initial commit on Federted servers

web/lib/oidc-config.ts

@@ -0,0 +1,42 @@
+/**
+ * Authelia OIDC configuration (STUB-AWARE).
+ *
+ * Authelia sign-in is only enabled when all three env vars hold real values:
+ *   OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET
+ *
+ * Empty values or obvious placeholders (REPLACE_ME, example.com, changeme, ...)
+ * are treated as "not connected": the Authelia provider is not registered,
+ * the login button is shown disabled, and email/password login keeps working.
+ *
+ * See docs/AUTHELIA.md for the full connection guide.
+ */
+
+const PLACEHOLDER_PATTERNS = [/replace[_-]?me/i, /example\.(com|org|net)/i, /changeme/i, /placeholder/i, /^<.*>$/, /^your[_-]/i, /^todo$/i]
+
+function isRealValue(value: string | undefined): value is string {
+  const v = (value ?? '').trim()
+  if (!v) return false
+  return !PLACEHOLDER_PATTERNS.some((p) => p.test(v))
+}
+
+export interface OidcStatus {
+  enabled: boolean
+  issuerSet: boolean
+  clientIdSet: boolean
+  clientSecretSet: boolean
+  /** Only exposed when the issuer is a real value (never exposes secrets). */
+  issuer: string | null
+}
+
+export function getOidcStatus(): OidcStatus {
+  const issuerSet = isRealValue(process.env.OIDC_ISSUER)
+  const clientIdSet = isRealValue(process.env.OIDC_CLIENT_ID)
+  const clientSecretSet = isRealValue(process.env.OIDC_CLIENT_SECRET)
+  return {
+    enabled: issuerSet && clientIdSet && clientSecretSet,
+    issuerSet,
+    clientIdSet,
+    clientSecretSet,
+    issuer: issuerSet ? process.env.OIDC_ISSUER!.trim() : null,
+  }
+}