Skip to content

Add enterprise SSO (OIDC + SAML) for self-hosted deployments #146

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shrsv merged 8 commits into from
Oct 29, 2026
Merged

Add enterprise SSO (OIDC + SAML) for self-hosted deployments #146

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
f43d2c8
synced commits
shrsv Oct 27, 2026
e537cd2
Add enterprise SSO (OIDC + SAML) for self-hosted deployments
shrsv Oct 29, 2026
1b6bdf1
Fix SSO feature-gating bug and harden crypto/error handling
shrsv Oct 29, 2026
c160e63
Add SSO feature screenshots for PR description
shrsv Oct 29, 2026
fe57f40
Sync dbmate schema snapshot and fix broken Go test/build targets
shrsv Oct 29, 2026
83853b6
Fix echo rate-limiter IP-spoofing bypass on subscription mutation routes
shrsv Oct 29, 2026
9899371
Address PR review comments: widen oidc_scopes, drop GNU timeout depen…
shrsv Oct 29, 2026
bc76491
Remove the LiveReview AI-review merge gate from CI
shrsv Oct 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .git-hooks-binary-allowlist
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,3 +65,7 @@ assets/screenshots/auto-approve/demo.mp4
assets/screenshots/auto-approve/poster.webp

docs/releases/assets/v1.1.0-audit-log.png

assets/screenshots/2026-10-29/01-settings-sso-oidc.png
assets/screenshots/2026-10-29/02-settings-sso-saml.png
assets/screenshots/2026-10-29/03-login-sso-button.png
84 changes: 0 additions & 84 deletions .github/workflows/livereview-gate.yml
View file
Open in desktop

This file was deleted.

18 changes: 17 additions & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -379,7 +379,7 @@ TEST_PACKAGES := $(shell find . \
SECURITY_GOVULN_PACKAGES := $(filter-out ./scripts ./cmd/onboarding-pdf,$(TEST_PACKAGES))

# Tests and packages that fail today, skipped until fixed. Remove a name once its test passes.
TESTALL_SKIP_TESTS := ^(TestAnalyticsPipelineFinalizeGivesUpAfterRepairFails|TestAnalyticsPipelineProducesExactCounts|TestAnalyticsPipelineProducesFacetedChart|TestAnalyticsPipelineProducesCSV|TestAnalyticsPipelineRepairsThenGivesUp|TestAnalyticsPipelineZeroRowsShortCircuits|TestBitbucketCommentHierarchyFromCapture|TestBuildFileCommentIndex|TestBuildFileCommentTree|TestChatBranchRejectsFabricatedJSON|TestCheckRequiredConfigCloudLiveLowPricingProfileRequiresLowPricingPlanIDs|TestCheckRequiredConfigCloudLiveModeRequiresLiveVars|TestCheckRequiredConfigCloudTestModeRequiresRazorpayTestVars|TestConvertAzureDevOpsCommentEvent_RealPayload|TestCountQueryBranchRejectsTruncatedJSON|TestCreateMonthlyPlan|TestDispatchClassifyFailureDegradesToChat|TestDispatchSwapsSystemPromptPerTurn|TestLawbookCarriesMachineContracts|TestListPaths|TestPostCommentReply_IssueCommentUsesIssueEndpoint|TestReconciliationSweepWorker_OnlyQueuesStaleRepositories|TestRoundTripUnifiedArtifact|TestShowCommentsPerFile|TestShowCommentsPerFileTree|TestShowCommentsPerFileTreeBitbucket|TestShowCommentsPerFileTreeGithub|TestShowCommentsPerFileTreeGitlab|TestSubscriptionIntegration|TestWebhookProcessing)$$

@livereview-agent livereview-agent Bot Oct 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severity: info

Tests have been removed from the skip list, indicating that these tests are now passing or have become obsolete.

Suggestions:

  1. Ensure these tests are now actively running in CI.

@livereview-agent livereview-agent Bot Oct 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severity: info

Tests were removed from the skip list, which implies that fixes have been implemented for these tests.

