v0.34.16

src/admin/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.0.3",
   "info": {
     "title": "RustProxy Administration API",
-    "version": "0.34.15",
+    "version": "0.34.16",
     "description": "Administration API for the active panel origin. Sign in through the panel; the same-origin HttpOnly cookie authenticates all private operations. Mutations also require the exact Origin, X-RustProxy-Request: 1 and a session-bound X-CSRF-Token. Loopback HTTP is the default; Settings can enable HTTPS before using a non-loopback administration bind. This document contains no live configuration or credentials. Object schemas marked extensible are summaries: full configuration validation is authoritative in Rust. The API also permits explicitly scoped GeneralApiBearer tokens on a narrow route allowlist, with RO/RW and source CIDR checks; API-token management and Prometheus-token management are browser-session-only."
   },
   "servers": [
@@ -439,6 +439,37 @@
           "id"
         ]
       },
+      "AuthenticationChoice": {
+        "type": "object",
+        "description": "Optional explicit provider and integration method. Absent means infer the existing active Basic/Tinyauth/Authelia/authentik/OIDC configuration for backward compatibility. The selected method must match the one enabled legacy settings object; unknown, inconsistent or unsupported pairs are rejected.",
+        "additionalProperties": false,
+        "required": ["provider", "method"],
+        "properties": {
+          "provider": {"type": "string", "enum": ["basic", "tinyauth", "authelia", "authentik", "pocket_id", "custom"]},
+          "method": {"type": "string", "enum": ["basic", "forward_auth", "oidc"], "description": "Basic supports basic only; Tinyauth/Authelia/authentik support forward_auth or oidc; Pocket ID/custom support oidc only."}
+        }
+      },
+      "OidcConfig": {
+        "type": "object",
+        "description": "Opt-in OpenID Connect Authorization Code integration method for an identity provider selected by authentication.provider. Uses issuer discovery, S256 PKCE, nonce/state cookies, JWKS RS256/ES256 ID token verification and encrypted host-only application sessions. Existing standalone oidc.enabled configurations remain supported.",
+        "additionalProperties": false,
+        "properties": {
+          "enabled": {"type": "boolean", "default": false},
+          "issuer_url": {"type": "string", "format": "uri", "description": "Exact HTTPS OIDC issuer; /.well-known/openid-configuration is discovered at this URL"},
+          "backend_url": {"type": "string", "format": "uri", "description": "Optional internal HTTP(S) origin for server-side discovery/token/JWKS/UserInfo requests; public issuer and JWT validation remain unchanged"},
+          "redirect_url": {"type": "string", "format": "uri", "description": "HTTPS URL for an exact hostname in this Vhost and path /_rustproxy/oidc/callback"},
+          "client_id": {"type": "string", "maxLength": 256},
+          "client_secret": {"type": "string", "maxLength": 2048, "description": "Confidential OIDC client secret; stored in Vhost configuration"},
+          "session_secret": {"type": "string", "minLength": 32, "maxLength": 4096, "description": "High-entropy secret for encrypted session and temporary state cookies"},
+          "scopes": {"type": "string", "default": "openid profile email"},
+          "allow_private": {"type": "boolean", "default": false},
+          "address_allowlist": {"type": "array", "items": {"type": "string"}},
+          "tls_ca_pem": {"type": "string", "nullable": true},
+          "connect_timeout_seconds": {"type": "integer", "minimum": 1, "maximum": 30, "default": 5},
+          "timeout_seconds": {"type": "integer", "minimum": 1, "maximum": 60, "default": 10},
+          "session_ttl_seconds": {"type": "integer", "minimum": 60, "maximum": 86400, "default": 3600}
+        }
+      },
       "ForwardAuthConfig": {
         "type": "object",
         "description": "Per-Vhost Authelia or authentik verification. Disabled by default. All other settings are optional and use RustProxy defaults; when enabled, url must identify an internal HTTP(S) origin (or expected verifier path). Authelia additionally requires a public HTTPS login_url. External addresses retain normal safe upstream validation, with TLS verification always enabled for HTTPS.",
@@ -560,6 +591,8 @@
             "$ref": "#/components/schemas/ForwardAuthConfig",
             "description": "authentik single-application forward auth. The URL is the internal outpost origin; RustProxy proxies its reserved path on the protected host. Disabled by default; mutually exclusive with basic_auth, tinyauth and authelia."
           },
+          "oidc": {"$ref": "#/components/schemas/OidcConfig"},
+          "authentication": {"$ref": "#/components/schemas/AuthenticationChoice", "description": "Optional provider/method selector. Set to null or omit for legacy Vhost data. It does not replace the existing provider-specific settings objects."},
           "cache": {
             "type": "object",
             "properties": {