preserve Tower Authentik operator login WIP

backend/app/core/config.py

@@ -22,6 +22,11 @@ class Settings(BaseSettings):
     auth_username: str | None = Field(default=None, validation_alias="GEOINTEL_AUTH_USERNAME")
     auth_password_hash: str | None = Field(default=None, validation_alias="GEOINTEL_AUTH_PASSWORD_HASH")
     auth_session_secret: str | None = Field(default=None, validation_alias="GEOINTEL_AUTH_SESSION_SECRET")
+    authentik_issuer: str | None = Field(default=None, validation_alias="GEOINTEL_AUTHENTIK_ISSUER")
+    authentik_client_id: str | None = Field(default=None, validation_alias="GEOINTEL_AUTHENTIK_CLIENT_ID")
+    authentik_client_secret: str | None = Field(default=None, validation_alias="GEOINTEL_AUTHENTIK_CLIENT_SECRET")
+    authentik_allowed_email: str | None = Field(default=None, validation_alias="GEOINTEL_AUTHENTIK_ALLOWED_EMAIL")
+    public_base_url: str = Field(default="http://localhost:8000", validation_alias="GEOINTEL_PUBLIC_BASE_URL")
     auth_session_ttl_seconds: int = Field(
         default=43_200,
         ge=900,
@@ -470,6 +475,21 @@ class Settings(BaseSettings):
         self.guest_display_name = self.guest_display_name.strip()
         if not self.guest_display_name:
             raise ValueError("GEOINTEL_GUEST_DISPLAY_NAME must not be blank")
+        authentik_values = (
+            self.authentik_issuer,
+            self.authentik_client_id,
+            self.authentik_client_secret,
+            self.authentik_allowed_email,
+        )
+        if any(authentik_values) and not all(authentik_values):
+            raise ValueError("All GEOINTEL_AUTHENTIK_* values must be configured together")
+        if all(authentik_values):
+            if not self.auth_enabled:
+                raise ValueError("GEOINTEL_AUTH_ENABLED must be true when Authentik is configured")
+            if not str(self.authentik_issuer).startswith("https://"):
+                raise ValueError("GEOINTEL_AUTHENTIK_ISSUER must use HTTPS")
+            if not self.public_base_url.startswith("https://"):
+                raise ValueError("GEOINTEL_PUBLIC_BASE_URL must use HTTPS for Authentik")
         if not self.auth_enabled:
             return self
         if not (self.auth_username or "").strip():