Phase 1: add OIDC client with proxyAuth header fallback

Replicates the admin-panel OIDC pattern: redirect/callback/token exchange
(client_secret_post) / JWKS validate / signed session cookie. get_user_identity()
prefers the OIDC session and falls back to the proxyAuth header. Adds /logout
route (was previously only a link). No manifest change yet.

app/main.py

@@ -20,6 +20,8 @@ import httpx
 from fastapi import FastAPI, Request, HTTPException
 from fastapi.responses import HTMLResponse, RedirectResponse, JSONResponse
 
+from app import oidc
+
 logging.basicConfig(level=logging.INFO)
 logger = logging.getLogger("member-dashboard")
 
@@ -30,17 +32,25 @@ app = FastAPI()
 
 
 # ---------------------------------------------------------------------------
-# Identity — Cloudron proxyAuth injects the authenticated user's USERNAME.
+# Identity — Cloudron OIDC session cookie (username). proxyAuth header is the
+# legacy fallback during the transition.
 # ---------------------------------------------------------------------------
 
 def get_user_identity(request: Request) -> str:
-    """Return the logged-in user's identity (Cloudron username, or email if
-    Cloudron happens to send one).
+    """Return the logged-in user's identity (Cloudron username).
 
-    Cloudron's proxyAuth injects the USERNAME (e.g. "ntnsndr") via
-    X-Remote-User, not the email. We pass it through unchanged to the broker,
-    which resolves username → email (it holds the Cloudron admin token).
+    Priority: a validated OIDC session cookie (when the oidc addon is active),
+    then the proxyAuth header (legacy fallback during the transition).
     """
+    # OIDC session cookie (only when the addon is configured).
+    if oidc.is_oidc_configured():
+        token = request.cookies.get(oidc.SESSION_COOKIE)
+        if token:
+            identity = oidc.read_session(token)
+            if identity:
+                return identity
+
+    # Legacy proxyAuth header fallback.
     for header in (
         "x-remote-user",
         "x-forwarded-user",
@@ -107,6 +117,8 @@ async def healthz():
 async def index(request: Request):
     identity = get_user_identity(request)
     if not identity:
+        if oidc.is_oidc_configured():
+            return RedirectResponse("/auth/openid/login", status_code=302)
         return HTMLResponse(
             "<h1>Not authenticated</h1><p>Please log in via the dashboard login.</p>",
             status_code=401,
@@ -154,6 +166,58 @@ async def api_revoke_key(name: str, request: Request):
         return JSONResponse({"error": e.detail}, status_code=e.status_code)
 
 
+# ---------------------------------------------------------------------------
+# OIDC routes — authorization-code flow against Cloudron's OIDC provider.
+# Active only when the `oidc` addon is configured (CLOUDRON_OIDC_* present).
+# During the transition the legacy proxyAuth header still works as a fallback.
+# ---------------------------------------------------------------------------
+
+@app.get("/auth/openid/login")
+async def oidc_login(request: Request):
+    if not oidc.is_oidc_configured():
+        raise HTTPException(404, "OIDC not configured")
+    login_url, state, nonce = oidc.build_login_url(request.headers.get("host", ""))
+    resp = RedirectResponse(login_url, status_code=302)
+    resp.set_cookie("oidc_state", state, max_age=600, httponly=True, samesite="lax")
+    resp.set_cookie("oidc_nonce", nonce, max_age=600, httponly=True, samesite="lax")
+    return resp
+
+
+@app.get("/auth/openid/callback")
+async def oidc_callback(request: Request):
+    if not oidc.is_oidc_configured():
+        raise HTTPException(404, "OIDC not configured")
+    code = request.query_params.get("code")
+    state = request.query_params.get("state")
+    expected_state = request.cookies.get("oidc_state")
+    nonce = request.cookies.get("oidc_nonce")
+
+    if not code or not state or not expected_state or not nonce:
+        return HTMLResponse("<h1>Login failed</h1><p>Incomplete OIDC callback.</p>", status_code=400)
+    if state != expected_state:
+        return HTMLResponse("<h1>Login failed</h1><p>State mismatch (possible CSRF).</p>", status_code=400)
+
+    try:
+        identity = await oidc.exchange_code(code, request.headers.get("host", ""), nonce)
+    except ValueError as e:
+        logger.warning("OIDC login failed: %s", e)
+        return HTMLResponse("<h1>Login failed</h1><p>Could not complete sign-in.</p>", status_code=400)
+
+    session = oidc.write_session(identity)
+    resp = RedirectResponse("/", status_code=302)
+    resp.set_cookie(oidc.SESSION_COOKIE, session, max_age=oidc.SESSION_MAX_AGE, httponly=True, samesite="lax")
+    resp.delete_cookie("oidc_state")
+    resp.delete_cookie("oidc_nonce")
+    return resp
+
+
+@app.get("/logout")
+async def logout():
+    resp = RedirectResponse("/", status_code=302)
+    resp.delete_cookie(oidc.SESSION_COOKIE)
+    return resp
+
+
 # ---------------------------------------------------------------------------
 # UI (brand-matched, self-contained, no external requests)
 # ---------------------------------------------------------------------------