Skip to content

F4 · Authentication and access, with depictio parity

Done 2026-10-26 · commit b2687d8 · spec v0.1

What changed

  • New spec: authentication and access. It covers:

    • instance modes (single, local, public, demo);
    • sign-in methods: password, magic links in three forms (sign-in, hand-over, scoped share link), OIDC with PKCE, SAML, depictio trust, CLI device code;
    • sessions and tokens;
    • pipeline provisioning through a scoped service account;
    • a test matrix with Keycloak and Mailpit.

  • API and data model §6 now points to it for sign-in.

Why

Thomas asked for every auth type he built in depictio, magic links and provisioning included. The share link also gives PR previews and demos access without accounts.

Decision: decision log, 2026-10-26, auth parity.

Evidence

  • Source: a code audit of depictio v1.19.2 with file:line references (research note).
  • Weak points in depictio, fixed in the design:
    • tickets stored in clear (read in the code);
    • no refresh-token reuse detection (an open TODO in the code);
    • redemption by read-then-save, which is not atomic: inferred from reading the code, not reproduced;
    • a shared provisioning key that could provision an admin: inferred from reading the code, not reproduced.

Figures and media

Follow-ups:

  • a magic-link and share-link sketch (hash at rest, atomic burn, scope claim), part of step D6's prompt;
  • the sign-in screens as UI boards, for the R7 UI review to request.

Findings and open questions

The security review of this spec is part of round R5. Its prompt now names the auth spec and every sign-in method.