From 50046274760c491ff657d8bb6a56add0725deef0 Mon Sep 17 00:00:00 2001 From: DCCONSTRUCTIONS Date: Mon, 6 Jul 2026 10:09:46 +0300 Subject: [PATCH] Use direct Authentik origin for CMS OIDC --- infra/.env.example | 4 +--- infra/.env.synology.example | 4 +--- infra/docker-compose.yml | 4 +--- server/admin-server.mjs | 44 +++++++++++++++++++++++-------------- 4 files changed, 30 insertions(+), 26 deletions(-) diff --git a/infra/.env.example b/infra/.env.example index cd046e7..61923e7 100644 --- a/infra/.env.example +++ b/infra/.env.example @@ -39,9 +39,7 @@ CMS_BOOTSTRAP_ADMIN_NAME=DCTOUCH CMS Admin CMS_AUTH_ENABLED=true CMS_BASE_URL=http://cms.local.nodedc:8210 CMS_OIDC_ISSUER=http://cms-auth.local.nodedc:8210/application/o/dc-cms/ -CMS_OIDC_INTERNAL_BASE_URL=http://reverse-proxy -CMS_OIDC_INTERNAL_HOST=cms-auth.local.nodedc -CMS_OIDC_INTERNAL_PROTO=http +CMS_OIDC_INTERNAL_BASE_URL=http://authentik-server:9000 CMS_OIDC_CLIENT_ID=dc-cms CMS_OIDC_CLIENT_SECRET=replace-with-random-secret CMS_OIDC_REDIRECT_URI=http://cms.local.nodedc:8210/auth/callback diff --git a/infra/.env.synology.example b/infra/.env.synology.example index 60a4ace..8f52637 100644 --- a/infra/.env.synology.example +++ b/infra/.env.synology.example @@ -40,9 +40,7 @@ CMS_BOOTSTRAP_ADMIN_NAME=DCTOUCH CMS Admin CMS_AUTH_ENABLED=true CMS_BASE_URL=https://cms.dcserve.ru CMS_OIDC_ISSUER=https://auth.dcserve.ru/application/o/dc-cms/ -CMS_OIDC_INTERNAL_BASE_URL=http://reverse-proxy -CMS_OIDC_INTERNAL_HOST=auth.dcserve.ru -CMS_OIDC_INTERNAL_PROTO=https +CMS_OIDC_INTERNAL_BASE_URL=http://authentik-server:9000 CMS_OIDC_CLIENT_ID=dc-cms CMS_OIDC_CLIENT_SECRET=replace-with-random-secret CMS_OIDC_REDIRECT_URI=https://cms.dcserve.ru/auth/callback diff --git a/infra/docker-compose.yml b/infra/docker-compose.yml index 0458eca..3bf8ee0 100644 --- a/infra/docker-compose.yml +++ b/infra/docker-compose.yml @@ -38,9 +38,7 @@ services: SITE_ROOT: /sites/nodedc CMS_AUTH_ENABLED: ${CMS_AUTH_ENABLED:-true} CMS_OIDC_ISSUER: ${CMS_OIDC_ISSUER:?cms oidc issuer required} - CMS_OIDC_INTERNAL_BASE_URL: ${CMS_OIDC_INTERNAL_BASE_URL:-} - CMS_OIDC_INTERNAL_HOST: ${CMS_OIDC_INTERNAL_HOST:-} - CMS_OIDC_INTERNAL_PROTO: ${CMS_OIDC_INTERNAL_PROTO:-} + CMS_OIDC_INTERNAL_BASE_URL: ${CMS_OIDC_INTERNAL_BASE_URL:-http://authentik-server:9000} CMS_OIDC_CLIENT_ID: ${CMS_OIDC_CLIENT_ID:?cms oidc client id required} CMS_OIDC_CLIENT_SECRET: ${CMS_OIDC_CLIENT_SECRET:?cms oidc client secret required} CMS_OIDC_REDIRECT_URI: ${CMS_OIDC_REDIRECT_URI:?cms oidc redirect uri required} diff --git a/server/admin-server.mjs b/server/admin-server.mjs index ec1be63..8ea90f6 100644 --- a/server/admin-server.mjs +++ b/server/admin-server.mjs @@ -211,8 +211,6 @@ const authConfig = { baseUrl: String(process.env.CMS_BASE_URL || "").trim(), issuer: trailingSlashUrl(process.env.CMS_OIDC_ISSUER), internalBaseUrl: String(process.env.CMS_OIDC_INTERNAL_BASE_URL || "").trim(), - internalHost: String(process.env.CMS_OIDC_INTERNAL_HOST || "").trim(), - internalProto: String(process.env.CMS_OIDC_INTERNAL_PROTO || "").trim(), clientId: String(process.env.CMS_OIDC_CLIENT_ID || "").trim(), clientSecret: String(process.env.CMS_OIDC_CLIENT_SECRET || "").trim(), redirectUri: String(process.env.CMS_OIDC_REDIRECT_URI || "").trim(), @@ -368,23 +366,10 @@ function oidcInternalFetchUrl(rawUrl) { return internalBaseUrl; } -function oidcFetchHeaders(headers) { - const nextHeaders = new Headers(headers || {}); - if (!authConfig.internalBaseUrl) return nextHeaders; - - const publicIssuer = new URL(authConfig.issuer); - const forwardedHost = authConfig.internalHost || publicIssuer.host; - const forwardedProto = authConfig.internalProto || publicIssuer.protocol.replace(/:$/, ""); - nextHeaders.set("host", forwardedHost); - nextHeaders.set("x-forwarded-host", forwardedHost); - nextHeaders.set("x-forwarded-proto", forwardedProto); - return nextHeaders; -} - async function fetchOidc(rawUrl, options = {}) { return fetch(oidcInternalFetchUrl(rawUrl), { ...options, - headers: oidcFetchHeaders(options.headers), + headers: options.headers, }); } @@ -400,6 +385,31 @@ async function fetchOidcJson(rawUrl, options = {}) { return { response, payload }; } +function publicOidcUrl(rawUrl) { + if (!rawUrl) return ""; + const publicIssuerUrl = new URL(authConfig.issuer); + const sourceUrl = new URL(rawUrl, publicIssuerUrl); + publicIssuerUrl.pathname = sourceUrl.pathname; + publicIssuerUrl.search = sourceUrl.search; + publicIssuerUrl.hash = ""; + return publicIssuerUrl.toString(); +} + +function normalizeDiscovery(payload) { + return { + ...payload, + issuer: authConfig.issuer, + authorization_endpoint: publicOidcUrl(payload.authorization_endpoint), + token_endpoint: publicOidcUrl(payload.token_endpoint), + userinfo_endpoint: publicOidcUrl(payload.userinfo_endpoint), + end_session_endpoint: publicOidcUrl(payload.end_session_endpoint), + introspection_endpoint: publicOidcUrl(payload.introspection_endpoint), + revocation_endpoint: publicOidcUrl(payload.revocation_endpoint), + device_authorization_endpoint: publicOidcUrl(payload.device_authorization_endpoint), + jwks_uri: publicOidcUrl(payload.jwks_uri), + }; +} + async function loadOidcDiscovery() { assertAuthConfigured(); if (discoveryCache) return discoveryCache; @@ -410,7 +420,7 @@ async function loadOidcDiscovery() { if (!response.ok || !payload) { throw new Error(`Не удалось загрузить OIDC discovery: ${response.status}`); } - discoveryCache = payload; + discoveryCache = normalizeDiscovery(payload); return discoveryCache; })().finally(() => { discoveryPromise = null;