[mtthsbrd]

Description

Currently, protocol-level credential requirements only allow either "Anything" or a single conjunction (ANDed set) of credential requirements (e.g. Password AND TOTP). There was no way to specify alternative authentication pathways, such as allowing a user to authenticate via SSH using either SSH Key OR Password + TOTP OR Web In-Browser Approval. The previous UI also did not make credential combinations clear.

This PR introduces support for multiple authentication combinations per protocol (Disjunctive Normal Form: OR-of-ANDs), while preserving the "Allow any" option, paired with an interactive matrix UI in the web admin.

Key Changes

• Core & Data Models:

  • Updated UserRequireCredentialsPolicy protocol fields (ssh, http, vnc, postgres, kubernetes, rdp) from Option<Vec<CredentialKind>> to Option<Vec<Vec<CredentialKind>>>.
  • Maintained backward compatibility in deserialization/migration so existing single-conjunction configurations seamlessly deserialize into the new format.
  • Updated session authentication pipelines across all protocols to validate whether the user's provided credentials satisfy any of the configured combination rules.

• Web Admin (Matrix UI):

  • Added an interactive matrix editor in AuthPolicyEditor.svelte:
    • Rows represent alternative combinations (OR paths).
    • Columns represent credential kinds (AND within each combination).
    • Clear controls to add/remove combination rows and toggle credential requirements.
  • Modernized event handling and typing in CredentialManager.svelte and user management views.

• API & Testing:

  • Regenerated OpenAPI schemas, TypeScript types, and Python SDK.
  • Adjusted oasdiff severity rule for the intentional schema evolution.
  • Updated all 15 integration test suites across SSH, VNC, HTTP, Postgres, Kubernetes, and RDP to the 2D policy structure.

---

AI Usage

Choose the level of AI involvement for this PR.

• Fully vibe coded
• AI-designed, AI-coded, manually checked
• Human-designed, AI-coded
• Human-designed, human-coded (includes AI autocompletions and boilerplate gen)

_{This is not to block AI contributions but rather to speed up PR review (saves time on trying to deduce the logic behind AI hallucinations).}

[mtthsbrd]

Could potentially address #2484