feat(auth): add SSO-only authentication mode

Require an enabled OIDC-linked superuser before disabling password flows. Track session authentication methods and fail closed across the API, web client, WebSockets, and administrative mutations. Closes #1002
2026-11-03 00:11:37 -06:00 · 2026-09-02 05:04:18 +00:00
parent 6edde6c64d
commit 9165dbed1d
69 changed files with 19353 additions and 156 deletions
@@ -234,6 +234,7 @@ These are the variables you are most likely to need during development. See `ser
 | `LIBRARY_BROWSE_ROOT` | Library folder picker root         | `/`                                                       |
 | `APP_URL`             | Base URL for email links           | `http://localhost:5173`                                   |
 | `SWAGGER_ENABLED`     | Serve Swagger UI and OpenAPI JSON  | `false`                                                   |
+| `DISABLE_LOCAL_AUTH`  | Disable password authentication    | `false`                                                   |

 ---