feat(auth): native email/password sign-in driven by Authentik (no redirect) + console cleanup

[izzywdev]

What

Product direction change per owner: the login page shows default email/password UI components as the primary sign-in — no redirect to Authentik's hosted page — while Authentik remains the sole identity authority. Google stays as a button (federated through Authentik).

Backend

• New backend/security/src/services/authentikPassword.ts: drives Authentik's flow-executor JSON API server-side with the submitted credentials (identification + password stages; combined identification-with-password supported), then completes a standard OIDC authorization-code + PKCE exchange using the authenticated Authentik session and reuses oidcService.handleCallback for token exchange + user sync. Minimal per-login cookie jar; CSRF header from authentik_csrf; fails closed (503, "use the SSO button") on stages it can't drive (MFA/consent).
• New POST /api/auth/oidc/password → { token, user, sessionId }, same shape as /api/auth/login; 401 on rejected credentials; 503 when OIDC is unconfigured/uninitialized or Authentik is unreachable.
• Handoff tracing: /oidc/login now logs issuer/redirectUri/frontendBase + client-init state so the reported "blinks but nothing happens" redirect failure is diagnosable from security-service pod logs.

Frontend

• LoginPage: credentials form is always the primary UI. With oidcConfigured, submit posts to the new Authentik-backed endpoint; without it (local dev/CI stacks), the same form falls back to local users-table auth. "Sign in with Authentik" redirect button removed; "Sign in with Google" retained.
• Console flood fix: axios interceptors' per-request/response console.groups, the module-load config dump + extra /api/health probe, LoginPage's mount env dump, and AppContent auth-state logs are now DEV-only.

Tests

• 8 new unit tests for the flow-executor service (happy path, combined stage, wrong password, access-denied, MFA fail-closed, unreachable, uninitialized, consent-flow detection) — all passing.
• LoginPage suite reworked to the new contract — 8/8 passing.
• oidc-plumbing e2e (runs against real Authentik in CI) gains two tests: password sign-in returns a platform JWT; wrong password → 401.
• Post-prod smoke test 4 updated: native form + Google button, no Authentik redirect button, no demo creds.

Notes

• Users must exist in Authentik to sign in via the form in prod (Authentik is the authority). The platform-DB-only synthetic smoke account continues to use the API path (/api/auth/login), which is unchanged.
• The Authentik authentication flow must be single-factor identification+password with implicit consent on the FuzeFront provider (matches the e2e blueprint). Accounts with MFA get a clear error directing them to the SSO button.

🤖 Generated with Claude Code

https://claude.ai/code/session_01R4AUD2d6aFpPT67pnLhQGk

---

Generated by Claude Code

[github-actions]

Automated code review (gate-code-review)

Credit balance is too low

Report-only — this check never blocks merge.

[github-actions]

Automated code review (gate-code-review)

Credit balance is too low

Report-only — this check never blocks merge.

[github-actions]

Automated code review (gate-code-review)

Credit balance is too low

Report-only — this check never blocks merge.

[github-actions]

Automated code review (gate-code-review)

Credit balance is too low

Report-only — this check never blocks merge.

[github-actions]

Automated code review (gate-code-review)

Credit balance is too low

Report-only — this check never blocks merge.

[github-actions]

Automated code review (gate-code-review)

• backend/security/src/routes/auth.ts:473 — The /oidc/password handler calls authentikPasswordLogin() directly with no lazy if (!oidcService.isInitialized()) await oidcService.initialize() retry — yet the monolith copy (backend/src/routes/auth.ts) and /oidc/login both added exactly that. If the OIDC client failed to initialize at boot (Authentik not ready), authentikPasswordLogin throws AuthentikUnavailableError and this endpoint returns 503 permanently until someone hits the SSO path that re-inits — password login never self-heals.
• backend/security/src/services/authentikPassword.ts:160 (and the monolith copy backend/src/services/authentikPassword.ts) — In flowRequest, if (!res.ok) throws AuthentikUnavailableError before response_errors is ever inspected. A flow-executor credential rejection returned as an HTTP 4xx (rather than a 200-with-errors) is surfaced to the user as 503 "service unavailable" instead of 401 invalid credentials — wrong condition ordering swallows the credential-error case.
• backend/security/src/routes/auth.ts:452 (and monolith copy) — passwordLoginRateLimiter uses skipSuccessfulRequests: true, which only skips responses <400. The UnsupportedFlowStageError (MFA-required) and AuthentikUnavailableError paths both return 503, so they count against the 10-attempt budget: an MFA account or an Authentik outage locks legitimate users out after 10 tries even though they never submitted a bad credential.

