Frank b48de913b8 open-webui: SSO via authentik (OIDC authorization-code flow) ...

- quadlet: OAUTH_*/OPENID_* env + EnvironmentFile for the client secret
  (secret stays off-repo in /home/dank/Containers/open-webui/env, mode 600)
- authentik objects created live: application 'open-webui', OAuth2 provider
  'Open WebUI' (Strict redirect URI), 'Open WebUI roles' scope mapping,
  entitlements Open WebUI Users/Admins bound to openwebui_users/admins
- e2e: 18-openwebui-sso.spec.ts (silent SSO round-trip) + prefix in config
- unit tests: OIDC wiring + secret-hygiene assertions
- docs: SSO section + history entry

2026-09-24 20:04:17 -07:00

..

00-auth.setup.ts

e2e: Playwright suite for homepage + guard chain; RBAC gate on /admin; fix stale service links

2026-09-01 16:42:33 -07:00

10-homepage.spec.ts

e2e: budget user/admin title asserts to 60s for cold Anubis PoW

2026-09-01 17:09:17 -07:00

11-admin.spec.ts

docs(arr): fleet consolidated on FrankBook-Pro, VPN egress proven; E2E counts derived from registry

2026-09-04 13:17:39 -07:00

12-crawl.spec.ts

docs(arr): fleet consolidated on FrankBook-Pro, VPN egress proven; E2E counts derived from registry

2026-09-04 13:17:39 -07:00

13-sso.spec.ts

authentik: require flows + application on proxy providers; harden SSO e2e

2026-09-01 18:55:44 -07:00

14-guard.spec.ts

test(e2e): accept IdP redirect as a valid gate in the direct-nav guard spec

2026-09-03 17:00:34 -07:00

15-unauth-fetch.spec.ts

test(e2e): pin unauthenticated wget-style denial for copyparty and homepage

2026-09-04 19:34:59 -07:00

16-marreta.spec.ts

e2e: add Marreta homepage-link regression test

2026-09-12 13:31:00 -07:00

17-hermes-vhost.spec.ts

tests: gate the hermes vhost, and stop specs from silently not running

2026-09-16 07:33:38 -07:00

18-openwebui-sso.spec.ts

open-webui: SSO via authentik (OIDC authorization-code flow)

2026-09-24 20:04:17 -07:00