) and Caddy gates access via a verify subrequest, eliminating the need for external IdPs like Authentik. Key components: - Forward auth flow: verify endpoint, exchange code callback, login portal - User groups with membership management - Per-proxy-host access control (users and/or groups) - Caddy config generation for forward_auth handler + callback route - OAuth and credential login on the portal page - Admin UI: groups page, inline user/group assignment in proxy host form - REST API: /api/v1/groups, /api/v1/forward-auth-sessions, per-host access - Integration tests for groups and forward auth schema Also fixes mTLS E2E test selectors broken by the RBAC refactor. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
133 lines
2.6 KiB
JSON
133 lines
2.6 KiB
JSON
{
|
|
"version": "5",
|
|
"dialect": "sqlite",
|
|
"entries": [
|
|
{
|
|
"idx": 0,
|
|
"version": "6",
|
|
"when": 1762515724134,
|
|
"tag": "0000_initial",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 1,
|
|
"version": "6",
|
|
"when": 1766854292252,
|
|
"tag": "0001_adorable_sally_floyd",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 2,
|
|
"version": "6",
|
|
"when": 1766880443160,
|
|
"tag": "0002_perfect_hedge_knight",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 3,
|
|
"version": "6",
|
|
"when": 1769262874211,
|
|
"tag": "0003_instances",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 4,
|
|
"version": "6",
|
|
"when": 1770395358533,
|
|
"tag": "0004_slimy_grim_reaper",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 5,
|
|
"version": "6",
|
|
"when": 1770395358534,
|
|
"tag": "0005_remove_static_response",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 6,
|
|
"version": "6",
|
|
"when": 1770395358535,
|
|
"tag": "0006_remove_redirects",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 7,
|
|
"version": "6",
|
|
"when": 1740441600000,
|
|
"tag": "0007_linking_tokens",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 8,
|
|
"version": "6",
|
|
"when": 1740960000000,
|
|
"tag": "0008_unique_provider_subject",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 9,
|
|
"version": "6",
|
|
"when": 1772129593846,
|
|
"tag": "0009_watery_bill_hollister",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 10,
|
|
"version": "6",
|
|
"when": 1772200000000,
|
|
"tag": "0010_waf",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 11,
|
|
"version": "6",
|
|
"when": 1772300000000,
|
|
"tag": "0011_mtls",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 12,
|
|
"version": "6",
|
|
"when": 1772400000000,
|
|
"tag": "0012_ca_private_key",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 13,
|
|
"version": "6",
|
|
"when": 1772500000000,
|
|
"tag": "0013_issued_client_certificates",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 14,
|
|
"version": "6",
|
|
"when": 1772806000000,
|
|
"tag": "0014_waf_blocked",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 15,
|
|
"version": "6",
|
|
"when": 1774300000000,
|
|
"tag": "0015_l4_proxy_hosts",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 16,
|
|
"version": "6",
|
|
"when": 1775400000000,
|
|
"tag": "0016_mtls_rbac",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 17,
|
|
"version": "6",
|
|
"when": 1775500000000,
|
|
"tag": "0017_forward_auth",
|
|
"breakpoints": true
|
|
}
|
|
]
|
|
}
|