portal: authenticate against Better Auth (public+PKCE); admin via email allowlist

Drops Authentik OIDC + the groups claim. Public PKCE client (Better Auth hashes confidential secrets), scopes openid/email/profile, admin determined by ADMIN_EMAILS.
2026-07-05 22:14:43 -04:00
parent 3908251f6e
commit c6c602fd20
4 changed files with 24 additions and 16 deletions
@@ -38,9 +38,9 @@ def app_url(tmp_path, monkeypatch):
        oidc_client_secret="sec",
        oidc_redirect_url="https://ui.example/auth/callback",
        session_secret="x" * 32,
-        admin_group="intervalsicu-mcp-admins",
+        admin_emails=frozenset({"admin@x.com"}),
        intervals_api_base="https://intervals.icu/api/v1",
-        oidc_scopes="openid email profile groups",
+        oidc_scopes="openid email profile",
        root_path="",
        mcp_url="https://intervalsicu.farhoodlabs.com/mcp",
    )