[qiuethan]

Adds opt-in MIST_AUTH_MODE=misty login for the browser and CLI. Misty owns email-code generation, delivery and verification; compute owns sessions, roles, teams, jobs and files. Only active registered Misty members can authenticate.

Companion gateway PR: UTMIST/Misty#331.

Existing compute accounts require explicit operator-reviewed Misty UUID mappings. Email equality cannot claim an old account or inherit an administrator role. New eligible members get role user; mapped accounts retain their IDs, roles and ownership. Compute verifies the expected gateway issuer at startup and on successful responses, and pins the issuer and gateway origin to its database. A changed origin is rejected before sending credentials.

Browser-bound challenges, strict origins, three attempts per challenge, single redemption and fail-closed upstream/status checks protect login. Password sessions and management are disabled in Misty mode. Legacy job ownership remains pinned across email changes. CLI credentials require HTTPS except on loopback, stay bound to the saved origin, and never follow redirects; separate --config files isolate environments. Logout and administrator revocation report database failures instead of falsely claiming success. Rolling back to local auth transactionally revokes Misty sessions and pending challenges, preserving local sessions and identity/ownership mappings. Local mode rejects late Misty-session writes, and switching back cannot revive deleted credentials; cleanup failure prevents startup.

The build requires Go 1.26.10 or newer. API and deployment helper images use Alpine 3.24.3. Zod and Undici are patched; the lockfile also repairs missing optional-platform entries so clean npm installs work. No other existing dependency versions changed.

Validation:

• Regression tests failed before and passed after the origin/redirect, revocation, email-linking and issuer fixes. Rollback regressions also fail against the audited base and pass now, covering pending challenges, retained local sessions, late writes, non-revival and atomic cleanup failure.
• Linux API/CLI race suites and go vet; frontend Vitest, TypeScript, ESLint, changed-file formatting and production build; clean npm ci and full npm audit with no advisories.
• API/CLI binaries and updated runtime image built successfully.
• Chromium against real compute auth and Misty gateway/directory/verification containers: valid login with an explicitly mapped admin, wrong-code rejection, replay rejection, unknown/inactive denial, and retirement after cache expiry. Only mail/code generation and unrelated cluster routes were test replacements; no real email or Kubernetes jobs ran.

Verification and limitations · Rollout, rollback and per-file rationale

Deploy and provision the companion Misty change in staging first. Back up compute's auth database, establish HTTPS, configure the scoped backend-only gateway key, set MISTY_ENVIRONMENT, and supply reviewed MISTY_ACCOUNT_LINKS before enabling Misty mode. Use separate databases/keys/configs for staging and production. A gateway outage prevents Misty-mode startup; changing a recorded issuer/origin requires a reviewed migration. Size the companion gateway’s configurable status and edge-IP budgets together; defaults budget roughly 300 continuously active identities while keeping the 30-second eligibility cache.

Local password mode remains the default; this PR does not enable or deploy the feature. Existing jobs retain local-ban/team-revocation policy. Shared mail-delivery quotas can still be exhausted by abuse; delivered challenges remain independently usable, and edge abuse monitoring remains necessary. Live host access, HTTPS/proxy configuration, real mail delivery and production mappings remain unverified.

[github-actions]

This PR exceeds the recommended size of 1000 lines. Please make sure you are NOT addressing multiple issues with one PR. Note this PR might be rejected due to its size.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.