Report-only — this check never blocks merge.

[github-actions]

Automated code review (gate-code-review)

Reviewed the diff focusing on runtime-correctness. The auth flow logic is largely sound (redundant authenticated boundary check, per-branch returns, guarded body access, intended rate-limiter semantics all check out). One concrete correctness issue stands out:

• backend/security/src/services/authentikPassword.ts (flowRequest redirect block, ~L130) — the redirect handler treats 307/308 the same as 302/303: it forces method = 'GET' and drops payload. Per HTTP semantics, 307/308 must preserve the original method and body, so a POST that Authentik answered with a 307/308 would be silently retried as a bodyless GET and lose the credentials/stage payload. Won't fire against Authentik's normal 302 flow-executor responses, but it's a latent logic bug. Same code duplicated in backend/src/services/authentikPassword.ts.

Everything else I traced (cookie jar, MAX_STEPS exhaustion, authorize-loop code null-handling, response mapping) either behaves as intended or is guarded. I could not verify the monolith copy's OIDC-completion section (generateAuthUrl/handleCallback adaptation) because it's truncated in the diff — worth a look given the doc comment flags a signature difference there.

Report-only — this check never blocks merge.

[github-actions]

Automated code review (gate-code-review)

Reviewing the visible diff for runtime-correctness issues only.

• backend/src/services/authentikPassword.ts (monolith port, truncated authorize section) — The file header states the monolith's oidcService.generateAuthUrl(state) returns a string (not { url, codeVerifier }) and handleCallback(code, state) takes 2 args, yet the security-service original (copied here) does const { url, codeVerifier } = oidcService.generateAuthUrl(state) and handleCallback(code, state, codeVerifier). If the port did not adapt those two calls, authorizeUrl/codeVerifier become undefined and the authorize fetch/token exchange break at runtime. This region is cut off in the diff and must be verified.
• backend/security/src/routes/auth.ts:~440 (rate limiter) — passwordLoginRateLimiter keys on client IP; behind the k8s ingress every request shares the ingress IP unless app.set('trust proxy', …) is configured, so 10 failed logins from any users would lock out all users for the window. Confirm trust-proxy is set (the comment claims parity with tokenAuthRateLimiter, but that isn't in this diff).
• backend/security/src/services/authentikPassword.ts:~230 (authorize redirect loop) — The loop caps at 5 hops (hop < 5) and the flow-executor loop at 4 (hop < 4); a real Authentik deployment that inserts extra intermediate redirects will exhaust the cap and throw AuthentikUnavailableError ("did not produce an authorization code") → spurious 503 on an otherwise-valid login.

The first item is the one to check before merging — it's a hard crash if the port wasn't adjusted, but the diff truncates exactly where it would be visible.

Report-only — this check never blocks merge.

[izzywdev]

Re: gate-code-review's three findings — all resolved in 4b6d7c0:

1. Monolith port adaptation (the "must verify" item): confirmed correct — backend/src/services/authentikPassword.ts:247 does const authorizeUrl = oidcService.generateAuthUrl(state) (string return; PKCE verifier rides the monolith's in-process state map) and :295 calls oidcService.handleCallback(code, returnedState || state) with two args. No destructuring of a {url, codeVerifier} shape survives in the port.
2. Rate-limiter IP keying: real issue — neither backend set trust proxy, so behind the ingress all clients shared one IP. Both apps now app.set('trust proxy', 1).
3. Hop caps: raised to 10 in both the flow-executor and authorize redirect loops.

