Whole-site login via Pocket ID (OIDC), replacing basic auth #16

Merged

arne merged 1 commit from pocket-id-login into main

2026-09-16 13:16:07 +02:00

arne commented

2026-09-16 13:03:16 +02:00

Owner

Login required everywhere: KOKOS_OIDC_ISSUER turns it on, using https://tilgang.golten.as in production. Only /feed/, /audio/ and /images/ stay public, because podcast platforms fetch them without credentials.
How it works: internal/auth uses the authorization-code flow with PKCE (via coreos/go-oidc). After login you get a signed cookie that lasts 12 hours. It adds /auth/login, /auth/callback and /auth/logout, and htmx requests without a session get sent to the login page.
Basic auth removed: that includes the password in the systemd unit. The client secret and session secret now go in /etc/kokosbananas/env in the container.
Docs: ADR-0021 and updates to both READMEs.
Local dev: .envrc loads a gitignored .env.local if it exists.
Tests: a fake OIDC provider covers login and logout, htmx requests, forged cookies, public paths and the redirect-after-login checks.

Before deploying: register https://goltenstories.no/auth/callback in Pocket ID and create /etc/kokosbananas/env (see deploy/README.md).

🤖 Generated with Claude Code

- **Login required everywhere:** `KOKOS_OIDC_ISSUER` turns it on, using `https://tilgang.golten.as` in production. Only `/feed/`, `/audio/` and `/images/` stay public, because podcast platforms fetch them without credentials. - **How it works:** `internal/auth` uses the authorization-code flow with PKCE (via `coreos/go-oidc`). After login you get a signed cookie that lasts 12 hours. It adds `/auth/login`, `/auth/callback` and `/auth/logout`, and htmx requests without a session get sent to the login page. - **Basic auth removed:** that includes the password in the systemd unit. The client secret and session secret now go in `/etc/kokosbananas/env` in the container. - **Docs:** ADR-0021 and updates to both READMEs. - **Local dev:** `.envrc` loads a gitignored `.env.local` if it exists. - **Tests:** a fake OIDC provider covers login and logout, htmx requests, forged cookies, public paths and the redirect-after-login checks. **Before deploying:** register `https://goltenstories.no/auth/callback` in Pocket ID and create `/etc/kokosbananas/env` (see `deploy/README.md`). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

arne added 1 commit

2026-09-16 13:03:16 +02:00

auth: whole-site login via Pocket ID (OIDC), replacing basic auth (ADR-0021) b08a62b5ca

The site now requires login through the OIDC provider set in KOKOS_OIDC_ISSUER
(https://tilgang.golten.as in production). It uses the authorization-code flow
with PKCE and keeps the login in an HMAC-signed session cookie. Only /feed/,
/audio/ and /images/ stay public for podcast platforms. Basic auth is removed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

arne merged commit 6c689005dc into main

2026-09-16 13:16:07 +02:00

arne referenced this pull request from a commit

2026-09-16 13:16:08 +02:00

Whole-site login via Pocket ID (OIDC), replacing basic auth (#16)

arne deleted branch pocket-id-login

2026-09-16 13:16:13 +02:00