hermes-bot
0ecf1aaac5
ci/woodpecker/push/test Pipeline was successful
The ProxyHeader scheme took the username from X-Authentik-Username for any peer inside Auth:ReverseProxy:TrustedProxies. The deployment set that to the whole pod CIDR (a hand copy of the Talos podSubnets), so every pod the network policies let reach :8080 (Hermes, Gitea, Traefik, all of ai and monitoring) could claim any human's name on the Facts page and on saved answers. Authentik's proxy provider sends no signed identity header, so the header cannot be verified at all. Humans now sign in with OpenID Connect against Authentik: a public client with PKCE, the username is preferred_username from the ID token, whose signature is checked against the provider's JWKS. Nothing about the network path or the request headers names a user any more. - Auth:Oidc:Authority, ClientId and PublicOrigin are required; the host refuses to start without them. PublicOrigin builds the redirect URI, because TLS ends at Traefik and the request scheme is http. - UI pages, static assets and the Blazor hub need a session (fallback policy); an anonymous browser is redirected to the provider. - The read API (/api/v1 reads, /ask, /questions, /rank, /status) needs a session or an API key (policy "read") and answers 401, never a redirect. Before, it was anonymous and relied on the gate, BasicAuth or network policy in front. - Writes still need an API key (policy "write"). - /health, /ready and the HMAC-signed /webhook stay anonymous. - ProxyHeaderAuthenticationHandler and Auth:ReverseProxy are removed. Tests: an in-process OpenID provider issues RS256 ID tokens. They cover the PKCE challenge and redirect URI, the full code flow ending in a session named after the token's user, rejection of a token signed by a foreign key, the Authentik header signing in nobody, and 401s for credential-less API calls.