---

Generated by Claude Code

[github-actions]

Automated code review (gate-code-review)

Reviewed the diff (new authentikPassword.ts, the /oidc/password route + rate limiter, and the trust proxy additions). One finding:

• backend/security/src/services/authentikPassword.ts:158 — flowRequest follows every redirect (301/302/303/307/308) by resolving Location and re-fetching with the full cookie jar attached, but never verifies the redirect target is same-origin as base. The comment says "follow same-origin redirects... carrying the jar," yet there's no origin check, so any redirect Authentik (or an intermediary) emits to a different host causes the authentik_session/authentik_csrf cookies to be sent to that host. Same latent gap exists in the authorize loop (line ~272), though there the target is matched-and-broken before the cross-origin fetch. Add an origin guard before continuing the loop.

Everything else checked out: the flow-step loop is bounded by MAX_STEPS/hop caps with no false "authenticated" path, the rate limiter's limit/requestWasSuccessful matches express-rate-limit v7 and the existing tokenAuthRateLimiter convention, FRONTEND_BASE is defined in the file, redirectUri() derives from the same env/default as the OIDC client's registered URI, and no missing awaits or swallowed errors on the success path.

Report-only — this check never blocks merge.

[github-actions]

Code-scanning triage

DRY RUN — would dismiss 67 legacy alerts:

