mosaic/stack
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Phase 1: Critical Backend Fixes #412

New Issue
Closed
opened 2026-02-16 16:56:37 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-02-16 16:56:37 +00:00
Owner
Copy Link

Parent Epic: #411

Stories

  • 1.1 Add OIDC_REDIRECT_URI to REQUIRED_OIDC_ENV_VARS with URL + path validation
  • 1.2 Wrap BetterAuth handler in try/catch with error logging
  • 1.3 Fix docker-compose.swarm.portainer.yml OIDC_REDIRECT_URI default
  • 1.4 Enable PKCE in genericOAuth config
  • 1.5 Add inline docs above @SkipCsrf() explaining BetterAuth's internal CSRF handling

Acceptance Criteria

  • OIDC_REDIRECT_URI validated (URL format, /auth/callback path)
  • BetterAuth errors logged with context (method, URL, stack)
  • Docker compose has safe default for OIDC_REDIRECT_URI
  • PKCE enabled - authorization URL includes code_challenge
  • @SkipCsrf() documented with rationale
  • All new code has tests (85%+ coverage)
  • pnpm lint && pnpm typecheck && pnpm test pass

Files

  • apps/api/src/auth/auth.config.ts
  • apps/api/src/auth/auth.controller.ts
  • apps/api/src/auth/auth.config.spec.ts
  • docker-compose.swarm.portainer.yml
## Parent Epic: #411 ## Stories - **1.1** Add OIDC_REDIRECT_URI to REQUIRED_OIDC_ENV_VARS with URL + path validation - **1.2** Wrap BetterAuth handler in try/catch with error logging - **1.3** Fix docker-compose.swarm.portainer.yml OIDC_REDIRECT_URI default - **1.4** Enable PKCE in genericOAuth config - **1.5** Add inline docs above @SkipCsrf() explaining BetterAuth's internal CSRF handling ## Acceptance Criteria - [ ] OIDC_REDIRECT_URI validated (URL format, /auth/callback path) - [ ] BetterAuth errors logged with context (method, URL, stack) - [ ] Docker compose has safe default for OIDC_REDIRECT_URI - [ ] PKCE enabled - authorization URL includes code_challenge - [ ] @SkipCsrf() documented with rationale - [ ] All new code has tests (85%+ coverage) - [ ] pnpm lint && pnpm typecheck && pnpm test pass ## Files - apps/api/src/auth/auth.config.ts - apps/api/src/auth/auth.controller.ts - apps/api/src/auth/auth.config.spec.ts - docker-compose.swarm.portainer.yml
jason.woltje added this to the Auth-Frontend-Remediation (0.0.14) milestone 2026-02-16 16:56:37 +00:00
jason.woltje added the authsecurityapiapi labels 2026-02-16 16:56:37 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
ai
AI/LLM integration
 api
Backend/API work
 api
auth
Authentication
 database
database
Database/schema work
 devops
Docker/deployment
 docs
Documentation
 frontend
graph
knowledge-module
migration
Data migration
 orchestrator
Orchestrator service (apps/orchestrator/)
 p0
Critical priority
 p1
High priority
 p2
Medium priority
 p3
Low priority
 performance
Performance work
 phase-1
phase-2
phase-3
phase-4
phase-5
plugin
MoltBot plugin work
 search
security
Security-related
 setup
Initial setup
 testing
Testing/QA
 web
Frontend work
No Label api api auth security
Milestone
No items
No Milestone Auth-Frontend-Remediation (0.0.14)
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaic/stack#412
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?