Add AT Protocol OAuth 2.0 authentication for dashboard

- Implement full OAuth 2.0 with PKCE using haileyok/atproto-oauth-golang
- Backend For Frontend (BFF) pattern: tokens stored server-side only
- AES-256-GCM encrypted session cookies
- Auto token refresh when near expiry
- Restrict access to allowed handles (1440.news, wehrv.bsky.social)
- Add genkey utility for generating OAuth configuration
- Generic error messages to prevent handle enumeration
- Server-side logging of failed login attempts for security monitoring

New files:
- oauth.go: OAuth client wrapper and DID/handle resolution
- oauth_session.go: Session management with encrypted cookies
- oauth_middleware.go: RequireAuth middleware for route protection
- oauth_handlers.go: Login, callback, logout, metadata endpoints
- cmd/genkey/main.go: Generate OAuth secrets and JWK keypair
- oauth.env.example: Configuration template

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

This commit is contained in:

primal

2026-01-30 15:16:51 -05:00

parent 1a2f6c15a9

commit 8192bce301

11 changed files with 1446 additions and 84 deletions

									
										docker-compose.yml
									
		+1
		
												View File
												
				@@ -6,6 +6,7 @@ services:

				    stop_grace_period: 30s

				    env_file:

				      - pds.env

				      - oauth.env

				    environment:

				      DB_HOST: atproto-postgres

				      DB_PORT: 5432