feat(authn): provider-agnostic Security AuthN backend (/api/v1/security)

[izzywdev]

AuthN backend slice — provider-agnostic Security API

Implements the AuthN surface under `/api/v1/security` against the frozen contract (PR #243: `packages/security/openapi.yaml` + `@fuzefront/security-client`), purely through the neutral `IdentityProvider` interface (env-driven factory). Authentik is named only inside the concrete provider.

Included

• `AuthentikIdentityProvider` absorbing `oidc.ts` (keeps `id_token_signed_response_alg: 'HS256'`), `authentikPassword.ts`, and a self-contained `machine-identity` (M2M provision/introspect) copied into the security package so it compiles within its `rootDir`.
• Routes: session CRUD + exchange, server-brokered social start/callback (302 to same-host `/api/auth/idp/` — never `auth.fuzefront.com`, opaque code back to the app, never a token in the URL), signup, `/methods`, `/mfa/` (factors, activate, recovery codes, challenge/verify), `/verify/*` (email + phone), M2M `/tokens` + introspect (fail-closed).
• Unit tests (`security-routes.test.ts` + provider tests) asserting status codes, the `SessionResult` discriminator, the `{ items }` envelope, bearer enforcement, and fail-closed mapping.

Typecheck fixes from prior WIP

• machine-identity no longer crosses tsconfig `rootDir` (local copy on native fetch).
• security tsconfig `types: ["node"]` (a backend service should not pull React ambient types; also sidesteps a corrupted hoisted `@types/react`).
• Removed unused `appBaseUrl`/`socialCallbackPath`/`isProduction`.

Scope

AuthN backend only. AuthZ (`/authz/`, `/tenants/`) is a separate later stream. UI, independent acceptance tests, and deploy wiring are NOT in this PR.

🤖 Generated with Claude Code

[github-actions]

Automated code review (gate-code-review)

Reviewing for runtime-correctness bugs only.

• backend/security/src/providers/authentik/AuthentikIdentityProvider.ts:141 — socialStates, pendingCodes, and mfaChallenges are per-process in-memory Maps, but the social-start route (routes/security.ts) sets a state cookie commented "so the callback is replica-agnostic." brokerCallback/exchangeCode/verifyMfa validate only against the in-process map, never the cookie — so any start→callback (or login→MFA-verify) that lands on a different replica, or survives a restart, throws UnauthorizedError and auth fails non-deterministically.
• backend/security/src/providers/authentik/AuthentikIdentityProvider.ts:658 — confirmPhoneVerification(phone, code) runs db('users').where({ phone }).update({ phone_verified: true }) with no user/session scoping; it flips phone_verified on every user row sharing that phone number (and requires no bearer token at the route), verifying the wrong account.
• backend/security/src/providers/authentik/AuthentikIdentityProvider.ts:628 — confirmEmailVerification matches code_hash globally (else q.andWhere({ code_hash: sha256(code) })) with no email/user scoping and no orderBy; a 6-digit code can select another user's pending row, marking the wrong row.user_id's email_verified true.
• backend/security/src/providers/authentik/AuthentikIdentityProvider.ts:601 — confirmEmailVerification picks an arbitrary .first() among unconsumed rows for a given token/code hash with no expiry filter in the query; if multiple pending verifications exist (resends), it can non-deterministically return an expired row and reject a still-valid one.

Note: the in-memory-map issue is the highest-impact and will manifest in any multi-replica deploy (the chart in this repo runs the backend with replicas).

Report-only — this check never blocks merge.

[github-actions]

CI fix pushed — branch claude-auto-fix-ci-claude/authn-backend-29394246721

Root cause: backend/security/tests/tsconfig.json was missing "types": ["node", "jest"]. The jest.config.js in backend/security uses ts-jest with tsconfig: 'tests/tsconfig.json', but without jest types, TypeScript couldn't resolve the global it/describe/expect identifiers, producing TS2593/TS2304 errors for the entire api-token test suite.

Fix: Added "types": ["node", "jest"] to backend/security/tests/tsconfig.json — same pattern as backend/tests/tsconfig.json.

The fix is committed and pushed to claude-auto-fix-ci-claude/authn-backend-29394246721. A PR could not be auto-created (Actions cannot create PRs in this repo), but the branch is ready to review and merge into claude/authn-backend.

[github-actions]

Automated code review (gate-code-review)

Reviewing the diff for runtime-correctness bugs only.

• backend/security/src/providers/authentik/AuthentikIdentityProvider.ts:96-98 — socialStates, pendingCodes, and mfaChallenges are per-process in-memory Maps, but this is a multi-replica k8s service (trust proxy is set). startSocialLogin/brokerCallback/exchangeCode/verifyMfa will intermittently fail with UnauthorizedError whenever the start and callback/exchange requests land on different replicas. The sec_social_state cookie is set in routes/security.ts (/social/:provider/start) with the comment "so the callback is replica-agnostic," but brokerCallback never reads the cookie — it looks the state up in the in-memory map, so the replica-agnostic guarantee is false and the cookie is dead code.

• backend/security/src/providers/authentik/AuthentikIdentityProvider.ts:315-320 — introspectToken returns { active: true } for any validly-signed session JWT purely from verifySessionToken, never checking the sessions table. After logout deletes the session row, the same token still introspects as active until JWT expiry, so revocation is not honored on the introspection path (unlike getUserInfo).

• backend/security/src/providers/authentik/AuthentikIdentityProvider.ts:449-453 — confirmPhoneVerification(phone, code) runs db('users').where({ phone }).update({ phone_verified: true }), scoped only by phone number, with no authenticated user context. It marks every user row sharing that phone as verified, and the route (/verify/phone/confirm) requires no bearer token — a caller who knows a valid OTP verifies phones on accounts that aren't theirs.

• backend/security/src/providers/authentik/AuthentikIdentityProvider.ts:456-464 — getVerificationStatus decodes the token with verifySessionToken instead of getUserInfo, so it skips the sessions-table existence/expiry check and returns status for tokens whose session has already been revoked via logout.

• backend/security/src/providers/authentik/AuthentikIdentityProvider.ts:189-192 — startSocialLogin's open-redirect guard rejects ^https?:// and //-prefixed targets but not backslash-prefixed paths (e.g. /\evil.com or \/\/evil.com), which browsers normalize to protocol-relative navigations, so redirectTo can still escape same-origin at the final res.redirect in /social/callback.

Report-only — this check never blocks merge.