2 Commits

Include renames

Author	SHA1	Message	Date
jcoffey-dev	d2c76aa3a4	Build the tenant-picker backend protocol (no frontend yet, by design) ... A multi-membership identity (belongs to more than one tenant) used to get a flat 501 refusal -- named as undesigned future work across CLAUDE.md/threat-model.md/the runbook since early Phase 4. Scope for this change was agreed via AskUserQuestion: backend protocol only, fully verified via real HTTP round trips, not the actual picker page -- web has zero session/cookie-handling code today (confirmed while researching this), so building that is separately-scoped, unverifiable frontend work in this environment (no live backend, no browser). session.Manager gains IssuePendingLogin/ValidatePendingLogin, a second JWT token type proving identity without committing to a tenant yet (10-minute TTL). PendingLoginClaims is deliberately a distinct Go type from Claims, and -- caught by this change's own test suite before it shipped -- needed a JSON field name disjoint from Claims.UserID's "user_id" too: go-jose's unmarshal is happy to populate a struct from any token whose claims happen to share a key, so a real session token would otherwise have parsed successfully as a pending login. Fixed via "pending_user_id" instead; both directions (session-as-pending, pending-as-session) now have regression tests. rbacstore.ListMembershipsWithTenantForUser joins tenant_memberships with tenants, since a picker needs display names, not just IDs. loginhandler.resolveIdentity's multiple-membership branch no longer errors -- finishLogin routes it into startTenantSelection instead, which issues a pending-login cookie (Path=/auth, so it's never sent on ordinary requests) and redirects to a new configurable SelectTenantRedirectURL (defaults to {POST_LOGIN_REDIRECT_URL}/select- tenant). Two new routes complete the round trip: GET /auth/memberships lists the pending identity's real tenant options, and POST /auth/select-tenant re-derives the role for the chosen tenant server-side (never trusts a client-supplied role, refuses a tenant_id outside the identity's actual memberships with 403) before issuing the real session -- responding with JSON {"redirect_url": ...}, not a redirect, since a POST/fetch caller should control its own navigation. Verified with the same real-fake-IdP tests the rest of this package uses (coreos/go-oidc's oidctest, crewjam/saml's samlidp): the full login -> pending cookie -> GET /auth/memberships -> POST /auth/select-tenant -> real session round trip for both protocols, plus negative paths (missing/expired pending cookie, a tenant_id outside membership, a real session token rejected as a pending login and vice versa). ErrMultipleMemberships is removed -- it's not an error path anymore. Docs updated in lockstep: CLAUDE.md, threat-model.md (including its summary table), phase-4-runbook.md (new §12), enterprise/README.md (new "Tenant selection" section, explicit about what's still not built and why: no session handling in web, no CORS on enterprise-auth).	2026-08-14 14:04:37 -07:00
jcoffey-dev	08a90a27aa	Build SAML login (enterprise/internal/loginhandler), mirroring OIDC ... Adds GET /auth/saml/login + POST /auth/saml/acs alongside the existing OIDC pair, both converging on the same upsert-user/resolve-tenant/ issue-session path. loginhandler.New now takes an optional *saml.ServiceProvider, RegisterRoutes registers each protocol's routes independently so either, both, or neither can be configured. SAML's replay/unsolicited-response defense (InResponseTo, standing in for OIDC's state) is carried via a SameSite=None sentry_saml_request cookie -- None because the ACS endpoint receives a cross-site POST from the IdP's origin, which SameSite=Lax cookies are never sent on. enterprise-auth's main.go now fetches+parses SAML_IDP_METADATA_URL at startup (samlsp.FetchMetadata) and wires the result through. Verified to the same bar as OIDC: a real fake IdP (crewjam/saml/samlidp, genuine XML signing/verification) drives the full login->ACS->session-cookie round trip and negative paths (bad InResponseTo, missing request cookie, missing email/NameID, no/multiple tenant memberships), all in loginhandler/saml_test.go, no Docker needed. The login-form HTML is bypassed by pre-seeding a saml.Session directly into samlidp's session store and presenting the matching `session` cookie -- an IdP-supported shortcut (confirmed by reading GetSession), the same "skip the UI, keep the crypto real" approach oidctest gave the OIDC tests. Writing that test caught two real bugs in internal/saml.ParseResponse, both fixed here: it never called r.ParseForm() before reading the POSTed SAMLResponse field, so every real ACS POST would have silently decoded an empty response; and its email-attribute matching missed urn:oid:0.9.2342.19200300.100.1.3 (the standard LDAP "mail" OID), which is what an IdP sends by default absent an explicit AttributeConsumingService request for "email" -- exactly what samlidp's own DefaultAssertionMaker does, and plausibly what real IdPs' default SAML app templates do too. Docs (CLAUDE.md, threat-model.md, architecture.md, enterprise/README.md, phase-4-runbook.md, docker-compose.yml's enterprise-auth comment) updated in lockstep: SAML login moves from "protocol mechanics only" to "built, verified with a real fake IdP, not yet tried against a real external IdP or a running enterprise-auth container" -- the same disclosed gap OIDC already carried.	2026-08-14 06:39:36 -07:00