Summary

This PR introduces comprehensive authentication and authorization features, adds ECS container monitoring, and implements an admin settings panel for managing OIDC providers and Terraform state buckets. The application now supports both local username/password authentication and SSO via OIDC, with token-based session management and role-based access control.

Key Changes

Authentication & Authorization

• Local authentication: Username/password login with bcrypt password hashing
• OIDC/SSO support: Full OIDC flow with authorization code grant, token refresh, and logout
• Token-based sessions: JWT access tokens (30 min TTL) and refresh tokens (7 day TTL)
• Role-based access control: Admin and user roles with protected routes and dependency injection (api/deps.py)
• User management: Admin panel to manage users, roles, and account status
• Initial setup wizard: Auto-provision admin account on first startup

ECS Container Monitoring

• ECS collector: New collectors/ecs.py for fetching ECS clusters, services, and task definitions
• ECS API endpoints: /api/ecs, /api/ecs/clusters, /api/ecs/{task_id} for container data
• Topology integration: ECS containers displayed in React Flow visualization with filtering support
• Frontend components: ECS list view, cluster details, and container nodes in topology

Admin Settings Management

• Settings routes: /api/settings/* endpoints for admin-only configuration
• OIDC configuration UI: Manage OIDC issuer, client ID, and client secret with connection testing
• Terraform bucket management: Add/update/remove S3 buckets and state file paths with S3 access testing
• Settings service: services/settings.py for persisting configuration to database

Database & Models

• Auth models: User, Session, AuthSettings SQLAlchemy models for authentication state
• Settings models: TerraformBucket, TerraformStatePath for Terraform configuration persistence
• Auth schemas: Pydantic schemas for login, token responses, user management, and settings

Frontend Enhancements

• Login page: Local authentication form with error handling
• Auth context: AuthContext for managing tokens, auto-refresh, and user state
• Protected routes: ProtectedRoute component for auth-required pages
• Settings page: Admin UI for OIDC and Terraform bucket configuration
• User management panel: Admin interface for managing users and roles
• Topology filtering: Filter controls for resource types in visualization
• OIDC callback handler: AuthCallbackPage for SSO redirect handling

Infrastructure & Deployment

• IAM module: Decoupled from ECS, manages task role with EC2, RDS, and S3 read permissions
• Secrets module: AWS Secrets Manager integration for session secret, OIDC client secret, and admin password
• ECS build workflow: New CI/CD pipeline for Docker image builds and ECR push
• Frontend tests workflow: ESLint, TypeScript, and Vitest coverage

Documentation & Configuration

• Environment variables: New auth-related vars (LOCAL_AUTH_ENABLED, ADMIN_USERNAME, ADMIN_PASSWORD, FRONTEND_URL, token TTLs)
• API documentation: Updated endpoint tables with public, protected, and admin-only route groupings
• Contributing & Security guides: New CONTRIBUTING.md and SECURITY.md files
• Version management: VERSION file and version.py for app versioning
• Makefile enhancements: Format, test, and Terraform destroy targets

Implementation Details

• Auth dependency injection: get_current_user() and get_current_admin_user() dependencies protect routes
• Service layer: Business logic separated into services/auth.py and services/settings.py
• Schema organization: Pydantic schemas split by domain (resources.py, auth.py, settings.py)
• SSRF protection: OIDC issuer validation rejects private IPs and reconstructs URLs from validated components
• Async operations: All endpoints and database operations use async

https://claude.ai/code/session_01GSu1MTW8XvAbfNK28ug1kU