• #1107 js/log-injection @ backend/src/routes/auth.ts
• #1106 js/log-injection @ backend/src/routes/auth.ts
• #1105 js/log-injection @ backend/src/routes/auth.ts
• #1101 js/user-controlled-bypass @ backend/src/routes/auth.ts
• #1100 js/user-controlled-bypass @ backend/src/routes/auth.ts
• #1099 js/user-controlled-bypass @ backend/src/routes/auth.ts
• #1098 js/user-controlled-bypass @ backend/src/routes/auth.ts
• #1097 js/user-controlled-bypass @ backend/src/routes/auth.ts
• #1096 js/user-controlled-bypass @ backend/src/routes/auth.ts
• #1069 js/missing-rate-limiting @ backend/src/routes/auth.ts
• #1067 js/missing-rate-limiting @ backend/src/routes/auth.ts
• #806 semgrep.fuze-auth-self-minted-user-token @ backend/src/routes/auth.ts
• #803 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• #802 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• #801 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• FQ-173: close API coverage gaps batch 14 #488 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• test: implement selected FuzeQuality coverage gaps #471 semgrep.fuze-auth-self-minted-user-token @ backend/src/routes/auth.ts
• FQ-182: tenant access, ownership, and integration administration #470 semgrep.fuze-auth-local-password-store @ backend/src/routes/auth.ts
• test: implement selected FuzeQuality coverage gaps #466 semgrep.fuze-auth-self-minted-user-token @ backend/security/src/routes/auth.ts
• refactor(frontend): LoginPage consumes @fuzefront/auth-ui AuthPanel #465 semgrep.fuze-auth-self-minted-user-token @ backend/security/src/routes/auth.ts
• feat(portal): master-admin provisioning pipeline + CRUD API (FF-EPIC-09 S2/S3) #464 semgrep.fuze-auth-local-password-store @ backend/security/src/routes/auth.ts
• feat(authentik): Gmail login + OIDC providers for the FuzeInfra admin plane #454 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• fix(fuzequality): mount writable runtime directories #355 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• Social-broker return-origin allowlist: marketplace.mendysrobotics.com + live.mendysrobotics.com #352 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• design-approval: approve auth-experience / password-reset #351 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• design-approval: approve auth-experience / verify-email #350 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• design-approval: approve auth-experience / signin #349 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• design-approval: approve auth-experience / signup #348 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• design-approval: approve auth-experience / signup #347 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• feat(deploy): give Unleash its own Argo Application (hybrid-Argo) #346 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• fix(frontend): stabilize WorkspaceProvisioningGate provisioning-spinner test #345 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• feat(registry): seed FuzeSocial as builtin — adds Social to nav #344 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• ci: auto-run post-prod E2E after release + Claude autofix on failure #343 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• feat(security): public email-availability endpoint for signup #342 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• chore(fuzequality): add sealed bootstrap secrets #341 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• chore(fuzequality): add sealed bootstrap secrets #340 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• chore(fuzequality): add sealed bootstrap secrets #339 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• feat(deploy): wire server-brokered Google sign-in env into security chart #330 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/index.ts
• feat(security): server-brokered Google sign-in (browser never transits Authentik) #329 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/index.ts
• ci(deps): bump actions/dependency-review-action from 4 to 5 #295 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• chore(governance): onboard governance-sync + publish-expert #294 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• feat(auth): policy-backed requirePermission middleware for consuming services #293 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• feat(security): manage-devices (sessions) + social link/unlink + set-password #292 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• fix(security): derive /methods capabilities from config instead of hard-coding them #291 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• feat(security): password reset flow (request/confirm + session revocation) #290 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• fix(security): conform /authz/bulk-check to the frozen contract + bound it #289 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• e2e: 3 OIDC-plumbing UI tests encode the pre-boundary flow (and the Google button as a path to Authentik's login page) #287 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• governance: required check 'In-repo packages resolve from source' is path-filtered — every PR is permanently BLOCKED unless it touches a package.json #286 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• feat(auth): implement @fuzefront/auth — real verifier + middleware (#117) #285 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• fix(signup): /signup no longer bounced to /login by the boot probe's 401 (#283) #284 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• bug(signup): /signup always renders the sign-in form — 401 interceptor redirects to /login first #283 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• fix(security): enforce session revocation on the request path #282 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• fix(nginx): route /api/v1/security to the security-service (parity + landmine) #281 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• test(e2e): cover real password sign-in through the Security API + Authentik #280 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• fix(e2e): run the security-service in the compose stack + route /api/v1/security #279 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• fix(sdlc): reap leaked agent worktrees (they silently break all agent launches) #278 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• fix(authn): Google sign-in goes direct to Google + repair auth e2e drift from the Security API cutover #277 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• feat(authentik): bind account-security stages to user-settings + auth flows #276 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• feat(local): k8s HTTPS via cert-manager, k8s docs, legacy cleanup #22 js/log-injection @ backend/src/index.ts
• fix(ci): backend types/lockfile + sdk/api-client/frontend lint green #21 js/log-injection @ backend/src/index.ts
• feat: SDK window-bridge shared services + login fix + FuzeClock example #9 js/missing-rate-limiting @ backend/src/routes/auth.ts
• feat: run FuzeFront in-cluster on FuzeInfra (kind), first light #8 js/missing-rate-limiting @ backend/src/routes/auth.ts
• Deploy FuzeFront Corporate Website to AWS #7 js/missing-rate-limiting @ backend/src/routes/auth.ts
• feat: Complete backend rebuild and database migration to PostgreSQL #6 js/missing-rate-limiting @ backend/src/routes/auth.ts
• feat: Add Docker containerization with PostgreSQL and shared infrastructure #5 js/clear-text-logging @ backend/src/routes/auth.ts
• Rename repository from FrontFuse to FuzeFront #4 js/tainted-format-string @ backend/src/index.ts
• feat(build): Implement comprehensive security scanning with GitHub Advanced Security #3 js/tainted-format-string @ backend/src/index.ts

[github-actions]

Code-scanning triage

Dismissed 67 legacy alerts:

