big juicy update

README.md

@@ -6,7 +6,7 @@ Go + Postgres marketplace where authenticated users can upload LLM skill files,
 - Backend: Go (`go run .`)
 - Frontend: vanilla HTML/CSS/JS
 - Database: Postgres
-- Auth: external OIDC JWT validation via JWKS
+- Auth: Authentik forward auth (identity headers)
 - Config: environment variables with `.env` support
 
 ## Run
@@ -23,29 +23,24 @@ Go + Postgres marketplace where authenticated users can upload LLM skill files,
 5. Open `http://localhost:8080`.
 
 ## Local dev mode (no auth setup)
-Set `DEV_MODE=true` in `.env` (enabled by default in `.env.example`).
+Set `DEV_MODE=true` in `.env`.
 In this mode, protected routes always authenticate as:
 - `sub`: `demo-user-001`
 - `email`: `demo@example.com`
 - `name`: `Demo User`
 
-OIDC variables are not required when `DEV_MODE=true`.
-
-## Auth flow
-When `DEV_MODE=false`, login is handled directly by the app:
-- `GET /auth/login` redirects to your OIDC provider
-- `GET /auth/callback` exchanges code for access token using `OIDC_CLIENT_ID` + `OIDC_CLIENT_SECRET`
-- Access token is stored in secure HttpOnly session cookie
-- Protected routes validate that token via JWKS
-- `GET /auth/logout` clears the local session (and optionally redirects to provider logout URL)
+## Forward auth flow (production)
+When `DEV_MODE=false`, deploy this app behind Authentik forward auth.
+The proxy/auth layer must validate authentication and pass identity headers to the app.
+The app reads:
+- `X-Authentik-Uid` (required; fallback `X-Forwarded-User`)
+- `X-Authentik-Email`
+- `X-Authentik-Name` (fallback `X-Forwarded-Preferred-Username`)
 
 ## Key routes
 - `GET /dashboard`: upload form
 - `GET /skills`: browse listings and buy
 - `GET /my-skills`: purchased skills and copy/download access
-- `GET /auth/login`: start OIDC login
-- `GET /auth/callback`: OIDC callback
-- `GET /auth/logout`: logout
 - `POST /api/upload`: upload and list a skill
 - `POST /api/purchase`: buy a skill
 - `GET /api/my-skills`: owned purchased list