Changeset 0.24.1 (#157)

server/main.go

@@ -94,7 +94,11 @@ func main() {
 		keyResolver = crypto.NewKeyResolver(envKey, uekCache)
 
 		// Initialize store layer
-		stores = postgres.NewStores(database.DB)
+		if database.IsSQLite() {
+			stores = sqliteStore.NewStores(database.DB)
+		} else {
+			stores = postgres.NewStores(database.DB)
+		}
 
 		// Provider health accumulator (v0.22.0)
 		if database.IsSQLite() {
@@ -339,9 +343,32 @@ func main() {
 	case auth.ModeBuiltin:
 		authProvider = auth.NewBuiltinProvider()
 	case auth.ModeMTLS:
-		log.Fatal("❌ AUTH_MODE=mtls is not yet implemented (planned for v0.24.1)")
+		authProvider = auth.NewMTLSProvider(auth.MTLSConfig{
+			HeaderDN:          cfg.MTLSHeaderDN,
+			HeaderVerify:      cfg.MTLSHeaderVerify,
+			HeaderFingerprint: cfg.MTLSHeaderFingerprint,
+			AutoActivate:      cfg.MTLSAutoActivate,
+			DefaultTeam:       cfg.MTLSDefaultTeam,
+			DefaultRole:       cfg.MTLSDefaultRole,
+		})
 	case auth.ModeOIDC:
-		log.Fatal("❌ AUTH_MODE=oidc is not yet implemented (planned for v0.24.1)")
+		var err error
+		authProvider, err = auth.NewOIDCProvider(auth.OIDCConfig{
+			IssuerURL:					cfg.OIDCIssuerURL,
+			ExternalIssuerURL:  cfg.OIDCExternalIssuerURL,
+			ClientID:           cfg.OIDCClientID,
+			ClientSecret:       cfg.OIDCClientSecret,
+			RedirectURL:        cfg.OIDCRedirectURL,
+			AutoActivate:       cfg.OIDCAutoActivate,
+			DefaultTeam:        cfg.OIDCDefaultTeam,
+			DefaultRole:        cfg.OIDCDefaultRole,
+			RolesClaim:         cfg.OIDCRolesClaim,
+			GroupsClaim:        cfg.OIDCGroupsClaim,
+			AdminRole:          cfg.OIDCAdminRole,
+		})
+		if err != nil {
+			log.Fatalf("❌ OIDC provider init failed: %v", err)
+		}
 	}
 	log.Printf("  🔑 Auth mode: %s", authMode)
 
@@ -373,6 +400,10 @@ func main() {
 			authGroup.POST("/login", authH.Login)
 			authGroup.POST("/refresh", authH.Refresh)
 			authGroup.POST("/logout", authH.Logout)
+
+			// OIDC routes (only active when AUTH_MODE=oidc)
+			authGroup.GET("/oidc/login", authH.OIDCLogin)
+			authGroup.GET("/oidc/callback", authH.OIDCCallback)
 		}
 
 		// ── Public extension assets ────────────────