Suggestions:

  1. Verify these tests pass reliably now.

TESTALL_SKIP_TESTS := ^(TestAnalyticsPipelineFinalizeGivesUpAfterRepairFails|TestAnalyticsPipelineProducesExactCounts|TestAnalyticsPipelineProducesFacetedChart|TestAnalyticsPipelineProducesCSV|TestAnalyticsPipelineRepairsThenGivesUp|TestAnalyticsPipelineZeroRowsShortCircuits|TestBitbucketCommentHierarchyFromCapture|TestChatBranchRejectsFabricatedJSON|TestCheckRequiredConfigCloudLiveLowPricingProfileRequiresLowPricingPlanIDs|TestCheckRequiredConfigCloudLiveModeRequiresLiveVars|TestCheckRequiredConfigCloudTestModeRequiresRazorpayTestVars|TestConvertAzureDevOpsCommentEvent_RealPayload|TestCountQueryBranchRejectsTruncatedJSON|TestCreateMonthlyPlan|TestDispatchClassifyFailureDegradesToChat|TestDispatchSwapsSystemPromptPerTurn|TestLawbookCarriesMachineContracts|TestPostCommentReply_IssueCommentUsesIssueEndpoint|TestReconciliationSweepWorker_OnlyQueuesStaleRepositories|TestSubscriptionIntegration|TestWebhookProcessing)$$
TESTALL_SKIP_PKGS := . ./scripts ./cmd/onboarding-pdf ./internal/license/payment

.PHONY: testall
Expand All @@ -390,6 +390,22 @@ testall:
regen-risk-report:
python3 scripts/regen_risk_report.py

# Local/CI end-to-end SSO test against a real Keycloak (OIDC + SAML, see

@livereview-agent livereview-agent Bot Oct 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severity: info

A new end-to-end SSO test target has been added, which is beneficial for validating OIDC and SAML configurations.

@livereview-agent livereview-agent Bot Oct 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severity: info

A new end-to-end SSO test target has been added, which utilizes Docker Compose and Keycloak.

Suggestions:

  1. Ensure Keycloak fixture is version-locked and stable.
  2. Document test setup in docs/sso.md.

# docs/sso.md). Brings up Keycloak with the checked-in realm fixture,
# runs the headless cookie-jar e2e test, tears the container down either
# way (the `|| true` + explicit `down` guarantees cleanup even on failure).
.PHONY: test-sso-e2e
test-sso-e2e:
docker compose -f docker/docker-compose.sso-test.yml up -d keycloak

@livereview-agent livereview-agent Bot Oct 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severity: info

The Keycloak service is being explicitly brought up, which is a good practice for managing dependencies.

@echo "Waiting for Keycloak to become healthy..."
@i=0; until docker compose -f docker/docker-compose.sso-test.yml ps keycloak --format json | grep -q "\"Health\":\"healthy\""; do \

@livereview-agent livereview-agent Bot Oct 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severity: info

A robust health check for Keycloak has been implemented, which helps prevent race conditions during tests.

i=$$((i + 2)); \
if [ $$i -ge 120 ]; then echo "Keycloak did not become healthy within 120s"; exit 1; fi; \
sleep 2; \
done
$(GOTEST) -tags=sso_e2e -count=1 -v ./internal/sso/... || (docker compose -f docker/docker-compose.sso-test.yml down -v; exit 1)

@livereview-agent livereview-agent Bot Oct 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severity: critical

Ensures that Keycloak is torn down even if the tests fail, which is critical for CI cleanup.

Suggestions:

  1. Confirm this down -v removes volumes to prevent stale state.

docker compose -f docker/docker-compose.sso-test.yml down -v

@livereview-agent livereview-agent Bot Oct 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severity: critical

Ensures that Keycloak is torn down after successful tests, which is critical for CI cleanup.

