SILVER/DC_CMS
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Use direct Authentik origin for CMS OIDC

Browse Source
This commit is contained in:
DCCONSTRUCTIONS
2026-07-06 10:09:46 +03:00
parent a836d3639b
commit 5004627476
4 changed files with 30 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/admin-server.mjs
+27 -17
View File
@@ -211,8 +211,6 @@ const authConfig = {
baseUrl: String(process.env.CMS_BASE_URL || "").trim(),
issuer: trailingSlashUrl(process.env.CMS_OIDC_ISSUER),
internalBaseUrl: String(process.env.CMS_OIDC_INTERNAL_BASE_URL || "").trim(),
internalHost: String(process.env.CMS_OIDC_INTERNAL_HOST || "").trim(),
internalProto: String(process.env.CMS_OIDC_INTERNAL_PROTO || "").trim(),
clientId: String(process.env.CMS_OIDC_CLIENT_ID || "").trim(),
clientSecret: String(process.env.CMS_OIDC_CLIENT_SECRET || "").trim(),
redirectUri: String(process.env.CMS_OIDC_REDIRECT_URI || "").trim(),
@@ -368,23 +366,10 @@ function oidcInternalFetchUrl(rawUrl) {
return internalBaseUrl;
}
function oidcFetchHeaders(headers) {
const nextHeaders = new Headers(headers || {});
if (!authConfig.internalBaseUrl) return nextHeaders;
const publicIssuer = new URL(authConfig.issuer);
const forwardedHost = authConfig.internalHost || publicIssuer.host;
const forwardedProto = authConfig.internalProto || publicIssuer.protocol.replace(/:$/, "");
nextHeaders.set("host", forwardedHost);
nextHeaders.set("x-forwarded-host", forwardedHost);
nextHeaders.set("x-forwarded-proto", forwardedProto);
return nextHeaders;
}
async function fetchOidc(rawUrl, options = {}) {
return fetch(oidcInternalFetchUrl(rawUrl), {
...options,
headers: oidcFetchHeaders(options.headers),
headers: options.headers,
});
}
@@ -400,6 +385,31 @@ async function fetchOidcJson(rawUrl, options = {}) {
return { response, payload };
}
function publicOidcUrl(rawUrl) {
if (!rawUrl) return "";
const publicIssuerUrl = new URL(authConfig.issuer);
const sourceUrl = new URL(rawUrl, publicIssuerUrl);
publicIssuerUrl.pathname = sourceUrl.pathname;
publicIssuerUrl.search = sourceUrl.search;
publicIssuerUrl.hash = "";
return publicIssuerUrl.toString();
}
function normalizeDiscovery(payload) {
return {
...payload,
issuer: authConfig.issuer,
authorization_endpoint: publicOidcUrl(payload.authorization_endpoint),
token_endpoint: publicOidcUrl(payload.token_endpoint),
userinfo_endpoint: publicOidcUrl(payload.userinfo_endpoint),
end_session_endpoint: publicOidcUrl(payload.end_session_endpoint),
introspection_endpoint: publicOidcUrl(payload.introspection_endpoint),
revocation_endpoint: publicOidcUrl(payload.revocation_endpoint),
device_authorization_endpoint: publicOidcUrl(payload.device_authorization_endpoint),
jwks_uri: publicOidcUrl(payload.jwks_uri),
};
}
async function loadOidcDiscovery() {
assertAuthConfigured();
if (discoveryCache) return discoveryCache;
@@ -410,7 +420,7 @@ async function loadOidcDiscovery() {
if (!response.ok || !payload) {
throw new Error(`Не удалось загрузить OIDC discovery: ${response.status}`);
}
discoveryCache = payload;
discoveryCache = normalizeDiscovery(payload);
return discoveryCache;
})().finally(() => {
discoveryPromise = null;