Authentication layer for web UI (SSO/SAML)

[haasonsaas]

Problem

The diffscope serve command starts a web UI with API endpoints but has no authentication layer. Any user on the network can access reviews, analytics, and configuration. This is a hard blocker for enterprise deployment.

Proposed Solution

Phase 1: Basic Auth

• API key authentication for API endpoints
• Session-based auth for the web UI
• Local user/password management

Phase 2: OAuth/OIDC

• GitHub OAuth (natural fit — users already have GitHub accounts)
• Google OAuth
• Generic OIDC provider support

Phase 3: Enterprise SSO

• SAML 2.0 support
• LDAP/Active Directory integration
• Role-based access control (admin, reviewer, read-only)
• Team/org scoping — users only see repos they have access to

Configuration

auth:
  provider: oidc  # none, basic, github, oidc, saml
  oidc:
    issuer_url: https://auth.company.com
    client_id: diffscope
    # client_secret from Vault
  rbac:
    admin_groups: ["platform-team"]
    reviewer_groups: ["engineering"]

Priority

Tier 3 — Enterprise requirement. Needed before any serious self-hosted enterprise deployment.