proxy

Files

T

wmantlyandClaude Opus 4.8 87c0d024d5 Per-host SSO: Node auth endpoints + Redis session (#57 )

Adds the /__proxy_auth OIDC flow served on every proxied host:
- routes/host_auth.js: /start (PKCE+state, per-host redirect_uri), /callback
  (exchange, enforce the host allow-list via utils/host_sso.identityAllowed,
  mint session + set __proxy_sso cookie), /logout.
- models/sso_session.js: SsoSession (Redis-backed, TTL'd; read directly by the
  Lua gate) and HostSsoState (in-flight auth request).
- utils/oidc.js: per-host redirect_uri override on buildAuthUrl/exchangeCode.
- conf.hostSso (reuses conf.oidc). Allow-list logic unit-tested.

Enforcement (Lua gate + nginx location) lands next.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-11 15:41:28 -04:00

basicauth.test.js

Per-host SSO: data model + normalization (#57 )

2026-07-11 12:01:54 -04:00

callback_queue.test.js

Added tests

2025-12-31 16:51:55 -05:00

dynamic_record.test.js

Add dynamic DNS: keep A records pointed at the current public IP

2026-07-10 23:55:56 -04:00

host_features.test.js

Add per-host reverse-proxy controls (rate limit, cache, headers, IP ACL)