luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 19: Local Auth (No-OIDC Mode) #23

Merged
luckberg merged 78 commits from gsd/phase-19-local-auth-no-oidc-mode into main 2026-06-18 06:25:00 -04:00
Conversation 0 Commits 78 Files Changed 75
+14 -13
2 changed files with 14 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 13e3757e88 - Show all commits
.planning/ROADMAP.md
+3 -3
View File
@@ -437,7 +437,7 @@ At ≤767px (`window.matchMedia('(max-width: 767px)')` in `apps/pwa/src/App.tsx`
| 16. CI Dep Audit, Sec & Img Hyg | v1.1 | 6/6 | Complete | 2026-06-13 | | 16. CI Dep Audit, Sec & Img Hyg | v1.1 | 6/6 | Complete | 2026-06-13 |
| 17. UI Optimization & Polish | v1.1 | 0/? | Not started | - | | 17. UI Optimization & Polish | v1.1 | 0/? | Not started | - |
| 18. Auto Timezone Detection | v1.1 | 4/4 | Complete | 2026-06-14 | | 18. Auto Timezone Detection | v1.1 | 4/4 | Complete | 2026-06-14 |
| 19. Local Auth (No-OIDC Mode) | v1.1 | 0/5 | Planned | - | | 19. Local Auth (No-OIDC Mode) | v1.1 | 1/5 | In Progress| |
## Backlog ## Backlog
@@ -683,7 +683,7 @@ Plans:
**Mode:** standard **Mode:** standard
**Depends on:** Phase 12 (Initial Setup Wizard) — builds directly on the pre-OIDC **local-user foundation** introduced there: nullable `users.oidc_iss`/`oidc_sub` + the claimed/pending marker, and the first-login-claims merge. Phase 19 generalizes that single bootstrap local user into a full local-account model + login. **Depends on:** Phase 12 (Initial Setup Wizard) — builds directly on the pre-OIDC **local-user foundation** introduced there: nullable `users.oidc_iss`/`oidc_sub` + the claimed/pending marker, and the first-login-claims merge. Phase 19 generalizes that single bootstrap local user into a full local-account model + login.
**Requirements**: AUTH-LOCAL-01..AUTH-LOCAL-20 (derived during planning 2026-06-17) — local_credentials schema (01), scrypt hash/verify (02), login route (03), localAuthMiddleware (04), auth-mode endpoint (05), logout (06), admin create-member (07), admin reset (08), self-change (09), OIDC-link (10), break-glass CLI (11), LoginPage (12), admin UI (13), settings UI (14), routing gate (15), dev-bypass/harness rework (16), hasLocalCredential (17), de-Authelia copy (18), rate-limit/lockout (19), auth unit tests (20). Plus `LOCAL_SESSION_SECRET` env + boot assertion (D-05). **Requirements**: AUTH-LOCAL-01..AUTH-LOCAL-20 (derived during planning 2026-06-17) — local_credentials schema (01), scrypt hash/verify (02), login route (03), localAuthMiddleware (04), auth-mode endpoint (05), logout (06), admin create-member (07), admin reset (08), self-change (09), OIDC-link (10), break-glass CLI (11), LoginPage (12), admin UI (13), settings UI (14), routing gate (15), dev-bypass/harness rework (16), hasLocalCredential (17), de-Authelia copy (18), rate-limit/lockout (19), auth unit tests (20). Plus `LOCAL_SESSION_SECRET` env + boot assertion (D-05).
**Plans:** 5 plans (4 waves) **Plans:** 1/5 plans executed
**Provenance:** Deferred from the Phase 12 discussion (2026-06-15) — see `.planning/phases/12-initial-setup-wizard/12-CONTEXT.md` §Deferred Ideas. The operator runs FamilySync this way themselves and wants no-OIDC operation as a first-class mode. **Provenance:** Deferred from the Phase 12 discussion (2026-06-15) — see `.planning/phases/12-initial-setup-wizard/12-CONTEXT.md` §Deferred Ideas. The operator runs FamilySync this way themselves and wants no-OIDC operation as a first-class mode.
@@ -697,7 +697,7 @@ Plans:
Plans: Plans:
**Wave 1** **Wave 1**
- [ ] 19-01-PLAN.md — Foundation (TDD): local_credentials schema + 0003 migration, scrypt hash/verify, local-session JWT helpers, LOCAL_SESSION_SECRET boot guard + generate-secrets, .dockerignore scripts exclusion (AUTH-LOCAL-01/02) - [x] 19-01-PLAN.md — Foundation (TDD): local_credentials schema + 0003 migration, scrypt hash/verify, local-session JWT helpers, LOCAL_SESSION_SECRET boot guard + generate-secrets, .dockerignore scripts exclusion (AUTH-LOCAL-01/02)
**Wave 2** *(blocked on Wave 1)* **Wave 2** *(blocked on Wave 1)*
.planning/STATE.md
+11 -10
View File
@@ -2,16 +2,17 @@
gsd_state_version: 1.0 gsd_state_version: 1.0
milestone: v1.1 milestone: v1.1
milestone_name: Operability & Polish milestone_name: Operability & Polish
current_phase: 13 current_phase: 19
status: "Phase 12 shipped — PR #22" current_phase_name: local-auth-no-oidc-mode
status: executing
stopped_at: Phase 19 UI-SPEC approved stopped_at: Phase 19 UI-SPEC approved
last_updated: "2026-06-17T20:04:38.622Z" last_updated: "2026-06-17T20:08:36.716Z"
last_activity: 2026-06-17 last_activity: 2026-06-17
last_activity_desc: Phase 19 planning complete last_activity_desc: Phase 19 execution started
progress: progress:
total_phases: 24 total_phases: 24
completed_phases: 10 completed_phases: 10
total_plans: 44 total_plans: 49
completed_plans: 43 completed_plans: 43
percent: 42 percent: 42
--- ---
@@ -23,14 +24,14 @@ progress:
See: .planning/PROJECT.md (updated 2026-06-16) See: .planning/PROJECT.md (updated 2026-06-16)
**Core value:** One color-coded family calendar (shared + personal) and shared lists from a single low-friction PWA — cross-ecosystem, no app store **Core value:** One color-coded family calendar (shared + personal) and shared lists from a single low-friction PWA — cross-ecosystem, no app store
**Current focus:** Phase 13 — real-lint-gate-eslint **Current focus:** Phase 19 — local-auth-no-oidc-mode
## Current Position ## Current Position
Phase: 13 Phase: 19 (local-auth-no-oidc-mode) — EXECUTING
Plan: Not started Plan: 1 of 5
Status: Phase 12 shipped — PR #22 Status: Executing Phase 19
Last activity: 2026-06-17 — Phase 19 planning complete Last activity: 2026-06-17 — Phase 19 execution started
### ✅ Resolved Checkpoint — Phase 15 Plan 15-03 Task 2 (human-action) ### ✅ Resolved Checkpoint — Phase 15 Plan 15-03 Task 2 (human-action)