feat: Add support for OIDC and user impersonation

.env.example

@@ -1,4 +1,21 @@
-# Add project environment variables here when needed.
+# A long random secret used to sign sessions and tokens (min 32 characters)
+STACKABLE_UI_SESSION_SECRET=change-me-to-a-long-random-secret-min-32-chars
+
+# The publicly accessible base URL of this application
+STACKABLE_UI_BASE_URL=http://localhost:5173
+
+# OIDC discovery URL (Keycloak, Entra ID, or any compliant OIDC provider)
+STACKABLE_UI_OIDC_DISCOVERY_URL=https://your-idp.example.com/realms/your-realm/.well-known/openid-configuration
+
+# The client ID and secret registered in your OIDC provider
+STACKABLE_UI_OIDC_CLIENT_ID=stackable-ui
+STACKABLE_UI_OIDC_CLIENT_SECRET=your-client-secret
+
+# OIDC claim used as the username for Trino impersonation (default: preferred_username)
+# STACKABLE_UI_OIDC_USERNAME_CLAIM=preferred_username
+
+# Path to the SQLite database file (must be on a persistent volume in Kubernetes)
+STACKABLE_UI_SQLITE_PATH=/data/auth.db
 
 # Logging
 # LOG_LEVEL=debug    # Minimum log level (debug, info, warn, error). Default: debug in dev, info in prod.

.env.test

@@ -0,0 +1,6 @@
+STACKABLE_UI_SQLITE_PATH=.data/test-auth.db
+STACKABLE_UI_OIDC_CLIENT_ID=mock-client
+STACKABLE_UI_OIDC_CLIENT_SECRET=mock-secret
+STACKABLE_UI_OIDC_DISCOVERY_URL=http://localhost:9090/.well-known/openid-configuration
+STACKABLE_UI_SESSION_SECRET=e2e-test-session-secret-that-is-long-enough
+STACKABLE_UI_BASE_URL=http://localhost:4173

.github/workflows/pr_checks.yaml

@@ -50,8 +50,6 @@ jobs:
   tests:
     name: E2E Tests
     runs-on: ubuntu-latest
-    env:
-      PLAYWRIGHT_BASE_URL: http://localhost:4173
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -70,13 +68,5 @@ jobs:
       - name: Install Playwright browsers
         run: npx playwright install --with-deps chromium firefox
 
-      - name: Build application
-        run: npm run build
-
-      - name: Start application
-        run: |
-          npm run preview &
-          timeout 60 bash -c 'until curl -sf http://localhost:4173 > /dev/null; do sleep 1; done'
-
       - name: Run E2E tests
         run: npm run test:e2e

.gitignore

@@ -17,6 +17,8 @@ Thumbs.db
 
 # Env
 .env
+.env.development
+.env.development.bak
 !.env.example
 !.env.test
 
@@ -33,6 +35,9 @@ dist/
 
 # Playwright
 e2e/test-results
+e2e/.auth
 # Paraglide
 src/lib/paraglide
 project.inlang/cache/
+.data/*
+!.data/.gitkeep

AGENTS.md

@@ -195,6 +195,14 @@ nvm install   # installs the version from .node-version
 nvm use       # activates it in the current shell
 ```
 
+### Local Setup
+
+For a pre-configured local dev environment using OIDC, deploy & configure Keycloak and Trino on a kind cluster:
+
+```bash
+./dev/setup.sh           # Creates and configures Keycloak. Deploys Trino with OIDC authentication. Runs auth database migration. Writes to .env.development which is used by dev server.
+```
+
 ### Development
 
 ```bash

TECH_DEBT.md

@@ -38,6 +38,14 @@ Trino error messages and Node.js exception messages are returned to the browser
 
 ---
 
+### SQLite session store prevents horizontal scaling
+
+**File:** `src/lib/server/auth.ts`, `deploy/helm/stackable-ui/values.yaml`
+
+better-auth uses SQLite (via better-sqlite3) for session and user storage. SQLite only supports a single writer, so the deployment is limited to `replicaCount: 1`. A single pod failure means complete downtime with no failover. The long-term fix is to switch to PostgreSQL or a stateless session store (JWT/Redis) to allow horizontal scaling.
+
+---
+
 ## API & Validation
 
 ### API route request body not validated with Zod
@@ -64,6 +72,14 @@ The `$effect` that persists connection settings only resets `queryId`, not `rows
 
 ---
 
+### No validation that the connection target is a Trino instance
+
+**File:** `src/routes/(app)/trino/+page.server.ts`
+
+The query action sends whatever SQL the user provides to the configured connection URL without first verifying that the endpoint is actually a Trino instance. A user could point the URL at any HTTP server, and the app would blindly POST to it. We should validate new connections (e.g. by calling Trino's `/v1/info` endpoint) and reject URLs that do not respond as a Trino server.
+
+---
+
 ## Infrastructure
 
