feat: GitHub OAuth authentication for the dashboard

[sebykrueger]

Summary

Adds opt-in GitHub OAuth login for the dashboard. When the auth block is absent or auth.enabled=false, the dashboard runs unauthenticated as today (no breaking change). When enabled, /api/* and / require a signed session cookie obtained via GitHub OAuth; /metrics stays open so Prometheus scrapers keep working.

• New internal/auth package: HMAC-SHA256 signed cookie sessions (no server-side store), GitHub OAuth client with /user + /user/emails calls to extract login + verified primary email, allowlist matching (case-insensitive emails OR usernames), and middleware that returns 303→/auth/login for browsers and 401 JSON for /api/* callers.
• New /auth/login, /auth/callback, /auth/logged-out, /auth/logout handlers. Logout lands on a dedicated static page rather than redirecting back through GitHub — otherwise the user gets silently re-authenticated and Logout looks broken.
• New /api/auth/me endpoint returns {login, email, logout_url} for the current session, used by the SPA.
• Frontend: an Account section in the existing Settings modal showing the GitHub @username and email, plus a Logout button. Hidden when auth is disabled.
• New --gen-session-secret CLI flag prints a 32-byte base64 secret.

Why GitHub OAuth (not OIDC)?

GitHub doesn't implement OIDC (no discovery doc, no ID tokens, separate /user/emails API call to get the verified email). Treating it as a first-class provider rather than forcing it through a generic OIDC abstraction kept the code simpler and removes the need for users to stand up a federating IDP just to log in with their GitHub account. A future PR can add a generic OIDC provider alongside if there's demand for Google/Microsoft/Authentik/Keycloak.

Config shape

"auth": {
  "enabled": true,
  "client_id": "Iv1.xxxx",
  "client_secret": "xxxx",
  "redirect_url": "https://dmarc.example.com/auth/callback",
  "session_secret": "<--gen-session-secret>",
  "allowed_users": ["sebykrueger"],
  "allowed_emails": ["seb@example.com"],
  "session_ttl_days": 7
}

ValidateAuth() refuses to start when auth.enabled=true and the allowlist is empty (otherwise nobody could log in). All fields also available as env vars (AUTH_ENABLED, AUTH_CLIENT_ID, AUTH_ALLOWED_USERS=a,b,c, etc.) for Docker/k8s secrets.

Security notes

• Sessions are stateless HMAC-signed cookies (HttpOnly; SameSite=Lax; Secure flag inferred from https:// redirect URL). No server-side session store.
• OAuth state is a separate signed token, validated against a short-lived state cookie scoped to /auth/callback for CSRF protection on the callback.
• /metrics is intentionally not auth-gated so existing Prometheus scrapers don't break.
• Removing someone from the allowlist doesn't kill their existing session (cookie keeps working until session_ttl_days). To force-evict immediately, rotate auth.session_secret. Documented as a known gotcha in the README.

Test plan

• go test ./... — session sign/verify round-trip + tamper detection + expiry, state token round-trip + expiry, secret-too-short rejection, allowlist case-insensitive matching for emails and logins, empty allowlist denies all, middleware decision matrix (no cookie → 303 browser / 401 api, garbage cookie → same, valid cookie → pass through with populated context for /api/auth/me), full config validation matrix.
• go vet ./... clean.
• go build ./... clean for both pure-Go and CGO modes.
• Manual end-to-end against a real GitHub OAuth App on http://localhost:8080: login flow, allowlist denial, logout flow with the dedicated landing page (verified you don't get silently re-authenticated through GitHub).
• Verified /metrics stays open with auth enabled.
• Verified existing deployments without an auth block continue to run unauthenticated (AuthConfig{Enabled: false} is the zero value).

[meysam81]

auth is not the focus of this repo

the self-hosted setup in parse-dmarc allows team to quickly spin up the server without hassle

nginx and other proxies handle auth properly and quite better