• #1107 js/log-injection @ backend/src/routes/auth.ts
• #1106 js/log-injection @ backend/src/routes/auth.ts
• #1105 js/log-injection @ backend/src/routes/auth.ts
• #1101 js/user-controlled-bypass @ backend/src/routes/auth.ts
• #1100 js/user-controlled-bypass @ backend/src/routes/auth.ts
• #1099 js/user-controlled-bypass @ backend/src/routes/auth.ts
• #1098 js/user-controlled-bypass @ backend/src/routes/auth.ts
• #1097 js/user-controlled-bypass @ backend/src/routes/auth.ts
• #1096 js/user-controlled-bypass @ backend/src/routes/auth.ts
• #1069 js/missing-rate-limiting @ backend/src/routes/auth.ts
• #1067 js/missing-rate-limiting @ backend/src/routes/auth.ts
• #806 semgrep.fuze-auth-self-minted-user-token @ backend/src/routes/auth.ts
• #803 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• #802 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• #801 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• FQ-173: close API coverage gaps batch 14 #488 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• test: implement selected FuzeQuality coverage gaps #471 semgrep.fuze-auth-self-minted-user-token @ backend/src/routes/auth.ts
• FQ-182: tenant access, ownership, and integration administration #470 semgrep.fuze-auth-local-password-store @ backend/src/routes/auth.ts
• test: implement selected FuzeQuality coverage gaps #466 semgrep.fuze-auth-self-minted-user-token @ backend/security/src/routes/auth.ts
• refactor(frontend): LoginPage consumes @fuzefront/auth-ui AuthPanel #465 semgrep.fuze-auth-self-minted-user-token @ backend/security/src/routes/auth.ts
• feat(portal): master-admin provisioning pipeline + CRUD API (FF-EPIC-09 S2/S3) #464 semgrep.fuze-auth-local-password-store @ backend/security/src/routes/auth.ts
• feat(authentik): Gmail login + OIDC providers for the FuzeInfra admin plane #454 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• fix(fuzequality): mount writable runtime directories #355 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• Social-broker return-origin allowlist: marketplace.mendysrobotics.com + live.mendysrobotics.com #352 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• design-approval: approve auth-experience / password-reset #351 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• design-approval: approve auth-experience / verify-email #350 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• design-approval: approve auth-experience / signin #349 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• design-approval: approve auth-experience / signup #348 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• design-approval: approve auth-experience / signup #347 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• feat(deploy): give Unleash its own Argo Application (hybrid-Argo) #346 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• fix(frontend): stabilize WorkspaceProvisioningGate provisioning-spinner test #345 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• feat(registry): seed FuzeSocial as builtin — adds Social to nav #344 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• ci: auto-run post-prod E2E after release + Claude autofix on failure #343 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• feat(security): public email-availability endpoint for signup #342 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• chore(fuzequality): add sealed bootstrap secrets #341 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• chore(fuzequality): add sealed bootstrap secrets #340 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• chore(fuzequality): add sealed bootstrap secrets #339 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/routes/auth.ts
• feat(deploy): wire server-brokered Google sign-in env into security chart #330 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/index.ts
• feat(security): server-brokered Google sign-in (browser never transits Authentik) #329 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/src/index.ts
• ci(deps): bump actions/dependency-review-action from 4 to 5 #295 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• chore(governance): onboard governance-sync + publish-expert #294 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• feat(auth): policy-backed requirePermission middleware for consuming services #293 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• feat(security): manage-devices (sessions) + social link/unlink + set-password #292 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• fix(security): derive /methods capabilities from config instead of hard-coding them #291 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• feat(security): password reset flow (request/confirm + session revocation) #290 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• fix(security): conform /authz/bulk-check to the frozen contract + bound it #289 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• e2e: 3 OIDC-plumbing UI tests encode the pre-boundary flow (and the Google button as a path to Authentik's login page) #287 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• governance: required check 'In-repo packages resolve from source' is path-filtered — every PR is permanently BLOCKED unless it touches a package.json #286 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• feat(auth): implement @fuzefront/auth — real verifier + middleware (#117) #285 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• fix(signup): /signup no longer bounced to /login by the boot probe's 401 (#283) #284 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• bug(signup): /signup always renders the sign-in form — 401 interceptor redirects to /login first #283 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• fix(security): enforce session revocation on the request path #282 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• fix(nginx): route /api/v1/security to the security-service (parity + landmine) #281 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• test(e2e): cover real password sign-in through the Security API + Authentik #280 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• fix(e2e): run the security-service in the compose stack + route /api/v1/security #279 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• fix(sdlc): reap leaked agent worktrees (they silently break all agent launches) #278 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• fix(authn): Google sign-in goes direct to Google + repair auth e2e drift from the Security API cutover #277 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• feat(authentik): bind account-security stages to user-settings + auth flows #276 javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring @ backend/security/src/routes/auth.ts
• feat(local): k8s HTTPS via cert-manager, k8s docs, legacy cleanup #22 js/log-injection @ backend/src/index.ts
• fix(ci): backend types/lockfile + sdk/api-client/frontend lint green #21 js/log-injection @ backend/src/index.ts
• feat: SDK window-bridge shared services + login fix + FuzeClock example #9 js/missing-rate-limiting @ backend/src/routes/auth.ts
• feat: run FuzeFront in-cluster on FuzeInfra (kind), first light #8 js/missing-rate-limiting @ backend/src/routes/auth.ts
• Deploy FuzeFront Corporate Website to AWS #7 js/missing-rate-limiting @ backend/src/routes/auth.ts
• feat: Complete backend rebuild and database migration to PostgreSQL #6 js/missing-rate-limiting @ backend/src/routes/auth.ts
• feat: Add Docker containerization with PostgreSQL and shared infrastructure #5 js/clear-text-logging @ backend/src/routes/auth.ts
• Rename repository from FrontFuse to FuzeFront #4 js/tainted-format-string @ backend/src/index.ts
• feat(build): Implement comprehensive security scanning with GitHub Advanced Security #3 js/tainted-format-string @ backend/src/index.ts