Suggestions:

  1. Confirm this down -v removes volumes to prevent stale state.


.PHONY: security-govulncheck security-govulncheck-json security-osv security-gitleaks security-semgrep security-dependabot security-gh-secret-scanning security-triage

# Run Go vulnerability analysis for reachable vulnerabilities.
Expand Down
Binary file added assets/screenshots/2026-10-29/01-settings-sso-oidc.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added assets/screenshots/2026-10-29/02-settings-sso-saml.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added assets/screenshots/2026-10-29/03-login-sso-button.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
2 changes: 1 addition & 1 deletion scripts/backfill_blast_radius_hunks.go → cmd/backfill-blast-radius-hunks/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
// whichever backend internal/blobstore is configured for (S3, GCS, Azure,
// local filesystem), not just S3.
//
// Usage: go run scripts/backfill_blast_radius_hunks.go
// Usage: go run ./cmd/backfill-blast-radius-hunks
package main

import (
Expand Down
2 changes: 1 addition & 1 deletion scripts/backfill_chat_chart_stats.go → cmd/backfill-chat-chart-stats/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
// shape chatstats doesn't recognize, which stays NULL on purpose) can be
// resumed by running it again.
//
// Usage: go run scripts/backfill_chat_chart_stats.go
// Usage: go run ./cmd/backfill-chat-chart-stats
package main

import (
Expand Down
0 scripts/create_live_plans.go → cmd/create-live-plans/main.go
View file
Open in desktop
File renamed without changes.
0 scripts/create_test_plans.go → cmd/create-test-plans/main.go
View file
Open in desktop
File renamed without changes.
16 changes: 8 additions & 8 deletions cmd/mrmodel/lib/mrmodel_batch_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ import (

// TestListPaths tests loading a unified artifact and listing its diff paths
func TestListPaths(t *testing.T) {
artifactPath := "../../../artifacts/gl_unified.json"

@livereview-agent livereview-agent Bot Oct 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severity: info

The artifact path has been updated to reflect a file relocation.

Suggestions:

  1. Consider using filepath.Join for cross-platform path construction.

artifactPath := "../../../docs/raw/artifacts/gl_unified.json"

// Read the JSON file
data, err := os.ReadFile(artifactPath)
Expand All @@ -34,7 +34,7 @@ func TestListPaths(t *testing.T) {

// TestShowCommentsPerFile tests showing comments organized by file
func TestShowCommentsPerFile(t *testing.T) {
artifactPath := "../../../artifacts/gl_unified.json"

@livereview-agent livereview-agent Bot Oct 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severity: info

The artifact path has been updated to reflect a file relocation.

Suggestions:

  1. Consider using filepath.Join for cross-platform path construction.

artifactPath := "../../../docs/raw/artifacts/gl_unified.json"

// Read the JSON file
data, err := os.ReadFile(artifactPath)
Expand Down Expand Up @@ -75,7 +75,7 @@ func TestShowCommentsPerFile(t *testing.T) {

// TestBuildFileCommentIndex tests building the efficient file->comments index
func TestBuildFileCommentIndex(t *testing.T) {
artifactPath := "../../../artifacts/gl_unified.json"

@livereview-agent livereview-agent Bot Oct 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severity: info

The artifact path has been updated to reflect a file relocation.

Suggestions:

  1. Consider using filepath.Join for cross-platform path construction.

artifactPath := "../../../docs/raw/artifacts/gl_unified.json"

// Read the JSON file
data, err := os.ReadFile(artifactPath)
Expand Down Expand Up @@ -115,7 +115,7 @@ func TestBuildFileCommentIndex(t *testing.T) {

// TestBuildFileCommentTree tests building the tree structure per file
func TestBuildFileCommentTree(t *testing.T) {
artifactPath := "../../../artifacts/gl_unified.json"

@livereview-agent livereview-agent Bot Oct 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severity: info

The artifact path has been updated to reflect a file relocation.

