[RonnyB71]

Implements login for the first version, as decided in #21: nothing in Saman is available without logging in.

Requirements: NF-11, NF-02, NF-12, and groundwork for NF-13.

How it works

• Payload owns the session. Both login methods end with the same payload-token cookie. Access control stays in the collection access functions.
• Astro middleware (src/web/src/middleware.ts) asks Payload's /api/brukere/me who the cookie belongs to on every request.
  • Without a user, it redirects to /logg-inn?redirect=….
  • If the CMS can't be reached, it returns 503, so nobody gets in.
• Entra ID (src/cms/src/auth/) uses openid-client with the authorization code flow and PKCE.
  • State, nonce and the PKCE verifier are kept in a signed cookie that lasts 10 minutes.
  • tid must match ENTRA_TENANT_ID.
  • Users are found by oid, created on first login, and linked by email to an existing user.
  • First and last name come from the optional claims given_name and family_name, which must be turned on in the app registration. A name the token doesn't carry is left unchanged.
  • After login, users are redirected only to the CMS or the web frontend.
  • Without the ENTRA_* variables the provider is off, and only email and password are offered.
• Email and password (NF-12) remain available on /logg-inn and in the admin panel. Users created by Entra ID get a random password, so the fallback works only for users an administrator has given a password.
• Ready for Ansattporten (NF-13): users have an identities array of { provider, subject }, and providers are a list. Ansattporten becomes one more entry once open question 8 is answered.

Changes to access

Now that everyone in Digdir can log in, the collections that let any logged-in user write had to be tightened:

• Only administrators (roles: ['admin']) can use the admin panel, read other users, or create, update and delete users and media.
• The first user in an empty database becomes an administrator.
• pnpm make-admin <email> promotes an existing user. Existing dev databases: users from before this PR have no role, so run it once for yourself.

Other changes

• Session length: sessions last 8 hours instead of Payload's 2.
• Cookie forwarding: Payload ignores its session cookie on server-to-server requests, because they carry no Origin or Sec-Fetch-Site header for its CSRF check. So the new authHeaders(cookie) in @saman/shared sends the token as Authorization: JWT …. CLAUDE.md now says pages read as the visitor.
• CMS front page: the template page on the CMS's / now redirects to the web frontend. The e2e readiness check waits on /api/health instead.

Tests

• pnpm lint passes.
• pnpm test: CMS 26 passed, web 14 passed.
• pnpm test:e2e: 9 passed.
• New tests:
  • CMS integration: the full Entra ID flow against oauth2-mock-server, covering first login, finding the user by oid after an email change, linking by email, another tenant, a tampered state cookie, the redirect allow-list, and the provider being off. Also access tests for users and media.
  • Web: the middleware and the login page.
  • e2e: no page without logging in, and password login and logout through the browser.
• Manual check against the real tenant: discovery works, and Entra ID accepts the redirect URI and shows its sign-in form. A full Entra ID sign-in needs a person and hasn't been done.

Setup for a local Entra ID login

Set ENTRA_TENANT_ID, ENTRA_CLIENT_ID and ENTRA_CLIENT_SECRET in src/cms/.env. The redirect URI is http://localhost:3000/api/brukere/oauth/entra/callback. The values are not committed.

🤖 Generated with Claude Code