🔐 v2.0.0-alpha1 - Authentication & Authorization System
⚠️ ALPHA RELEASE - For Testing Only
This is the first alpha release of MeshMonitor v2.0.0, introducing a comprehensive authentication and authorization system.
⚠️ Breaking Changes
- All API endpoints now require authentication or appropriate anonymous permissions
- Session cookies required for API access
- This is a major version change - please review the migration notes below
🎯 Key Features
Authentication
- ✅ Local username/password authentication with bcrypt hashing
- ✅ OpenID Connect (OIDC) integration for SSO
- ✅ Dual authentication support (both local and OIDC simultaneously)
- ✅ Session management with secure cookies
- ✅ Admin password reset utility (
reset-admin.mjs)
Authorization
- ✅ Permission-based access control for 8 resource types:
- Dashboard, Nodes, Channels, Messages, Settings, Configuration, Info, Automation
- ✅ Read/Write permissions per resource
- ✅ Admin role with full permissions
- ✅ Middleware for route protection
- ✅ Database-backed permission storage
User Management
- ✅ Admin-only Users tab for managing users and permissions
- ✅ Create local users with passwords
- ✅ Set/reset passwords for local users
- ✅ Toggle admin status
- ✅ Activate/deactivate users
- ✅ Grant/revoke granular permissions
- ✅ OIDC user auto-creation on first login
Anonymous User Support
- ✅ Special "anonymous" user defines permissions for unauthenticated users
- ✅ Enables public/read-only access scenarios
- ✅ Configurable permissions via admin interface
- ✅ Seamless transition between authenticated and anonymous states
🔧 First-Run Setup
On first startup, MeshMonitor will create a default admin user:
- Username:
admin - Password:
changeme
⚠️ IMPORTANT: Change this password immediately after first login!
🔑 Configuration
Environment Variables
# OIDC (optional)
OIDC_ISSUER=https://your-oidc-provider.com
OIDC_CLIENT_ID=your-client-id
OIDC_CLIENT_SECRET=your-client-secret
OIDC_REDIRECT_URI=http://localhost:3001/api/auth/oidc/callback
# Session Security (recommended for production)
SESSION_SECRET=your-random-secret-here
# Admin User (optional, defaults to 'admin')
ADMIN_USERNAME=admin📝 Migration Notes
- First-run creates default admin user (username:
admin, password:changeme) - Existing installations will auto-create admin on next startup
- Anonymous user created automatically with default read-only permissions (dashboard, nodes, info)
- Database migrations run automatically on startup
- Admin can modify anonymous permissions in the Users tab
🔒 Security Enhancements
- Passwords hashed with bcrypt (10 rounds)
- Session-based authentication with HTTP-only cookies
- CSRF protection via SameSite cookies
- Permission checks on all protected routes
- Admin-only routes for user management
- Secure OIDC token validation
- SQL injection prevention with input validation
📚 Documentation
- OIDC setup guide available in docs/AUTHENTICATION.md
- Permission model documented in code comments
- Database schema includes permission constraints
🧪 Testing
This is an alpha release intended for testing. Please report any issues on GitHub.
Test Coverage:
- ✅ 505 tests passing
- ✅ Local authentication login/logout
- ✅ OIDC authentication flow
- ✅ Permission checks across all resources
- ✅ Admin user management operations
- ✅ Password reset functionality
- ✅ Anonymous user permissions
- ✅ Logout returns to anonymous state
🐛 Known Issues
- None currently identified
📦 What's Next
- v2.0.0-beta1: Bug fixes and refinements based on alpha feedback
- v2.0.0-rc1: Release candidate with full documentation
- v2.0.0: Stable release
🙏 Acknowledgments
This release includes contributions and testing feedback from the community.
🤖 Generated with Claude Code