2 Commits

Author	SHA1	Message	Date
wmantly	653c79f099	Per-host SSO: data model + normalization (#57) ... Add Host fields sso_enabled / sso_allow_users / sso_allow_groups (empty allow-lists = any authenticated user) and normalize them (parseAllowList). SSO reuses conf.oidc and is OR'd with basic auth. Enforcement (session cookie + Lua + nginx auth location) lands separately. Unit tests included. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-11 12:01:54 -04:00
wmantly	3e5590288a	Per-host HTTP basic auth (#57) ... Adds opt-in basic auth per Host, following the existing per-host controls pattern: - Host fields basicauth_enabled / basicauth_realm / basicauth_users ({user: base64(sha1(pw))}). Credentials are parsed to plaintext by the pure host_features normalizer and hashed at the route layer (utils/basicauth.js), so plaintext never reaches Redis. - ops/nginx_conf/hostfeatures.lua enforces it in access phase: verifies the Authorization header against base64(sha1(password)), fails closed with a 401 WWW-Authenticate challenge. - hosts.ejs gains an enable toggle, realm, and a username:password textarea (passwords never echoed back; blank keeps the current set). Unit tests cover hashing (matches the htpasswd {SHA} vector), credential parsing, and normalization. Note: the Lua path needs verification on a live OpenResty box. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-11 11:47:08 -04:00