DC-154: forward_auth enforcement endpoint (whois + access map + sensitive step-up) + tests

dashcaddy-api/src/app.js

@@ -808,6 +808,57 @@ async function createApp() {
     return p7WgRedeemRouter(req, res, next);
   };
   apiRouter.use('/network/wg', p7WgRedeemLazy);
+
+  // forward_auth enforcement (DC-154, spec §4 Layer 2). Same lazy-provider
+  // pattern as p7WgRedeemLazy: the check service needs an active provider
+  // (any id — whois is part of the shared provider contract); without one,
+  // 503 { error: 'network provider not active' }. NO auth middleware in
+  // front — this route IS the auth check, called by Caddy forward_auth.
+  // Caddy passes the client IP via X-Forwarded-For; the route honors it.
+  const networkForwardAuthRoutes = require('../routes/network-forward-auth'); // eslint-disable-line global-require
+  const { createForwardAuthService } = require('./network/forward-auth'); // eslint-disable-line global-require
+  let p7ForwardAuthRouter = null;
+  const p7ForwardAuthLazy = (req, res, next) => {
+    if (!p7ForwardAuthRouter) {
+      const prov = getActiveProvider();
+      if (!prov) {
+        return res.status(503).json({ error: 'network provider not active' });
+      }
+      const service = createForwardAuthService({
+        provider: prov,
+        accessStore: p7AccessStore,
+        resourcesStore: p7ResourcesStore,
+        peopleStore: p7PeopleStore,
+        // Reuse the cookie-only session validation from middleware.js (the
+        // same isSessionValid the TOTP gate uses) — never a reimplementation.
+        sessionValidator: (r) => Promise.resolve(middlewareResult.isSessionValid(r)),
+        logger: ctx.log,
+        auditLog: {
+          logForwardAuth: (entry) => ctx.auditLog
+            ? ctx.auditLog.log({
+              action: 'network.' + entry.event,
+              resource: entry.resource || entry.host || '',
+              details: {
+                event: entry.event,
+                personId: entry.personId,
+                resource: entry.resource,
+                host: entry.host,
+                outcome: entry.outcome,
+              },
+              outcome: entry.outcome || 'unknown',
+            })
+            : Promise.resolve(),
+        },
+      });
+      p7ForwardAuthRouter = networkForwardAuthRoutes({
+        service,
+        asyncHandler: ctx.asyncHandler,
+        log: ctx.log,
+      });
+    }
+    return p7ForwardAuthRouter(req, res, next);
+  };
+  apiRouter.use('/network/forward-auth', p7ForwardAuthLazy);
   // ── end P7 mounts ───────────────────────────────────────────────────────
   apiRouter.use(sitesRoutes({
     asyncHandler: ctx.asyncHandler,