Andrew S Erwin
4e421f6ea2
release gate / check (push) Failing after 6m43s
High severity: - wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup - bucket public rate limits on effective client IP, add per-bookmark budget, and forward the signed browser identity from the share page - disable first-run bootstrap in server deployments and document seeding - serialize last-admin demotion in one advisory-locked transaction Medium/low: - cap and batch share recipient inserts - add a shared outbound budget for preview/CardDAV/IMAP/signal work - pin CardDAV dials to 443 and bound IMAP logout - fix rightward kanban column drags and normalize cards on column delete - classify backend outages in auth guards, add request timeouts and an error boundary, remove the dead login route, surface throttling - enforce pinned/unpinned page reorder grouping server-side - avoid preview work for stale bookmark versions; drop duplicate dialog fetch - sequence-guard collection/tag/calendar/quick-find loads - validate property config and fix MULTI_SELECT/DATE filter inputs - document index maintenance; apply same-origin check to sign-out - trim signup names, unique shared dates and kanban keys (migration 010), reset reference cache on identity changes, hide OIDC issuer, return 413 for oversized direct bodies, escape Markdown link destinations - remove dead template files and duplicate test helper Verified with go build/vet, full PostgreSQL race suite, db convergence, tsc, both ESLint configs and a Next production build.
100 lines
3.6 KiB
Go
100 lines
3.6 KiB
Go
package oidc
|
|
|
|
// Provider is the Authelia OIDC sign-in provider.
|
|
//
|
|
// Porting guide 3.1: the Authelia provider is registered only when
|
|
// getOidcStatus().enabled. Scope "openid profile email". Profile mapping:
|
|
// id=sub, name = name ?? preferred_username ?? sub, email, image = picture.
|
|
// It links to an existing account with the same email.
|
|
//
|
|
// STUB: the full OIDC code flow (authorization code exchange, token endpoint,
|
|
// userinfo) is NOT implemented in Go — it will be driven by the client, which
|
|
// runs NextAuth and handles the provider itself. These handlers exist so the
|
|
// route table matches the original app and the Settings/login pages can read
|
|
// the status. They return 501 until the client-side flow is wired.
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
)
|
|
|
|
// HandleStatus returns the current OIDC configuration state. This is what the
|
|
// Settings page and the login page read to decide whether to show the
|
|
// "Sign in with Authelia" button.
|
|
//
|
|
// GET /api/auth/oidc/status -> {enabled, issuerSet, clientIdSet, clientSecretSet}
|
|
//
|
|
// Review L-7: the issuer URL is deliberately NOT public. It is usually a
|
|
// public hostname, but an internal one would become an information leak; the
|
|
// authenticated settings surface can expose it when one exists.
|
|
func HandleStatus(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Cache-Control", "no-store")
|
|
if r.Method != http.MethodGet {
|
|
w.Header().Set("Content-Type", "application/json")
|
|
w.WriteHeader(http.StatusMethodNotAllowed)
|
|
_ = json.NewEncoder(w).Encode(map[string]string{"error": "method not allowed"})
|
|
return
|
|
}
|
|
s := Status()
|
|
w.Header().Set("Content-Type", "application/json")
|
|
_ = json.NewEncoder(w).Encode(map[string]interface{}{
|
|
"enabled": s.Enabled,
|
|
"issuerSet": s.IssuerSet,
|
|
"clientIdSet": s.ClientIDSet,
|
|
"clientSecretSet": s.ClientSecretSet,
|
|
})
|
|
}
|
|
|
|
// HandleLogin starts the OIDC authorization-code flow. STUB: returns 501 until
|
|
// the client drives the flow via NextAuth.
|
|
//
|
|
// GET /api/auth/oidc/login
|
|
func HandleLogin(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Cache-Control", "no-store")
|
|
w.Header().Set("Content-Type", "application/json")
|
|
w.WriteHeader(http.StatusNotImplemented)
|
|
_ = json.NewEncoder(w).Encode(map[string]string{
|
|
"error": "oidc not implemented",
|
|
"detail": "Authelia OIDC is driven by the client (NextAuth); this handler is a stub",
|
|
})
|
|
}
|
|
|
|
// HandleCallback is the Authelia OIDC callback. STUB: returns 501 until the
|
|
// client drives the flow via NextAuth.
|
|
//
|
|
// GET /api/auth/callback/authelia
|
|
func HandleCallback(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Cache-Control", "no-store")
|
|
w.Header().Set("Content-Type", "application/json")
|
|
w.WriteHeader(http.StatusNotImplemented)
|
|
_ = json.NewEncoder(w).Encode(map[string]string{
|
|
"error": "oidc not implemented",
|
|
"detail": "Authelia OIDC is driven by the client (NextAuth); this handler is a stub",
|
|
})
|
|
}
|
|
|
|
// Profile maps an Authelia userinfo response to a user identity. Porting guide
|
|
// 3.1: id=sub, name = name ?? preferred_username ?? sub, email, image = picture.
|
|
type Profile struct {
|
|
Sub string `json:"sub"`
|
|
Name string `json:"name"`
|
|
PreferredUsername string `json:"preferred_username"`
|
|
Email string `json:"email"`
|
|
Picture string `json:"picture"`
|
|
}
|
|
|
|
// MapProfile converts a raw Authelia profile into the identity fields.
|
|
func MapProfile(p Profile) (id, name, email, image string) {
|
|
id = p.Sub
|
|
if p.Name != "" {
|
|
name = p.Name
|
|
} else if p.PreferredUsername != "" {
|
|
name = p.PreferredUsername
|
|
} else {
|
|
name = p.Sub
|
|
}
|
|
email = p.Email
|
|
image = p.Picture
|
|
return
|
|
}
|