feat(auth): optional viewer auth layer (PR1: none + basic + scaffold)

Adds a pluggable, optional authentication layer for the viewer. The OSS default (AUTH_MODE=none) preserves today's open behaviour exactly. When operators flip AUTH_MODE=basic, the viewer requires username/password login, and the session cookie short-circuits the existing API key middleware. API keys remain a parallel auth path for programmatic clients regardless of mode. Backend - src/auth/ — AuthMode/Identity/Provider Protocol; NoneAuthProvider, BasicAuthProvider (argon2id); SessionAuthMiddleware with sliding-window cookie re-issue; signed-cookie session via itsdangerous; double-submit CSRF; structured auth_event audit logger; /api/v1/auth/{config,login,logout,me} router; CLI helper for hashing passwords. - src/config.py — adds AUTH_* fields with a model_validator that fails fast at startup when per-mode env is missing or malformed. - src/main.py — wires SessionAuthMiddleware conditionally and registers cookieAuth alongside APIKeyHeader in custom_openapi(). - src/middleware/api_key_auth.py — short-circuits when request.state.identity is set; gates the same-origin shortcut on AUTH_MODE=none so it cannot silently defeat the new gate. - src/middleware/logging_middleware.py — adds user_sub/email/provider fields to response logs when an identity is present. - src/services/session_store.py + src/api/pipeline_viewer.py — pipeline sessions now carry identity_sub/provider_id; SSE session event payload surfaces the user. Viewer - clients/viewer/src/auth/ — AuthContext + apiFetch + LoginPage + CallbackPage + RequireAuth. - viewer-main.tsx wraps routes in <AuthProvider>; six fetch sites migrated to apiFetch (handles credentials, CSRF echo, 401 redirect). OIDC / SSO landing in PR2 — generic OIDCAuthProvider with Microsoft Entra as a config preset; scaffolding (config schema, route shape, viewer LoginPage rendering) is in place from this PR. Tests - 21 unit + 11 integration tests; full unit suite (553) passes; no regressions in existing api_key_auth or middleware tests. Docs - New docs/how-to/enable-basic-auth.md. - Extended docs/reference/authentication.md and docs/explanation/authentication-design.md. - AGENTS.md gains a workflows row. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Blake Bertuccelli-Booth committed on May 7, 2026, 05:06 PM

Showing 46 changed files +2377 additions -46 deletions

M AGENTS.md +1

M Makefile +8

A clients/viewer/src/auth/AuthContext.tsx +114

A clients/viewer/src/auth/CallbackPage.tsx +25

A clients/viewer/src/auth/LoginPage.tsx +162

A clients/viewer/src/auth/apiFetch.ts +63

A clients/viewer/src/auth/types.ts +23

M clients/viewer/src/components/pipeline-viewer/FeedbackModal.tsx +2 -3

M clients/viewer/src/hooks/useFeedbackConfig.ts +2 -3

M clients/viewer/src/hooks/usePipelineViewer.ts +5 -6

M clients/viewer/src/pages/MinimalPage.tsx +2 -3

M clients/viewer/src/viewer-main.tsx +25 -4

M docs/explanation/authentication-design.md +39

A docs/how-to/enable-basic-auth.md +94

M docs/reference/authentication.md +45 -4

M pyproject.toml +2

M src/api/pipeline_viewer.py +25 -4

A src/auth/__init__.py +29

A src/auth/audit.py +61

A src/auth/base.py +85

A src/auth/cli.py +46

A src/auth/cookies.py +70

A src/auth/csrf.py +40

A src/auth/dependencies.py +31

A src/auth/factory.py +51

A src/auth/middleware.py +76

A src/auth/providers/__init__.py +1

A src/auth/providers/basic_provider.py +128

A src/auth/providers/none_provider.py +27

A src/auth/routes.py +225

A src/auth/session.py +102

M src/config.py +92 -1

M src/main.py +22 -5

M src/middleware/api_key_auth.py +23 -2

M src/middleware/logging_middleware.py +30 -8

M src/services/session_store.py +17 -1

M tests/conftest.py +8 -1

A tests/conftest_fixtures/auth.py +114

A tests/integration/auth/__init__.py

A tests/integration/auth/test_basic_login_roundtrip.py +155

A tests/unit/auth/__init__.py

A tests/unit/auth/test_basic_provider.py +64

A tests/unit/auth/test_config_validation.py +68

A tests/unit/auth/test_csrf.py +44

A tests/unit/auth/test_session.py +84

M uv.lock +47 -1