stwaidele/dorfteich
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 22 Wiki Activity

[VS-NfD] Add a hard auth.local.enabled = false switch covering every local credential flow #216

New Issue
Closed
opened 2026-07-30 01:43:47 +02:00 by fable-5 · 1 comment
fable-5 commented 2026-07-30 01:43:47 +02:00
Collaborator
Copy Link

Plan reference: 20-massnahmenplan.md -> P1-1
ADR: ADR 0021
Effort: M (2 AT)
Depends on: #214

Context

Delegating authentication only counts if the local path is actually closed
— including the flows people forget: password reset, self-service signup,
personal access tokens and feed tokens. A half-closed local path is worse
than none, because the operating concept then describes something untrue.

Current state

  • Local passwords: UserIdentity.credential (Argon2id),
    apps/api/src/auth/; token flows in
    apps/api/src/auth/auth-tokens.service.ts,
    apps/api/src/public-api/api-tokens.service.ts (PATs) and
    apps/api/src/public/feed-tokens.service.ts.
  • Switch precedent to follow: api.enabled / mcp.enabled in
    apps/api/src/settings/instance-settings.service.ts, enforced as 404.
  • No switch for local authentication exists.

Acceptance criteria

  • With the switch off: password login, signup, password reset,
    e-mail-verification-as-login and any other credential-issuing flow
    are unreachable (404/403 consistently with the project's
    404/403 policy) — enumerated in the test, not assumed.
  • PAT and feed-token issuance behaviour with the switch off is a
    stated decision (blocked, or allowed only for IdP-authenticated
    users), tested either way.
  • The first-run setup wizard's local admin creation is addressed
    explicitly — bootstrapping must remain possible without reopening
    the local path in normal operation.
  • A route-enumeration test proves no authentication route is
    accidentally left open (extend the existing enumeration fence).
  • The switch is deploy-level, not merely a runtime setting a
    compromised Site-Admin could flip back — or, if runtime, that
    residual risk is documented in #231.
  • #227 makes "local auth off" part of the reference configuration.

Out of scope

Migrating existing users to the IdP, and deleting stored password hashes.

**Plan reference:** `20-massnahmenplan.md` -> P1-1 **ADR:** ADR 0021 **Effort:** M (2 AT) **Depends on:** #214 ## Context Delegating authentication only counts if the local path is actually closed — including the flows people forget: password reset, self-service signup, personal access tokens and feed tokens. A half-closed local path is worse than none, because the operating concept then describes something untrue. ## Current state - Local passwords: `UserIdentity.credential` (Argon2id), `apps/api/src/auth/`; token flows in `apps/api/src/auth/auth-tokens.service.ts`, `apps/api/src/public-api/api-tokens.service.ts` (PATs) and `apps/api/src/public/feed-tokens.service.ts`. - Switch precedent to follow: `api.enabled` / `mcp.enabled` in `apps/api/src/settings/instance-settings.service.ts`, enforced as 404. - No switch for local authentication exists. ## Acceptance criteria - [ ] With the switch off: password login, signup, password reset, e-mail-verification-as-login and any other credential-issuing flow are unreachable (404/403 consistently with the project's 404/403 policy) — enumerated in the test, not assumed. - [ ] PAT and feed-token issuance behaviour with the switch off is a **stated decision** (blocked, or allowed only for IdP-authenticated users), tested either way. - [ ] The first-run setup wizard's local admin creation is addressed explicitly — bootstrapping must remain possible without reopening the local path in normal operation. - [ ] A route-enumeration test proves no authentication route is accidentally left open (extend the existing enumeration fence). - [ ] The switch is deploy-level, not merely a runtime setting a compromised Site-Admin could flip back — or, if runtime, that residual risk is documented in #231. - [ ] #227 makes "local auth off" part of the reference configuration. ## Out of scope Migrating existing users to the IdP, and deleting stored password hashes.
fable-5 added this to the M27 — VS-NfD: external authentication milestone 2026-07-30 01:43:47 +02:00
fable-5 added the
vs-nfd:blocker
effort:M
area:auth
vs-nfd
 labels 2026-07-30 01:43:47 +02:00
fable-5 referenced this issue from a commit 2026-07-31 10:01:14 +02:00
#231: residual-risk list
fable-5 referenced this issue from a commit 2026-07-31 10:35:39 +02:00
#231: residual-risk list
fable-5 commented 2026-07-31 13:47:16 +02:00
Author
Collaborator
Copy Link

Implemented in PR #284 (commit 13f0311), merged fast-forward (run 603 green); CD 609 green. AUTH_LOCAL_ENABLED=false answers 404 on every local credential flow (login, signup, verification, resend, password forgot/reset/change) - enforced centrally via the LocalCredentialFlow marker before any session/CSRF logic; an enumeration fence fails when an auth route is neither marked nor on the reviewed allowlist. Deploy-level on purpose: a compromised Site Admin cannot flip it back - R-02 closed in 90-restrisiken.md. Stated decisions tested: sessions/logout keep working, PAT and feed-token issuance stays available to IdP-authenticated users. Bootstrap: setup (or SETUP_ADMIN_* pre-seed) before flipping; boot warning when no sign-in path remains. Hardening guide: planned 1.3 row went live in the 1.2 deploy table incl. the login-404 verification probe; login page hides the local form (methods reports local:false).

Implemented in PR #284 (commit 13f0311), merged fast-forward (run 603 green); CD 609 green. AUTH_LOCAL_ENABLED=false answers 404 on every local credential flow (login, signup, verification, resend, password forgot/reset/change) - enforced centrally via the LocalCredentialFlow marker before any session/CSRF logic; an enumeration fence fails when an auth route is neither marked nor on the reviewed allowlist. Deploy-level on purpose: a compromised Site Admin cannot flip it back - R-02 closed in 90-restrisiken.md. Stated decisions tested: sessions/logout keep working, PAT and feed-token issuance stays available to IdP-authenticated users. Bootstrap: setup (or SETUP_ADMIN_* pre-seed) before flipping; boot warning when no sign-in path remains. Hardening guide: planned 1.3 row went live in the 1.2 deploy table incl. the login-404 verification probe; login page hides the local form (methods reports local:false).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
area:auth

   
area:docs

   
area:export

   
area:ops

   
area:storage

   
area:supply-chain

   
auth

Authentication, permissions, quotas

  
backend

API server (apps/api)

  
blocked

Blocked on external dependency/infrastructure

  
collab

Collaboration server (apps/collab)

  
deployment

Docker, CI/CD, hosting

  
docs

Documentation

  
effort:L

   
effort:M

   
effort:S

   
frontend

SPA (apps/web)

  
plugins

Plugin system and SDK

  
qa

Tests, fixtures, e2e

  
vs-nfd

   
vs-nfd:blocker
No Label
area:auth
area:docs
area:export
area:ops
area:storage
area:supply-chain
auth
backend
blocked
collab
deployment
docs
effort:L
effort:M
effort:S
frontend
plugins
qa
vs-nfd
vs-nfd:blocker
Milestone
Clear milestone
No items
No Milestone
M27 — VS-NfD: external authentication
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stwaidele/dorfteich#216
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?