 ### No Content Security Policy headers

deploy/helm/stackable-ui/templates/configmap.yaml

@@ -4,4 +4,7 @@ metadata:
   name: {{ include "stackable-ui.fullname" . }}
   labels:
     {{- include "stackable-ui.labels" . | nindent 4 }}
-data: {}
+data:
+  oidc-discovery-url: {{ .Values.auth.discoveryUrl | quote }}
+  oidc-client-id: {{ .Values.auth.clientId | quote }}
+  base-url: {{ .Values.auth.baseUrl | quote }}

deploy/helm/stackable-ui/templates/deployment.yaml

@@ -58,17 +58,52 @@ spec:
               value: {{ .Values.config.nodeEnv | quote }}
             - name: PORT
               value: {{ .Values.service.targetPort | quote }}
-            - name: SESSION_SECRET
+            - name: STACKABLE_UI_SESSION_SECRET
               valueFrom:
                 secretKeyRef:
                   name: {{ include "stackable-ui.fullname" . }}
                   key: session-secret
+            - name: STACKABLE_UI_OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "stackable-ui.fullname" . }}
+                  key: oidc-client-secret
+            - name: STACKABLE_UI_BASE_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "stackable-ui.fullname" . }}
+                  key: base-url
+            - name: STACKABLE_UI_OIDC_DISCOVERY_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "stackable-ui.fullname" . }}
+                  key: oidc-discovery-url
+            - name: STACKABLE_UI_OIDC_CLIENT_ID
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "stackable-ui.fullname" . }}
+                  key: oidc-client-id
+            - name: STACKABLE_UI_SQLITE_PATH
+              value: {{ .Values.config.databasePath | quote }}
+            {{- if .Values.auth.usernameClaim }}
+            - name: STACKABLE_UI_OIDC_USERNAME_CLAIM
+              value: {{ .Values.auth.usernameClaim | quote }}
+            {{- end }}
           volumeMounts:
             - name: tmp
               mountPath: /tmp
+            - name: data
+              mountPath: /data
       volumes:
         - name: tmp
           emptyDir: {}
+        - name: data
+          {{- if .Values.persistence.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{ else }}{{ include "stackable-ui.fullname" . }}-data{{ end }}
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

deploy/helm/stackable-ui/templates/pvc.yaml

@@ -0,0 +1,17 @@
+{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "stackable-ui.fullname" . }}-data
+  labels:
+    {{- include "stackable-ui.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.accessMode }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size }}
+  {{- with .Values.persistence.storageClassName }}
+  storageClassName: {{ . }}
+  {{- end }}
+{{- end }}

deploy/helm/stackable-ui/templates/secret.yaml

@@ -7,3 +7,4 @@ metadata:
 type: Opaque
 stringData:
   session-secret: {{ include "stackable-ui.sessionSecret" . | quote }}
+  oidc-client-secret: {{ .Values.auth.clientSecret | quote }}

deploy/helm/stackable-ui/values.yaml

@@ -1,6 +1,8 @@
 ---
 # Default values for stackable-ui
 
+# NOTE: SQLite requires a single writer. Keep replicaCount at 1 when
+# persistence.enabled is true to avoid concurrent-write corruption.
 replicaCount: 1
 
 image:
@@ -113,6 +115,36 @@ affinity: {}
 config:
   # Node.js environment
   nodeEnv: production
+  # SQLite database path inside the container (should be on the persistence volume)
+  databasePath: "/data/auth.db"
 
 # Session secret for signing cookies (auto-generated if not provided)
 sessionSecret: ""
+
+# OIDC authentication configuration
+auth:
+  # The publicly accessible base URL of this application (used for OIDC callback URLs)
+  # Required. Example: https://stackable-ui.example.com
+  baseUrl: ""
+  # OIDC discovery URL (the full .well-known/openid-configuration URL)
+  # Required. Example: https://your-idp.example.com/realms/your-realm/.well-known/openid-configuration
+  discoveryUrl: ""
+  # Client ID registered in the OIDC provider
+  # Required.
+  clientId: ""
+  # Client secret registered in the OIDC provider
+  # Required.
+  clientSecret: ""
+  # OIDC claim used as the username for Trino impersonation (default: preferred_username)
+  usernameClaim: ""
+
+# SQLite persistence for the Better Auth database.
+# NOTE: Requires replicaCount: 1 — SQLite does not support concurrent writes from multiple pods.
+persistence:
+  enabled: true
+  size: 1Gi
+  # Storage class name. Leave empty to use the cluster default.
+  storageClassName: ""
+  accessMode: ReadWriteOnce
+  # Set to reuse an existing PVC instead of creating a new one.
+  existingClaim: ""

dev/keycloak.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: keycloak
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: keycloak
+  template:
+    metadata:
+      labels:
+        app: keycloak
+    spec:
+      containers:
+        - name: keycloak
+          image: quay.io/keycloak/keycloak:26.1
+          args: ['start-dev']
+          env:
+            - name: KC_BOOTSTRAP_ADMIN_USERNAME
+              value: admin
+            - name: KC_BOOTSTRAP_ADMIN_PASSWORD
+              value: admin
+          ports:
+            - containerPort: 8080
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: keycloak
+  namespace: default
+spec:
+  type: NodePort
+  selector:
+    app: keycloak
+  ports:
+    - port: 8080
+      targetPort: 8080
+      nodePort: 30080