Project

General

Profile

Actions

Epic #3

open

Implement a secure user authentication system

Epic #3: Implement a secure user authentication system

Added by Bricklou 8 months ago. Updated 16 days ago.

Status:
In Progress
Priority:
Normal
Assigned To:
Target version:
-
Start date:
03/28/2026
Due date:
% Done:

62%

Estimated time:
(Total: 0:00 h)

Description

As a platform, we need a comprehensive user authentication system that allows users to securely register, log in, and manage their accounts. This epic covers the entire authentication flow (from initial sign-up through to session management and password recovery) ensuring that user data is protected and the experience is seamless across all devices.

This includes handling secure credential storage, token-based session management, and integration with third-party identity providers (e.g., Google, Facebook). The system must comply with relevant security standards and provide a smooth, intuitive experience for both new and returning users.


Subtasks 43 (43 open — 0 closed)

Feature #159: User Account ProvisioningIn ProgressBricklou08/22/2026

Actions
User Story #163: As the instance administrator, I want to complete a first-install setup, so that I get an admin account without relying on insecure default credentialsIn ProgressBricklou08/22/2026

Actions
Sub-Task #164: Validate email format and password strength requirementsDoneBricklou08/22/2026

Actions
Sub-Task #165: Hash and securely store credentialsDoneBricklou08/22/2026

Actions
User Story #169: As a new user, I want to register via OAuth/OIDC, so that I can use existing accountsDoneBricklou09/06/2026

Actions
Sub-Task #170: Integrate OAuth/OIDC providers (Google, Discord, GitHub)DoneBricklou09/06/2026

Actions
Sub-Task #171: Auto-create account on first OAuth/OIDC loginDoneBricklou09/06/2026

Actions
User Story #263: As an administrator, I want to invite a new user by email, so that they can activate their own accountPlannedBricklou

Actions
Sub-Task #166: Send invitation email with tokenPlannedBricklou

Actions
User Story #264: As an administrator, I want to create a user account directly with a temporary password, so that I can onboard someone without sending an emailPlannedBricklou

Actions
Feature #160: User LoginIn ReviewBricklou04/13/2026

Actions
User Story #172: As a user, I want to log in with credentials, so that I can access my accountDoneBricklou04/13/2026

Actions
Sub-Task #173: Validate credentials against stored hashDoneBricklou04/13/2026

Actions
Sub-Task #174: Generate and store opaque session token server-sideDoneBricklou04/13/2026

Actions
Sub-Task #175: Set secure session cookieDoneBricklou04/13/2026

Actions
User Story #176: As a user, I want to log in via OAuth/OIDC, so that I can use existing providersDoneBricklou08/30/2026

Actions
Sub-Task #254: Backend: OIDC provider configurationDoneBricklou08/30/2026

Actions
Sub-Task #255: Backend: discovery endpoint for login pageDoneBricklou09/01/2026

Actions
Sub-Task #256: Backend: OIDC endpoints (login start, callback, session)DoneBricklou09/01/2026

Actions
Sub-Task #257: Frontend: OIDC login integrationDoneBricklou09/01/2026

Actions
User Story #237: As a user, I want to log in using a security key (WebAuthn), so that I can use phishing-resistant MFADoneBricklou09/06/2026

Actions
Sub-Task #239: Generate WebAuthn registration challenge and verify attestation (backend)DoneBricklou09/06/2026

Actions
Sub-Task #240: Generate WebAuthn authentication challenge and verify assertion (backend)DoneBricklou09/06/2026

Actions
Sub-Task #241: Store WebAuthn credentials (public key, credential ID, sign count) in the databaseDoneBricklou09/06/2026

Actions
Sub-Task #242: Frontend: WebAuthn credential registration flow in user profileDoneBricklou09/06/2026

Actions
Sub-Task #243: Frontend: WebAuthn assertion flow in MFA login stepDoneBricklou09/06/2026

Actions
User Story #238: As a user, I want to enable and disable TOTP from my profile, so that I can manage my two-factor authentication settingsDoneBricklou08/20/2026

Actions
Sub-Task #244: API endpoint: initiate TOTP setup (generate secret, return base32 + otpauth URL)DoneBricklou08/20/2026

Actions
Sub-Task #245: API endpoint: confirm and activate TOTP (verify OTP code before persisting secret)DoneBricklou08/27/2026

Actions
Sub-Task #247: API endpoint: disable TOTP (requires current OTP code or password confirmation)DoneBricklou08/20/2026

Actions
Sub-Task #248: Frontend: TOTP setup wizard (QR code display, manual entry, confirmation code input)DoneBricklou08/27/2026

Actions
Sub-Task #249: Frontend: MFA management section in user profile (enable/disable/status)DoneBricklou08/27/2026

Actions
Feature #161: Session ManagementDoneBricklou09/06/2026

Actions
User Story #178: As a user, I want my session to remain active, so that I stay logged inDoneBricklou09/06/2026

Actions
Sub-Task #179: Implement server-side session storage and validationDoneBricklou08/22/2026

Actions
User Story #181: As a user, I want to log out, so that I can end my sessionDoneBricklou08/22/2026

Actions
Sub-Task #182: Invalidate server-side session on logoutDoneBricklou08/22/2026

Actions
Feature #162: Password RecoveryTo Do03/28/2026

Actions
User Story #183: As a user, I want to request a password reset, so that I can recover my accountTo Do03/28/2026

Actions
Sub-Task #184: Generate reset token and send reset emailTo Do03/28/2026

Actions
Sub-Task #185: Validate token expiryTo Do03/28/2026

Actions
User Story #186: As a user, I want to reset my password, so that I can regain accessTo Do03/28/2026

Actions
Sub-Task #187: Validate reset token and update password securelyTo Do03/28/2026

Actions
Actions

Also available in: PDF Atom