ldraney/mdview
1
0
Fork 0
Code Issues 12 Pull requests Projects Releases Packages Wiki Activity Actions 2

[Ch 11] Integration — auth, database, and API token generation #20

New issue
Open
opened 2026-08-01 19:03:35 +00:00 by ldraney · 0 comments
ldraney commented 2026-08-01 19:03:35 +00:00
Owner
Copy link

Type

Feature

Lineage

Standalone — scoped from platform-playbook chapter 11 for the full-stack mdview vision.

Repo

ldraney/mdview

User Story

As a developer
I want to log in via Keycloak and generate API tokens
So that I can authenticate the CLI through the cluster

Context

This is the core integration ticket. Everything is provisioned (database, Keycloak, deployment) — now wire it together in the app. Users log in via Keycloak SSO, generate API tokens from a web UI, and use those tokens from the CLI. The CLI authenticates via token header; the cluster proxies authenticated requests to the mdview container.

File Targets

  • Gemfile — add omniauth_openid_connect, omniauth-rails_csrf_protection
  • app/controllers/sessions_controller.rb — create OmniAuth callback handler
  • app/models/api_token.rb — create (user_id, token_digest, name, last_used_at)
  • app/controllers/api_tokens_controller.rb — create (generate, revoke, list)
  • app/views/api_tokens/ — token management UI
  • config/initializers/omniauth.rb — Keycloak provider config
  • app/controllers/application_controller.rb — auth enforcement + token middleware
  • db/migrate/ — users table, api_tokens table

Files the agent should NOT touch:

  • app/controllers/markdown_controller.rb — keep rendering logic separate from auth

Feature Flag

none — this is core functionality, not a toggleable feature

Acceptance Criteria

  • Web login via Keycloak works end-to-end
  • User can generate API tokens from the web UI
  • User can revoke API tokens
  • CLI can authenticate with Authorization: Bearer <token> header
  • Unauthenticated requests are rejected (401)
  • Token last_used_at updates on use

Test Expectations

  • Unit test: API token digest generation and validation
  • Integration test: OmniAuth callback creates session
  • Integration test: token auth middleware accepts valid token, rejects invalid
  • Run command: bundle exec rspec

Constraints

  • Follow landscaping-assistant auth pattern (OmniAuth + PKCE)
  • Token storage: store bcrypt digest, never the raw token
  • Show raw token exactly once on creation

Checklist

  • PR opened
  • Tests pass
  • No unrelated changes

Related

  • project-mdview — project this affects
### Type Feature ### Lineage Standalone — scoped from platform-playbook chapter 11 for the full-stack mdview vision. ### Repo `ldraney/mdview` ### User Story As a developer I want to log in via Keycloak and generate API tokens So that I can authenticate the CLI through the cluster ### Context This is the core integration ticket. Everything is provisioned (database, Keycloak, deployment) — now wire it together in the app. Users log in via Keycloak SSO, generate API tokens from a web UI, and use those tokens from the CLI. The CLI authenticates via token header; the cluster proxies authenticated requests to the mdview container. ### File Targets - `Gemfile` — add `omniauth_openid_connect`, `omniauth-rails_csrf_protection` - `app/controllers/sessions_controller.rb` — create OmniAuth callback handler - `app/models/api_token.rb` — create (user_id, token_digest, name, last_used_at) - `app/controllers/api_tokens_controller.rb` — create (generate, revoke, list) - `app/views/api_tokens/` — token management UI - `config/initializers/omniauth.rb` — Keycloak provider config - `app/controllers/application_controller.rb` — auth enforcement + token middleware - `db/migrate/` — users table, api_tokens table Files the agent should NOT touch: - `app/controllers/markdown_controller.rb` — keep rendering logic separate from auth ### Feature Flag none — this is core functionality, not a toggleable feature ### Acceptance Criteria - [ ] Web login via Keycloak works end-to-end - [ ] User can generate API tokens from the web UI - [ ] User can revoke API tokens - [ ] CLI can authenticate with `Authorization: Bearer <token>` header - [ ] Unauthenticated requests are rejected (401) - [ ] Token `last_used_at` updates on use ### Test Expectations - [ ] Unit test: API token digest generation and validation - [ ] Integration test: OmniAuth callback creates session - [ ] Integration test: token auth middleware accepts valid token, rejects invalid - Run command: `bundle exec rspec` ### Constraints - Follow landscaping-assistant auth pattern (OmniAuth + PKCE) - Token storage: store bcrypt digest, never the raw token - Show raw token exactly once on creation ### Checklist - [ ] PR opened - [ ] Tests pass - [ ] No unrelated changes ### Related - `project-mdview` — project this affects
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
phase:1

   
phase:2

   
phase:3

   
phase:4

   
phase:5
No labels
phase:1
phase:2
phase:3
phase:4
phase:5
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
ldraney/mdview#20
No description provided.