kwila/kiosk
1
0
Fork 1
Code Pull requests Releases 17 Activity Actions

docs(spec): add authentication and access control spec #23

Merged
addison merged 14 commits from exe-dev-bot/kiosk:spec/007-authentication-access-control-2026-02-20 into main 2026-02-20 06:08:56 -05:00
Conversation 0 Commits 14 Files changed 7 +691 -6
exe-dev-bot commented 2026-02-20 04:08:21 -05:00
Contributor
Copy link

Adds a new Specture spec for authentication and role-based access control.

Covers:

  • Three-tier API access (public, kiosk/localhost, authenticated)
  • Admin login with password, member OTP provisioning
  • API key management with device labels
  • Feature-level permissions (calendars, settings, system, users)
  • Database schema for users, permissions, API keys, OTP codes, audit log
  • Middleware flow for request authorization
Adds a new Specture spec for authentication and role-based access control. Covers: - Three-tier API access (public, kiosk/localhost, authenticated) - Admin login with password, member OTP provisioning - API key management with device labels - Feature-level permissions (calendars, settings, system, users) - Database schema for users, permissions, API keys, OTP codes, audit log - Middleware flow for request authorization
Co-authored-by: Shelley <shelley@exe.dev>
exe-dev-bot force-pushed spec/007-authentication-access-control-2026-02-20 from ed2156ad84 to 003177a64b 2026-02-20 04:12:10 -05:00 Compare 
Co-authored-by: Shelley <shelley@exe.dev>
Co-authored-by: Shelley <shelley@exe.dev>
Co-authored-by: Shelley <shelley@exe.dev>
Co-authored-by: Shelley <shelley@exe.dev>
Co-authored-by: Shelley <shelley@exe.dev>
Co-authored-by: Shelley <shelley@exe.dev>
Co-authored-by: Shelley <shelley@exe.dev>
Co-authored-by: Shelley <shelley@exe.dev>
Co-authored-by: Shelley <shelley@exe.dev>
- OTP uses URL fragment (#otp=) instead of query param
- Add CSP header requirement for XSS mitigation
- Rate limiting on auth endpoints (5/min/IP, exponential backoff)
- HTTPS marked as out of scope (accepted risk for LAN)
- Host header validation on kiosk routes (DNS rebinding protection)
- API key generation: crypto/rand, 256-bit entropy, bcrypt hashed
- Privilege escalation protection (cannot grant higher than own level)
- OTP codes hashed before storage, expired records auto-cleaned
- Separate auth_failure table for failed auth logging
- Revoke all admin keys on password reset
- Replace informal 'parent' language with precise permission terms
- Key list endpoint returns metadata only (raw key shown once)
- Clarify key revocation: own keys or write-all on users
- Admin redirects to admin UI, not member dashboard
- write-own valid for settings, not for system
- POST /api/calendars requires write-own (creator = owner)
- Ownership assignment: creator specifies owner, defaults to self
- Auth response includes api_key, username, role, permissions
- Expired API keys return 401 (not 403)
- Audit log covers successful logins and OTP claims
- Permission levels explicitly hierarchical
- OTP claim must be atomic (DB transaction)
- User deletion out of scope (deactivation only)
- Max 3 concurrent admin API keys
- GET /api/events returns all calendars

Co-authored-by: Shelley <shelley@exe.dev>
Define all frontend pages and their permission requirements:
- / — login (unauth) or dashboard (member) or redirect to /system (admin)
- /calendars — calendar management (replaces old /admin feed management)
- /users — user management, permissions, OTP, key management
- /system — theme, update, sync, audit log (admin landing page)
- /settings — personal API keys/devices (any authenticated user)

Document old /admin migration path.
Update frontend task list with per-page tasks.

Co-authored-by: Shelley <shelley@exe.dev>
- System account: 'admin' → 'root' (username, role, seed file, CLI)
- Permission levels: write-own → write, write-all → admin
- Hierarchy: none < read < write < admin
- User roles: root / member (no 'admin' role)
- Dashboard card: 'System' → 'System Administration'
- Human-friendly terms: calendar admin, user admin, system admin

Co-authored-by: Shelley <shelley@exe.dev>
- Remove read level from system feature (no read-only view)
- GET /api/audit requires admin on system, not read
- Update dashboard card, permission notes, and task list

Co-authored-by: Shelley <shelley@exe.dev>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
kwila/kiosk!23
No description provided.