Suggestions:

  1. Consider using filepath.Join for cross-platform path construction.

artifactPath := "../../../docs/raw/artifacts/gl_unified.json"

// Read the JSON file
data, err := os.ReadFile(artifactPath)
Expand Down Expand Up @@ -158,7 +158,7 @@ func TestBuildFileCommentTree(t *testing.T) {

// TestShowCommentsPerFileTree tests showing the tree structure
func TestShowCommentsPerFileTree(t *testing.T) {
artifactPath := "../../../artifacts/gl_unified.json"

@livereview-agent livereview-agent Bot Oct 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severity: info

The artifact path has been updated to reflect a file relocation.

Suggestions:

  1. Consider using filepath.Join for cross-platform path construction.

artifactPath := "../../../docs/raw/artifacts/gl_unified.json"

// Read the JSON file
data, err := os.ReadFile(artifactPath)
Expand All @@ -181,7 +181,7 @@ func TestShowCommentsPerFileTree(t *testing.T) {

// TestShowCommentsPerFileTreeBitbucket tests with Bitbucket data that has threaded comments
func TestShowCommentsPerFileTreeBitbucket(t *testing.T) {
artifactPath := "../../../artifacts/bb_unified.json"

@livereview-agent livereview-agent Bot Oct 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severity: info

The artifact path has been updated to reflect a file relocation.

Suggestions:

  1. Consider using filepath.Join for cross-platform path construction.

artifactPath := "../../../docs/raw/artifacts/bb_unified.json"

// Read the JSON file
data, err := os.ReadFile(artifactPath)
Expand Down Expand Up @@ -230,7 +230,7 @@ func TestShowCommentsPerFileTreeBitbucket(t *testing.T) {

// TestShowCommentsPerFileTreeGitlab tests with GitLab data
func TestShowCommentsPerFileTreeGitlab(t *testing.T) {
artifactPath := "../../../artifacts/gl_unified.json"

@livereview-agent livereview-agent Bot Oct 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severity: info

The artifact path has been updated to reflect a file relocation.

Suggestions:

  1. Consider using filepath.Join for cross-platform path construction.

artifactPath := "../../../docs/raw/artifacts/gl_unified.json"

// Read the JSON file
data, err := os.ReadFile(artifactPath)
Expand Down Expand Up @@ -280,7 +280,7 @@ func TestShowCommentsPerFileTreeGitlab(t *testing.T) {

// TestShowCommentsPerFileTreeGithub tests with GitHub data
func TestShowCommentsPerFileTreeGithub(t *testing.T) {
artifactPath := "../../../artifacts/gh_unified.json"

@livereview-agent livereview-agent Bot Oct 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severity: info

The artifact path has been updated to reflect a file relocation.

Suggestions:

  1. Consider using filepath.Join for cross-platform path construction.

artifactPath := "../../../docs/raw/artifacts/gh_unified.json"

// Read the JSON file
data, err := os.ReadFile(artifactPath)
Expand Down
2 changes: 1 addition & 1 deletion cmd/mrmodel/lib/roundtrip_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ import (

// TestRoundTripUnifiedArtifact tests loading a saved UnifiedArtifact JSON back into the struct
func TestRoundTripUnifiedArtifact(t *testing.T) {
artifactPath := "../../../artifacts/gh_unified.json"

@livereview-agent livereview-agent Bot Oct 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severity: info

The artifact path has been updated to reflect a file relocation.

Suggestions:

  1. Consider using filepath.Join for cross-platform path construction.

artifactPath := "../../../docs/raw/artifacts/gh_unified.json"

// Read the JSON file
data, err := os.ReadFile(artifactPath)
Expand Down
56 changes: 0 additions & 56 deletions cmd/test/final_test.go
View file
Open in desktop

This file was deleted.

57 changes: 0 additions & 57 deletions cmd/test/test_line_comment.go
View file
Open in desktop

This file was deleted.

56 changes: 0 additions & 56 deletions cmd/test/verify_line_comment.go
View file
Open in desktop

This file was deleted.

Loading
Loading