[github-actions]

Prod Authentik ops

BLOCKED: repo secret AUTHENTIK_PROD_TOKEN is not set. Mirror the cluster token:

kubectl -n fuzefront get secret fuzefront-secrets -o jsonpath="{.data.AUTHENTIK_BOOTSTRAP_TOKEN}" | base64 -d | gh secret set AUTHENTIK_PROD_TOKEN --repo izzywdev/FuzeFront

[github-actions]

Prod Authentik ops

BLOCKED: repo secret AUTHENTIK_PROD_TOKEN is not set. Mirror the cluster token:

kubectl -n fuzefront get secret fuzefront-secrets -o jsonpath="{.data.AUTHENTIK_BOOTSTRAP_TOKEN}" | base64 -d | gh secret set AUTHENTIK_PROD_TOKEN --repo izzywdev/FuzeFront

[github-actions]

Code-scanning triage

Dismissed 3 legacy alerts:

• #1125 semgrep.fuze-auth-self-minted-user-token @ backend/src/routes/auth.ts
• #1119 semgrep.fuze-auth-self-minted-user-token @ backend/security/src/routes/auth.ts
• #1102 js/user-controlled-bypass @ frontend/src/pages/LoginPage.tsx

[github-actions]

Prod Authentik ops

BLOCKED: repo secret AUTHENTIK_PROD_TOKEN is not set. Mirror the cluster token:

kubectl -n fuzefront get secret fuzefront-secrets -o jsonpath="{.data.AUTHENTIK_BOOTSTRAP_TOKEN}" | base64 -d | gh secret set AUTHENTIK_PROD_TOKEN --repo izzywdev/FuzeFront

[github-actions]

Prod Authentik ops

BLOCKED: repo secret AUTHENTIK_PROD_TOKEN is not set. Mirror the cluster token:

kubectl -n fuzefront get secret fuzefront-secrets -o jsonpath="{.data.AUTHENTIK_BOOTSTRAP_TOKEN}" | base64 -d | gh secret set AUTHENTIK_PROD_TOKEN --repo izzywdev/FuzeFront