Tasks: Multi-User Authentication and Authorization

Feature Branch: 016-multi-user-auth Feature Spec: specs/016-multi-user-auth/spec.md Implementation Plan: specs/016-multi-user-auth/plan.md

Phase 1: Setup & Infrastructure (Blocking)

Goal: Initialize the auth database, core dependencies, and backend infrastructure.

T001 Install backend dependencies (Authlib, Passlib, PyJWT, SQLAlchemy) in backend/requirements.txt
T002 Implement core configuration for Auth and Database in backend/src/core/auth/config.py
T003 Implement database connection logic for auth.db in backend/src/core/database.py
T004 Create SQLAlchemy models for User, Role, Permission in backend/src/models/auth.py
T005 Create migration/init script to generate auth.db schema in backend/src/scripts/init_auth_db.py
T006 Implement password hashing utility using Passlib in backend/src/core/auth/security.py
T007 Implement JWT token generation and validation logic in backend/src/core/auth/jwt.py
T008 [P] Implement CLI tool for creating the initial admin user in backend/src/scripts/create_admin.py

Phase 2: User Story 1 - Local User Authentication (Priority: P1)

Goal: Enable users to log in with username/password and receive a JWT session.

T009 [US1] Create Pydantic schemas for User, UserCreate, Token in backend/src/schemas/auth.py
T010 [US1] Implement AuthRepository for DB operations in backend/src/core/auth/repository.py
T011 [US1] Implement AuthService for login logic (verify password, create token) in backend/src/services/auth_service.py
T012 [US1] Create API endpoint POST /api/auth/login in backend/src/api/auth.py
T013 [US1] Implement get_current_user dependency for JWT verification in backend/src/dependencies.py
T014 [US1] Create API endpoint GET /api/auth/me to retrieve current user profile in backend/src/api/auth.py
T043 [US1] Implement session revocation (Logout) endpoint in backend/src/api/auth.py
T044 [US1] Implement account status check (is_active) in authentication flow in backend/src/services/auth_service.py
T015 [US1] Implement frontend auth store (Svelte store) in frontend/src/lib/auth/store.ts
T016 [US1] Implement Login Page UI using src/lib/ui and src/lib/i18n in frontend/src/routes/login/+page.svelte
T017 [US1] Integrate Login Page with Backend API in frontend/src/routes/login/+page.svelte
T018 [US1] Implement ProtectedRoute component to redirect unauthenticated users in frontend/src/components/auth/ProtectedRoute.svelte
T037 [US1] Implement password complexity validation logic in backend/src/core/auth/security.py

Phase 3: User Story 2 - Plugin-Based Access Control (Priority: P1)

Goal: Restrict access to plugins based on user roles and permissions.

T019 [US2] Update PluginBase to include required permission strings in backend/src/core/plugin_base.py
T020 [US2] Implement has_permission dependency for route protection in backend/src/dependencies.py
T021 [US2] Protect existing plugin API routes using has_permission in backend/src/api/routes/*.py
T022 [US2] Implement SystemAdminPlugin inheriting from PluginBase for User/Role management in backend/src/plugins/system_admin.py
T023 [US2] Implement Admin API endpoints within SystemAdminPlugin in backend/src/api/routes/admin.py
T053 [US2] Extend Admin API with User Update/Delete and Role CRUD endpoints in backend/src/api/routes/admin.py
T054 [US2] Add Pydantic schemas for UserUpdate, RoleCreate, RoleUpdate in backend/src/schemas/auth.py
T051 [US2] Implement adminService.js for frontend API orchestration
T055 [US2] Update adminService.js with new CRUD methods
T024 [US2] Create Admin Dashboard UI using src/lib/ui and src/lib/i18n in frontend/src/routes/admin/users/+page.svelte
T056 [US2] Update Admin User Dashboard to support Edit/Delete operations in frontend/src/routes/admin/users/+page.svelte
T057 [US4] Create Role Management UI in frontend/src/routes/admin/roles/+page.svelte
T025 [US2] Update Navigation Bar to hide links and show user profile/logout using src/lib/ui in frontend/src/components/Navbar.svelte
T042 [US2] Implement PermissionGuard frontend component for granular UI element protection in frontend/src/components/auth/PermissionGuard.svelte
T045 [US2] Implement multi-role permission resolution logic (union of permissions) in backend/src/services/auth_service.py

Phase 4: User Story 3 - ADFS Integration (Priority: P2)

Goal: Enable corporate SSO login via ADFS and JIT provisioning.

T026 [US3] Configure Authlib for ADFS OIDC in backend/src/core/auth/oauth.py
T027 [US3] Create ADGroupMapping model in backend/src/models/auth.py and update DB init script
T028 [US3] Implement JIT provisioning logic (create user if maps to group) in backend/src/services/auth_service.py
T029 [US3] Create API endpoints GET /api/auth/login/adfs and GET /api/auth/callback/adfs in backend/src/api/auth.py
T030 [US3] Update Login Page to include "Login with ADFS" button using src/lib/ui in frontend/src/routes/login/+page.svelte
T031 [US3] Implement Admin UI for configuring AD Group Mappings in frontend/src/routes/admin/settings/+page.svelte
T052 [US3] Extend Admin API with AD mapping endpoints in backend/src/api/routes/admin.py
T041 [US3] Create ADFS mock provider for local testing and CI in backend/tests/auth/mock_adfs.py
T046 [US3] Implement token refresh logic for ADFS OIDC tokens in backend/src/core/auth/jwt.py

Phase 5: Polish & Security Hardening

Goal: Ensure security best practices and smooth UX.

T032 Ensure all cookies are set with HttpOnly and Secure flags in backend/src/api/auth.py
T033 Implement rate limiting and account lockout policy in backend/src/api/auth.py
T034 Verify error messages are generic (no username enumeration) across all auth endpoints
T035 Add "Session Expired" handling in frontend interceptor in frontend/src/lib/api/client.ts
T036 Final manual test of switching between Local and ADFS login flows
T040 Add confirmation dialogs for destructive admin actions using src/lib/ui in frontend/src/routes/admin/users/+page.svelte
T047 Implement audit logging for security events (login, logout, permission changes) in backend/src/core/auth/logger.py
T048 Perform UI accessibility audit (keyboard nav, ARIA alerts) for all auth components
T049 Implement unit and integration tests for Local Auth and RBAC in backend/tests/auth/
T050 Implement E2E tests for ADFS flow using mock provider in tests/e2e/auth.spec.ts

Dependencies

Phase 1 must be completed before any User Stories.
Phase 2 (Local Auth) is the foundation for authentication and session management.
Phase 3 (RBAC) depends on Phase 2 (needs authenticated users to check permissions).
Phase 4 (ADFS) depends on Phase 2 (uses same session mechanism) and Phase 3 (needs roles for JIT).

Implementation Strategy

MVP: Complete Phases 1 and 2. This gives a working auth system with local users.
Increment 1: Complete Phase 3. This adds the critical security controls (RBAC).
Increment 2: Complete Phase 4. This adds corporate SSO convenience.

7.4 KiB Raw Blame History