feat: integrate Logto OIDC for user authentication

- Add Logto OIDC integration (app/core/logto.py): CookieStorage adapter, create/decode session token helpers, sync_logto_user upsert - New auth endpoints (/api/v1/auth): sign-in, callback, sign-out, me - AuthRedirectMiddleware: protects HTML pages, redirects to /setup when Logto is unconfigured, to /login otherwise - Update require_admin_auth: accepts dmarq_session cookie JWT first, then API key, then Bearer JWT (fully backward compatible) - Update User model: add logto_id, username, picture, created_at, updated_at; make hashed_password nullable for Logto-only users; is_superuser default=True - New Alembic migration d4e5f6a7b8c9 for the above schema changes - Add LOGTO_ENDPOINT / LOGTO_APP_ID / LOGTO_APP_SECRET / LOGTO_REDIRECT_URI settings with logto_configured property - Create login.html (Sign in with Logto button) and setup.html (step-by-step configuration guide) - Update base.html: user menu with avatar/name and sign-out via Alpine.js fetch to /api/v1/auth/me - Update settings.html: remove localStorage adminApiKey; session cookie is sent automatically by browser; add 401 → /login redirect - Update requirements.txt: replace fastapi-users additions with logto + aiohttp - Add test_auth.py: 18 new tests covering session tokens, CookieStorage, sync_logto_user, /me, /sign-in (503), /sign-out cookie clearing - Fix test_security_extra.py: pass Request mock to require_admin_auth; add new test_valid_session_cookie_returns_auth_context Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/b448f585-7646-40f8-ae2d-9986c361e3fd Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-03-30 10:09:50 +00:00
parent 308e6f8d91
commit 531dc968a8
21 changed files with 1496 additions and 203 deletions
@@ -0,0 +1,87 @@
+"""Add Logto fields to users table.
+
+Adds the columns required for Logto OIDC integration and general user-profile
+enhancements:
+
+- ``logto_id``      – the Logto subject claim (``sub``); acts as the stable
+                      external identity reference.
+- ``username``      – optional display username synced from Logto.
+- ``picture``       – profile-picture URL synced from Logto.
+- ``created_at``    – row-creation timestamp.
+- ``updated_at``    – last-update timestamp.
+
+``hashed_password`` is made nullable because Logto-authenticated users
+authenticate externally and have no local password.
+
+Revision ID: d4e5f6a7b8c9
+Revises: c3d4e5f6a7b8
+Create Date: 2026-03-30 10:00:00.000000
+"""
+
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = "d4e5f6a7b8c9"
+down_revision: Union[str, Sequence[str], None] = "c3d4e5f6a7b8"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    """Apply schema changes."""
+    with op.batch_alter_table("users") as batch_op:
+        # New columns
+        batch_op.add_column(
+            sa.Column("logto_id", sa.String(), nullable=True)
+        )
+        batch_op.add_column(
+            sa.Column("username", sa.String(), nullable=True)
+        )
+        batch_op.add_column(
+            sa.Column("picture", sa.String(), nullable=True)
+        )
+        batch_op.add_column(
+            sa.Column(
+                "created_at",
+                sa.DateTime(),
+                nullable=True,
+                server_default=sa.func.now(),
+            )
+        )
+        batch_op.add_column(
+            sa.Column(
+                "updated_at",
+                sa.DateTime(),
+                nullable=True,
+                server_default=sa.func.now(),
+            )
+        )
+        # Make hashed_password nullable (Logto users have no local password)
+        batch_op.alter_column("hashed_password", nullable=True)
+        # Set is_superuser default to True (all users are admins for now)
+        batch_op.alter_column("is_superuser", server_default=sa.true())
+
+    # Add unique index on logto_id
+    op.create_index(
+        op.f("ix_users_logto_id"),
+        "users",
+        ["logto_id"],
+        unique=True,
+    )
+
+
+def downgrade() -> None:
+    """Revert schema changes."""
+    op.drop_index(op.f("ix_users_logto_id"), table_name="users")
+
+    with op.batch_alter_table("users") as batch_op:
+        batch_op.drop_column("updated_at")
+        batch_op.drop_column("created_at")
+        batch_op.drop_column("picture")
+        batch_op.drop_column("username")
+        batch_op.drop_column("logto_id")
+        batch_op.alter_column("hashed_password", nullable=False)
+        batch_op.alter_column("is_superuser", server_default=sa.false())