8 Commits

Include renames

Author	SHA1	Message	Date
woggioni	074e48a372	Add OIDC back-channel logout with session indexes	2026-11-02 12:15:41 +08:00
woggioni	ec056a15b9	Migrate dependency management from pip to uv ... - Add a uv workspace at the repository root covering all packages/kaya-* members - Replace pip-compile requirements files with a committed uv.lock - Remove redundant per-package dev extras - Build and publish artifacts with uv build and uv publish in CI - Update the README with uv sync/run/build commands	2026-10-21 21:56:08 +08:00
woggioni	e73c4b2c18	Validate ID tokens against discovered issuer and refreshed tokens ... OIDCClient.validate_id_token compared the iss claim against OIDCConfig.issuer (the discovery URL) instead of the issuer advertised by the provider metadata. This broke Microsoft Entra ID, whose v2 metadata advertises the templated issuer https://login.microsoftonline.com/{tenantid}/v2.0 while tokens carry the concrete tenant GUID, and it also affected tenant-domain issuers. - Validate iss against the discovered metadata issuer and substitute {tenantid} with the token's tid claim. - Catch jwt.PyJWTError in the OIDC callback so invalid tokens return 400 instead of 500 (InvalidIssuerError is not a ValueError). - Re-enable aud/exp/iat/nbf checks for unsigned (alg: none) ID tokens. - Validate ID tokens returned by the refresh grant before storing them, including nonce continuity when present and sub continuity with the session user. - Document Entra ID support and update tests.	2026-10-01 23:22:00 +08:00
woggioni	fa8bb0487d	Add Pushed Authorization Request (RFC 9126) support ... OIDCConfig.par selects never (default), auto, or always. When enabled, build_authorization_url pushes the authorization parameters to the provider's PAR endpoint and redirects the browser with only client_id and request_uri. Providers that require PAR raise a clear error when configured with par='never'. Client authentication follows the token endpoint (HTTP Basic or public client).	2026-10-01 08:23:40 +08:00
woggioni	15dc4b6dad	Add single/multi identity strategy to OIDC providers ... OIDCProviders and OIDCMixin accept strategy='single-identity' (default) or 'multi-identity'. Single-identity evicts other providers' identities and tokens after a successful login so the session holds exactly one user, matching Spring Security's last-login-wins behavior. Ephemeral flow keys are preserved so in-flight logins can still complete.	2026-10-01 08:23:40 +08:00
woggioni	3af2e7a975	Add support for multiple OIDC providers ... Namespace per-provider session state as oidc:{provider}:... so several providers can share one session, and add an OIDCProviders mixin that wires multiple configs onto distinct /auth/{provider}/... routes. Logging out of one provider no longer signs the user out of the others.	2026-10-01 08:23:40 +08:00
woggioni	3ebf079533	Refactor to composable KayaMixin architecture ... Replace wrapper-based SessionMiddleware/OIDCApp with KayaMixin subclasses applied via KayaApp(mixins=[...]). Mixins hook into handle_request and handle_websocket via before/after hooks, so both ASGI and RSGI keep working. Mixin dependencies are applied automatically and deduplicated.	2026-07-23 22:09:59 +08:00
woggioni	24a797e3d2	Add kaya-oidc package for OpenID Connect authentication	2026-07-23 22:09:59 +08:00