mosaic/stack
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

[EPIC] Auth & Frontend Remediation #411

New Issue
Closed
opened 2026-02-16 16:56:23 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-02-16 16:56:23 +00:00
Owner
Copy Link

Summary

Backend auth hardening + frontend OIDC-aware multi-method login.

The Mosaic Stack authentication system has critical gaps that cause silent 500 errors in production and leave the frontend unable to adapt to backend configuration. The frontend login UI is hardcoded for OIDC-only authentication with no fallback, no error display, and no awareness of backend state.

Phases

  • Phase 1: Critical Backend Fixes (OIDC validation, error handling, PKCE)
  • Phase 2: Auth Config Discovery (GET /auth/config endpoint)
  • Phase 3: Backend Hardening (trustedOrigins, CORS, session config)
  • Phase 4: Frontend Foundation (auth components)
  • Phase 5: Login Page Integration (dynamic provider rendering)
  • Phase 6: Error Recovery & Polish (PDA error messages, retry logic, session expiry)

Plan

See for full implementation plan.

## Summary Backend auth hardening + frontend OIDC-aware multi-method login. The Mosaic Stack authentication system has critical gaps that cause silent 500 errors in production and leave the frontend unable to adapt to backend configuration. The frontend login UI is hardcoded for OIDC-only authentication with no fallback, no error display, and no awareness of backend state. ## Phases - Phase 1: Critical Backend Fixes (OIDC validation, error handling, PKCE) - Phase 2: Auth Config Discovery (GET /auth/config endpoint) - Phase 3: Backend Hardening (trustedOrigins, CORS, session config) - Phase 4: Frontend Foundation (auth components) - Phase 5: Login Page Integration (dynamic provider rendering) - Phase 6: Error Recovery & Polish (PDA error messages, retry logic, session expiry) ## Plan See for full implementation plan.
jason.woltje added this to the Auth-Frontend-Remediation (0.0.14) milestone 2026-02-16 16:56:23 +00:00
jason.woltje added the authsecurity labels 2026-02-16 16:56:23 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
ai
AI/LLM integration
 api
Backend/API work
 api
auth
Authentication
 database
database
Database/schema work
 devops
Docker/deployment
 docs
Documentation
 frontend
graph
knowledge-module
migration
Data migration
 orchestrator
Orchestrator service (apps/orchestrator/)
 p0
Critical priority
 p1
High priority
 p2
Medium priority
 p3
Low priority
 performance
Performance work
 phase-1
phase-2
phase-3
phase-4
phase-5
plugin
MoltBot plugin work
 search
security
Security-related
 setup
Initial setup
 testing
Testing/QA
 web
Frontend work
No Label auth security
Milestone
No items
No Milestone Auth-Frontend-Remediation (0.0.14)
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaic/stack#411
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?