Files

T

lyra 2064153cd3

Tests / test (pull_request) Successful in 1m10s

Details

chore: adopt shared Guiding Light configs and fix conformance gaps

Brings preauth from 18/34 to 30/34 conformance (auth-gateway profile). The
remaining four checks all depend on files this branch cannot change (see below).

PHP toolchain (§1)
  - require.php  >=8.4 -> ^8.5, and pin config.platform to 8.5.0. The old
    constraint also permitted PHP 9, which is not a promise we can keep.
    composer.lock regenerated with --lock: content-hash + platform-overrides
    only, zero dependency version movement.
  - friendsofphp/php-cs-fixer  * -> ^3.95. A wildcard meant CI was not
    reproducible.

PHPStan (§2.2)
  - vendor the shared phpstan.neon.dist (level 6) + a generated baseline.
    187 errors are captured rather than fixed; the baseline should only shrink
    from here.
  - add phpstan/phpstan:^2.1 to require-dev.

Code style (§8.2)
  - vendor the shared .php-cs-fixer.dist.php (@Symfony + @Symfony:risky +
    declare_strict_types) and apply it: 59 of 67 files reformatted.
  - Verified this is a formatting change, not a behaviour change: all 313 tests
    pass after the reformat, all in_array() calls already passed strict=true,
    and the remaining edits are @Symfony:risky idiom (yoda conditions, \count(),
    self:: over the class name).

Repository layout (§4.4)
  - docs/{Caddyfile,compose.yaml,example.env} -> docs/examples/, with
    example.env becoming the conventional .env.example. This is the layout
    GUIDING-LIGHT already cites preauth as doing correctly — it just needed
    renaming.
  - update the four readme.md references and a stale compose.yaml comment.
  - docs/v1.1-plan.md references are left alone deliberately: it is a historical
    plan recording what was done at the time, not live documentation.

Licence and security policy (§7)
  - add LICENSE (uniform MIT, matching composer.json).
  - add SECURITY.md describing the actual threat model: per-request
    allow/intercept, no caching of the login flow, app-set security headers,
    TOTP, and the fact that REMOTE_USER is trusted input.

Mobile accessibility (§3.3a)
  - templates/base.html.twig: drop maximum-scale=1 and add viewport-fit=cover.
    preauth was the one app already past the font-size precondition (controls
    render at 21.6px = 0.9em x 24px), so removing the lock is safe here and
    restores pinch-zoom for Android users.

Conformance tooling (§8.2)
  - vendor .ci/conformance.sh and .ci/css-control-size.py so the check runs
    from a checkout rather than fetching from the LAN-only private/ci.
  - .editorconfig synced from the version that keeps the Caddyfile tab rule.

Not included (blocked by the .gitea/workflows pre-receive hook):
  - ci-composer-audit, ci-composer-validate, ci-reusable-workflows.
    Workflow files may only change via a trusted ref, so the caller files are
    staged but not committed.

Also not included: dockerfile-nonroot (§6.4). Adding USER to an image with
VOLUME [/config, /data] changes volume ownership and needs an actual container
build/run to verify, so it goes in its own change.

2026-09-23 20:13:45 +00:00

3.3 KiB

Raw Blame History

Security Policy

Supported Versions

Version	Supported
unreleased (v1 development)	✅

Reporting a Vulnerability

Report vulnerabilities privately to security@digitaladapt.com (or open a private security advisory on the repository). Please include reproduction steps and affected versions. You will receive an acknowledgement within 48 hours and a status update at least weekly until resolution.

Do not open a public issue for a suspected vulnerability. preauth is an authentication gateway — it sits in front of every protected service, so a weakness here is a weakness everywhere behind it.

Security model summary

preauth implements the auth half of the forward_auth pattern: a reverse proxy calls it per request to decide whether a request may reach the upstream service.

Two outcomes per request: allow or intercept. AcceptListener / RejectListener / InterceptListener decide, and the decision is made on every request rather than cached — a cached auth session is an anti-pattern (GUIDING-LIGHT §3.3d), which is also why this project gets no service worker.
The login flow is never cached. The login page, failed logins, redirects and rate-limit responses are sent with Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0. An aggressive cache (notably older Safari) replaying a stale pre-auth response presents to the user as being logged back out after a refresh.
Headers are set by the app, not left to the proxy. X-Content-Type-Options: nosniff, X-Frame-Options: DENY, a Content-Security-Policy, and Strict-Transport-Security: max-age=31536000. Docs recommend mirroring the caching headers at the edge as defence in depth, but the app does not depend on it.
TOTP is required. Secrets come from TOTP_URI; if it is unset the app generates one and prints it for enrolment. Login state is carried in a signed payload (src/Data/Payload.php) bound to a nonce and a scope, not in a server-side session store.
Rate limiting is on by default, with the block response configurable (TEAPOT=false returns 429 rather than 418).
REMOTE_USER is trusted input, not a secret. In remote_user modes the gateway accepts an upstream-asserted identity, so the upstream must be the only path to the app. Do not expose preauth directly to the internet for this mode.
.env is never committed; secrets are env vars injected at runtime. Real secrets belong in .env.local or bin/console secrets:set, read via %env(...)%. .env.example and .env.test are the committed env files.

Scope

In scope: the application code in src/, the shipped Caddyfile, the Dockerfile, and anything that affects the allow/intercept decision.

Out of scope: the forward_auth integration at the edge (a host-proxy configuration concern, see docs/examples/Caddyfile) and the security of the services preauth protects.

Deployment note

preauth runs as a container and, once GUIDING-LIGHT §6.4 is adopted here, will drop privileges via USER. The image declares VOLUME ["/config", "/data"]; if you pin a user: in your compose file, that user must be able to write both paths — otherwise login state and backup codes cannot be persisted.

3.3 KiB Raw Blame History