Add support for users

OpenCRE could become more useful if users could make an account and select which resources they want to be working with.

This would allow users to not only see and export subgraphs of information but most importantly map their resources to sub-graphs without the noise.

This feature set contains the following sub-features:

A user should be able to login with an OIDC provider (e.g. google, github, linkedin etc)
A user should have the ability to select which resources they want to see in their account

Sir what are your requirements after login -
1- User must go to a new page or same home page
2- which db you wanna use {I may use Mongodb} for user credentials.

I am willing to work on this issue ,Plz assign me this issue.

How I will solve the above issue -
1- I will use Auth0 for handling the signup and login mechanism
2- using the above we can easily integrate the OIDC providers
3- Creating a filter to filter out the resources

@northdpole

Please assign me this issue @northdpole

Sir what are your requirements after login -
1- User must go to a new page or same home page
2- which db you wanna use {I may use Mongodb} for user credentials.
This should work seamlessly with the platform, we currently use postgresql as our database and sqlite for development all exposed via a sqlalchemy ORM.
A user should be able to filter the resources they want to see after logging in.
e.g. not everyone cares about zap rules or asvs or samm or any other resource so they should be able to filter them out if they wish.

I am willing to work on this issue ,Plz assign me this issue.

done

How I will solve the above issue -
1- I will use Auth0 for handling the signup and login mechanism
2- using the above we can easily integrate the OIDC providers
3- Creating a filter to filter out the resources
let's start with the login first, let's create the login that can be turned off for local development and then we can work on the filtering.

I'd like to work on this. Can you assign me to this issue?

Hi I have noticed that this issue is inactive for a while, If its okay could you pls assign this to me if its still available?

@northdpole

Hi @northdpole, @Pa04rth and @viyatb,

Could you please let me know if this issue has been resolved, or if it is still pending?

If it is still pending, I would kindly like to request to be assigned to it. I am a contributer on the Nest project and would like to work on resolving this issue immediately.

Hi, I’ve reviewed the issue and the previous PR attempts (#592 and #704).

Before starting implementation, I’d like to clarify:

What parts of the login feature are already implemented?
Is there a preferred OIDC library (e.g., Authlib)?
Should we prioritize backend authentication or resource filtering first?
Is there a branch with partial work to build on?

I’d like to propose an incremental implementation plan before starting.

@northdpole

Hi @northdpole, I noticed that this issue has been open for some time and there have been previous discussions and partial attempts. If it is still available and not actively being worked on, I would be happy to contribute to implementing this feature. I’ve gone through the issue description and the earlier comments regarding OIDC login and resource filtering. If the issue is open for contribution, could you please assign it to me? Thanks!

"Hi @parth-sohaney! I'm Saatwik, a GSoC 2026 applicant for OpenCRE. I'd like to work on this issue. I'll review your existing changes first and reach out if I have questions before opening a PR."

fix(api): address review — concurrency, request-body spec, value trim…

feat(api): filter /rest/v1/standards by saved resource selection (OWA…

feat(frontend): resource-selection UI in MyOpenCRE (Part of OWASP#586)

fix(frontend): handle anonymous/login-disabled and initial-load failu…

fix(frontend): reject malformed /user/resources load; async/await loa…

fix(db): serialize set_user_resource_selection with a per-user row lo…

fix(db): concurrency-safe set_user_resource_selection + enforce OpenC…

fix(db): serialize set_user_resource_selection with a per-user row lo…

fix(db): concurrency-safe set_user_resource_selection + enforce OpenC…

fix(db): serialize set_user_resource_selection with a per-user row lo…

@northdpole

The core per-user resource selection loop is complete and merged:

User + resource-selection persistence (feat(db): persist users + resource selection — Part of #586 #980)
GET/PUT /rest/v1/user/resources API (feat(api): per-user resource selection endpoint — Part of #586 #981)
Server-side filtering of /rest/v1/standards with ?all=true bypass (feat(api): filter /rest/v1/standards by saved resource selection (#586) #1001)
Resource-selection UI in MyOpenCRE (feat(frontend): resource-selection UI in MyOpenCRE (Part of #586) #1005)
Concurrency-safe selection write + OpenCRE-always-included invariant (fix(db): concurrency-safe set_user_resource_selection + enforce OpenCRE (Part of #586) #1008)

Two extensions were deliberately deferred and are tracked in the follow-up issue #1043 :
graph-link pruning on CRE pages, and ga_standards filtering with the paired frontend
?all=true bypass.

@northdpole — from your note, this is ready to close once the follow-up (#1043 is filed;
that's linked above. Closing is yours to make whenever you're happy it's wrapped.

Closing as complete. Core per-user resource selection loop is merged (#980, #981, #1001, #1005, #1008). Deferred graph-link pruning and ga_standards filtering tracked in #1043.

Navigation Menu

Repository navigation

Add support for users #586

35 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Add support for users #586

Description

Activity

Pa04rth commented on Mar 6, 2025

Pa04rth commented on Mar 7, 2025

northdpole commented on Mar 7, 2025

abhishekblue commented on Nov 3, 2025

sd2604 commented on Nov 12, 2025

moizulfiqar commented on Jan 27, 2026

Arunodoy18 commented on Feb 19, 2026

Mahaboobunnisa123 commented on Mar 4, 2026

skypank-coder commented on Apr 3, 2026

35 remaining items

skypank-coder commented on Aug 23, 2026

northdpole commented on Aug 26, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions