feat(sso): SSO forward-auth gateway — auth once, access all (Phase 1: service + edge) - #2221

Merged

POWERFULMOVES merged 28 commits into

mainfrom

feat/sso-gateway

Jul 25, 2026

Commits on Jul 25, 2026

docs(sso): design spec for the PMOVES SSO gateway (auth once, access all)

POWERFULMOVES
and
claude
committed
281a7da
docs(sso): implementation plan (11 tasks) for the SSO gateway

POWERFULMOVES
and
claude
committed
1706949
fix(plan): lazy settings proxy — no import-time env read (Task 1 testability)

POWERFULMOVES
and
claude
committed
82c41ca
feat(sso-auth): scaffold service + Supabase-JWT verify + /auth/verify
POWERFULMOVES
committed
f5300da
fix(plan): Task 1 security — require role=authenticated + decouple verify from OIDC config

POWERFULMOVES
and
claude
committed
a68a0d3
fix(sso-auth): require role=authenticated + decouple verify from OIDC config
POWERFULMOVES
committed
6d65c1b
fix(plan): Task 2/3 test correctness — role claim, TestClient host, deps

POWERFULMOVES
and
claude
committed
2bc407f
feat(sso-auth): GoTrue login (GitHub + email/pw), cookie issuance, logout
POWERFULMOVES
committed
9c070b1
fix(plan): Task 2/3 tests use autouse fixture, not module-level reload

POWERFULMOVES
and
claude
committed
8c0e725
fix(sso-auth): test_login uses autouse env fixture (no module-reload pollution)
POWERFULMOVES
committed
f1f10f2
fix(plan): Task 2 open-redirect guard on rd param (_safe_rd)

POWERFULMOVES
and
claude
committed
e81baa3
fix(sso-auth): open-redirect guard on rd param (_safe_rd)
POWERFULMOVES
committed
c621396
fix(plan): Task 2 consolidated review fixes (callback error, e-param, logout revoke+local)

POWERFULMOVES
and
claude
committed
eb3fbe2
fix(sso-auth): Task 2 review fixes — callback error handling, logout revoke+local redirect, error rendering

POWERFULMOVES
and
claude
committed
aa96666
fix(plan): Task 2 gotrue transport-error fail-closed + outage tests

POWERFULMOVES
and
claude
committed
9824a54
fix(sso-auth): harden _safe_rd (backslash/control-char/scheme reject) + gotrue fail-closed on outage

POWERFULMOVES
and
claude
committed
0d91d80
feat(sso-auth): minimal OIDC subset for jellyfin-plugin-oidc

POWERFULMOVES
and
claude
committed
8e82e95
fix(plan): Task 3 OIDC redirect_uri allowlist (HIGH open-redirect fix)

POWERFULMOVES
and
claude
committed
c4cdba7
fix(sso-auth): OIDC redirect_uri allowlist + constant-time client-secret compare (HIGH open-redirect)

POWERFULMOVES
and
claude
committed
811d87a
fix(plan): config redirect_uris field needs NoDecode (pydantic-settings eager json decode)

POWERFULMOVES
and
claude
committed
f6a5539
feat(sso): compose layer — sso-auth service, Traefik forward-auth edge, per-app routers

POWERFULMOVES
and
claude
committed
a4b71bb
feat(sso-auth): Dockerfile (fleet-pinned python:3.11-slim base, non-root, healthcheck)

POWERFULMOVES
and
claude
committed
2a20ca6
fix(plan): sso-auth needs traefik.enable labels or auth router never registers

POWERFULMOVES
and
claude
committed
9ef3061
fix(sso): register sso-auth with Traefik (enable+network+port) so auth router resolves

POWERFULMOVES
and
claude
committed
819db40
feat(sso): env.shared.example — SSO gateway config keys (Task 10)

POWERFULMOVES
and
claude
committed
d8b4ef5
fix(sso-auth): urlencode rd on OIDC no-session bounce (final-review F1)

POWERFULMOVES
and
claude
committed
35b5ec8
chore(compose): regenerate split overlays to clear drift gate

POWERFULMOVES
and
claude
committed
f8f20d3
Merge branch 'main' into feat/sso-gateway
POWERFULMOVES
authored
def4bb1

Navigation Menu

feat(sso): SSO forward-auth gateway — auth once, access all (Phase 1: service + edge) - #2221

feat(sso): SSO forward-auth gateway — auth once, access all (Phase 1: service + edge)#2221
POWERFULMOVES merged 28 commits into
mainfrom
feat/sso-gateway

Commits on Jul 25, 2026

docs(sso): design spec for the PMOVES SSO gateway (auth once, access all)

docs(sso): implementation plan (11 tasks) for the SSO gateway

fix(plan): lazy settings proxy — no import-time env read (Task 1 testability)

feat(sso-auth): scaffold service + Supabase-JWT verify + /auth/verify

fix(plan): Task 1 security — require role=authenticated + decouple verify from OIDC config

fix(sso-auth): require role=authenticated + decouple verify from OIDC config

fix(plan): Task 2/3 test correctness — role claim, TestClient host, deps

feat(sso-auth): GoTrue login (GitHub + email/pw), cookie issuance, logout

fix(plan): Task 2/3 tests use autouse fixture, not module-level reload

fix(sso-auth): test_login uses autouse env fixture (no module-reload pollution)

fix(plan): Task 2 open-redirect guard on rd param (_safe_rd)

fix(sso-auth): open-redirect guard on rd param (_safe_rd)

fix(plan): Task 2 consolidated review fixes (callback error, e-param, logout revoke+local)

fix(sso-auth): Task 2 review fixes — callback error handling, logout revoke+local redirect, error rendering

fix(plan): Task 2 gotrue transport-error fail-closed + outage tests

fix(sso-auth): harden _safe_rd (backslash/control-char/scheme reject) + gotrue fail-closed on outage

feat(sso-auth): minimal OIDC subset for jellyfin-plugin-oidc

fix(plan): Task 3 OIDC redirect_uri allowlist (HIGH open-redirect fix)

fix(sso-auth): OIDC redirect_uri allowlist + constant-time client-secret compare (HIGH open-redirect)

fix(plan): config redirect_uris field needs NoDecode (pydantic-settings eager json decode)

feat(sso): compose layer — sso-auth service, Traefik forward-auth edge, per-app routers

feat(sso-auth): Dockerfile (fleet-pinned python:3.11-slim base, non-root, healthcheck)

fix(plan): sso-auth needs traefik.enable labels or auth router never registers

fix(sso): register sso-auth with Traefik (enable+network+port) so auth router resolves

feat(sso): env.shared.example — SSO gateway config keys (Task 10)

fix(sso-auth): urlencode rd on OIDC no-session bounce (final-review F1)

chore(compose): regenerate split overlays to clear drift gate

Merge branch 'main' into feat/sso-gateway