Roadmap relationship
Outcome
Provide production-ready human authentication that supports secure onboarding and recovery without requiring operators to delete user files or share generated passwords manually.
Current gap
The first admin and collaborators currently rely on locally generated credentials, manual password transfer, fixed-duration cookies, and destructive file deletion for recovery. There is no password reset, MFA, session inventory, or federated login.
User experience
- Add email-based invite/activation and password-reset flows with expiry, resend, invalid/used-token states, and generic anti-enumeration responses.
- Support TOTP MFA with recovery codes, step-up prompts for sensitive actions, and a clear lost-device recovery path.
- Show active sessions/devices with last-used metadata and one-click revocation.
- Offer optional OIDC first; keep local auth available as an emergency path with explicit configuration.
Scope
- Introduce verified email, password change/reset, login/session history, MFA enrollment/recovery, and session revocation.
- Rotate signing keys safely and version session cookies; enforce idle and absolute expiry.
- Add OIDC discovery, state/nonce/PKCE validation, organization-domain mapping, and provider disable/recovery controls.
- Preserve loopback development ergonomics without allowing auth bypass in exposed box mode.
Technical direction
- Use modern password hashing parameters with transparent rehash-on-login and constant-time comparisons.
- Hash reset/invite/recovery tokens at rest; rate-limit by normalized identity and network signals without enabling trivial lockout abuse.
- Separate authentication identity from organization membership and authorization.
- Emit sanitized auth security events without passwords, OTPs, tokens, or raw provider assertions.
Safety and operability
- Require recent authentication for password, MFA, SSO, owner, token, and secret-sensitive changes.
- Provide admin recovery codes or documented offline recovery before SSO enforcement can be enabled.
- Protect against CSRF, session fixation, open redirects, replay, OAuth mix-up, and user enumeration.
Acceptance criteria
- A user can accept an invite, reset a forgotten password, enroll MFA, revoke another session, and recover with a code.
- Disabling a user or removing membership invalidates access promptly.
- OIDC login maps only verified identities according to explicit organization policy.
- Existing local users continue to sign in and are prompted through a non-breaking upgrade path.
Verification
- Token expiry/replay, rate-limit, CSRF, fixation, redirect, MFA recovery, and session rotation tests.
- OIDC mock-provider integration tests including invalid state/nonce and provider outage.
- Accessible end-to-end flows on mobile and desktop.
Non-goals
- SAML or SCIM in the initial implementation.
- Storing third-party provider access tokens unless a separate integration requires them.
- Replacing provider IAM authentication.