03c8f40417
CPM can now act as its own forward auth provider for proxied sites. Users authenticate at a login portal (credentials or OAuth) and Caddy gates access via a verify subrequest, eliminating the need for external IdPs like Authentik. Key components: - Forward auth flow: verify endpoint, exchange code callback, login portal - User groups with membership management - Per-proxy-host access control (users and/or groups) - Caddy config generation for forward_auth handler + callback route - OAuth and credential login on the portal page - Admin UI: groups page, inline user/group assignment in proxy host form - REST API: /api/v1/groups, /api/v1/forward-auth-sessions, per-host access - Integration tests for groups and forward auth schema Also fixes mTLS E2E test selectors broken by the RBAC refactor. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
31 lines
943 B
TypeScript
31 lines
943 B
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { requireApiAdmin, apiErrorResponse } from "@/src/lib/api-auth";
|
|
import {
|
|
listForwardAuthSessions,
|
|
deleteUserForwardAuthSessions
|
|
} from "@/src/lib/models/forward-auth";
|
|
|
|
export async function GET(request: NextRequest) {
|
|
try {
|
|
await requireApiAdmin(request);
|
|
const sessions = await listForwardAuthSessions();
|
|
return NextResponse.json(sessions);
|
|
} catch (error) {
|
|
return apiErrorResponse(error);
|
|
}
|
|
}
|
|
|
|
export async function DELETE(request: NextRequest) {
|
|
try {
|
|
await requireApiAdmin(request);
|
|
const userId = request.nextUrl.searchParams.get("userId");
|
|
if (!userId) {
|
|
return NextResponse.json({ error: "userId query parameter is required" }, { status: 400 });
|
|
}
|
|
await deleteUserForwardAuthSessions(Number(userId));
|
|
return new NextResponse(null, { status: 204 });
|
|
} catch (error) {
|
|
return apiErrorResponse(error);
|
|
}
|
|
}
|