e92c022e80
Add a complete authentication and authorization system to Silo with three pluggable backends (local bcrypt, LDAP/FreeIPA, OIDC/Keycloak), session management, API token support, and role-based access control. Authentication backends: - Local: bcrypt (cost 12) password verification against users table - LDAP: FreeIPA simple bind with group-to-role mapping - OIDC: Keycloak redirect flow with realm role mapping - Backends are tried in order; users upserted to DB on first login Session and token management: - PostgreSQL-backed sessions via alexedwards/scs + pgxstore - Opaque API tokens (silo_ prefix, SHA-256 hashed, shown once) - 24h session lifetime, HttpOnly/SameSite=Lax/Secure cookies Role-based access control (admin > editor > viewer): - RequireAuth middleware: Bearer token -> session -> redirect/401 - RequireRole middleware: per-route-group minimum role enforcement - CSRF protection via justinas/nosurf on web forms, API exempt - CORS locked to configured origins when auth enabled Route restructuring: - Public: /health, /ready, /login, /auth/oidc, /auth/callback - Web (auth + CSRF): /, /projects, /schemas, /settings - API read (viewer): GET /api/** - API write (editor): POST/PUT/PATCH/DELETE /api/** User context wiring: - created_by/updated_by columns on items, projects, relationships - All create/update handlers populate tracking fields from context - CSV and BOM import handlers pass authenticated username - Revision creation tracks user across all code paths Default admin account: - Configurable via auth.local.default_admin_username/password - Env var overrides: SILO_ADMIN_USERNAME, SILO_ADMIN_PASSWORD - Idempotent: created on first startup, skipped if exists CLI and FreeCAD plugin: - silo token create/list/revoke subcommands (HTTP API client) - FreeCAD SiloClient sends Bearer token on all requests - Token read from ApiToken preference or SILO_API_TOKEN env var Web UI: - Login page (Catppuccin Mocha themed, OIDC button conditional) - Settings page with account info and API token management - User display name, role badge, and logout button in header - One-time token display banner with copy-to-clipboard Database (migration 009): - users table with role, auth_source, oidc_subject, password_hash - api_tokens table with SHA-256 hash, prefix, expiry, scopes - sessions table (scs pgxstore schema) - audit_log table (schema ready for future use) - created_by/updated_by ALTER on items, relationships, projects New dependencies: scs/v2, scs/pgxstore, go-oidc/v3, go-ldap/v3, justinas/nosurf, golang.org/x/oauth2
Kindred Silo
Item database and part management system for Kindred Create.
Overview
Kindred Silo is an R&D-oriented item database with:
- Configurable part number generation via YAML schemas
- FreeCAD integration with git-like commands (checkout, commit, status)
- Revision tracking with append-only history
- BOM management with reference designators and alternates
- Physical inventory tracking with hierarchical locations
Components
silo/
├── cmd/
│ ├── silo/ # CLI tool
│ └── silod/ # API server
├── internal/
│ ├── api/ # HTTP handlers, routes, and templates
│ ├── config/ # Configuration loading
│ ├── db/ # PostgreSQL access
│ ├── migration/ # Property migration utilities
│ ├── partnum/ # Part number generation
│ ├── schema/ # YAML schema parsing
│ └── storage/ # MinIO file storage
├── pkg/
│ └── freecad/ # FreeCAD workbench (Python)
├── migrations/ # Database migration SQL scripts
├── schemas/ # Part numbering schema definitions (YAML)
├── deployments/ # Docker Compose and systemd configs
├── scripts/ # Deployment and setup scripts
└── docs/ # Documentation
Quick Start
# Database setup
psql -h psql.kindred.internal -U silo -d silo -f migrations/001_initial.sql
# Configure
cp config.example.yaml config.yaml
# Edit config.yaml with your settings
# Run server
go run ./cmd/silod
# CLI usage
go run ./cmd/silo register --schema kindred-rd --category F01
Configuration
See config.example.yaml for all options.
Kindred Create Integration
Install the workbench:
ln -s $(pwd)/pkg/freecad ~/.local/share/FreeCAD/Mod/KindredSilo
Then in Kindred Create, use the Silo workbench toolbar commands:
- Pull - Download an item by part number
- Commit - Save current state as a new revision with comment
- Push - Batch upload modified files
- Info - View revision history
License
MIT License - Copyright (c) 2026 Kindred Systems LLC
See LICENSE for details.