feature: add oidc login flow

backend/auth.py

@@ -24,6 +24,11 @@ def _is_member_of(username: str, groups: Set[str]) -> bool:
 
 
 def is_authorized_admin(username: str, settings: Settings) -> bool:
+    if settings.auth_mode == "oidc":
+        allowed_users = set(settings.auth_allowed_users)
+        if allowed_users and username not in allowed_users:
+            return False
+        return True
     # UID 0 always allowed
     try:
         entry = pwd.getpwnam(username)
@@ -41,6 +46,11 @@ def is_authorized_admin(username: str, settings: Settings) -> bool:
 
 
 def authenticate_admin_user(username: str, password: str, settings: Settings) -> None:
+    if settings.auth_mode != "pam":
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="Password login disabled; OIDC is configured",
+        )
     if not is_authorized_admin(username, settings):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
@@ -82,9 +92,13 @@ def get_current_admin(
     settings: Settings = Depends(get_settings),
 ) -> str:
     auth_header = request.headers.get("authorization")
-    if not auth_header or not auth_header.lower().startswith("bearer "):
+    token = None
+    if auth_header and auth_header.lower().startswith("bearer "):
+        token = auth_header.split(" ", 1)[1].strip()
+    if not token:
+        token = request.cookies.get(settings.session_cookie_name)
+    if not token:
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Missing token")
-    token = auth_header.split(" ", 1)[1].strip()
     return decode_token(token, settings)