Use direct Authentik origin for CMS OIDC

infra/.env.example

@@ -39,9 +39,7 @@ CMS_BOOTSTRAP_ADMIN_NAME=DCTOUCH CMS Admin
 CMS_AUTH_ENABLED=true
 CMS_BASE_URL=http://cms.local.nodedc:8210
 CMS_OIDC_ISSUER=http://cms-auth.local.nodedc:8210/application/o/dc-cms/
-CMS_OIDC_INTERNAL_BASE_URL=http://reverse-proxy
+CMS_OIDC_INTERNAL_BASE_URL=http://authentik-server:9000
-CMS_OIDC_INTERNAL_HOST=cms-auth.local.nodedc
-CMS_OIDC_INTERNAL_PROTO=http
 CMS_OIDC_CLIENT_ID=dc-cms
 CMS_OIDC_CLIENT_SECRET=replace-with-random-secret
 CMS_OIDC_REDIRECT_URI=http://cms.local.nodedc:8210/auth/callback

infra/.env.synology.example

@@ -40,9 +40,7 @@ CMS_BOOTSTRAP_ADMIN_NAME=DCTOUCH CMS Admin
 CMS_AUTH_ENABLED=true
 CMS_BASE_URL=https://cms.dcserve.ru
 CMS_OIDC_ISSUER=https://auth.dcserve.ru/application/o/dc-cms/
-CMS_OIDC_INTERNAL_BASE_URL=http://reverse-proxy
+CMS_OIDC_INTERNAL_BASE_URL=http://authentik-server:9000
-CMS_OIDC_INTERNAL_HOST=auth.dcserve.ru
-CMS_OIDC_INTERNAL_PROTO=https
 CMS_OIDC_CLIENT_ID=dc-cms
 CMS_OIDC_CLIENT_SECRET=replace-with-random-secret
 CMS_OIDC_REDIRECT_URI=https://cms.dcserve.ru/auth/callback

infra/docker-compose.yml

@@ -38,9 +38,7 @@ services:
       SITE_ROOT: /sites/nodedc
       CMS_AUTH_ENABLED: ${CMS_AUTH_ENABLED:-true}
       CMS_OIDC_ISSUER: ${CMS_OIDC_ISSUER:?cms oidc issuer required}
-      CMS_OIDC_INTERNAL_BASE_URL: ${CMS_OIDC_INTERNAL_BASE_URL:-}
+      CMS_OIDC_INTERNAL_BASE_URL: ${CMS_OIDC_INTERNAL_BASE_URL:-http://authentik-server:9000}
-      CMS_OIDC_INTERNAL_HOST: ${CMS_OIDC_INTERNAL_HOST:-}
-      CMS_OIDC_INTERNAL_PROTO: ${CMS_OIDC_INTERNAL_PROTO:-}
       CMS_OIDC_CLIENT_ID: ${CMS_OIDC_CLIENT_ID:?cms oidc client id required}
       CMS_OIDC_CLIENT_SECRET: ${CMS_OIDC_CLIENT_SECRET:?cms oidc client secret required}
       CMS_OIDC_REDIRECT_URI: ${CMS_OIDC_REDIRECT_URI:?cms oidc redirect uri required}

server/admin-server.mjs

@@ -211,8 +211,6 @@ const authConfig = {
   baseUrl: String(process.env.CMS_BASE_URL || "").trim(),
   issuer: trailingSlashUrl(process.env.CMS_OIDC_ISSUER),
   internalBaseUrl: String(process.env.CMS_OIDC_INTERNAL_BASE_URL || "").trim(),
-  internalHost: String(process.env.CMS_OIDC_INTERNAL_HOST || "").trim(),
-  internalProto: String(process.env.CMS_OIDC_INTERNAL_PROTO || "").trim(),
   clientId: String(process.env.CMS_OIDC_CLIENT_ID || "").trim(),
   clientSecret: String(process.env.CMS_OIDC_CLIENT_SECRET || "").trim(),
   redirectUri: String(process.env.CMS_OIDC_REDIRECT_URI || "").trim(),
@@ -368,23 +366,10 @@ function oidcInternalFetchUrl(rawUrl) {
   return internalBaseUrl;
 }
 
-function oidcFetchHeaders(headers) {
-  const nextHeaders = new Headers(headers || {});
-  if (!authConfig.internalBaseUrl) return nextHeaders;
-
-  const publicIssuer = new URL(authConfig.issuer);
-  const forwardedHost = authConfig.internalHost || publicIssuer.host;
-  const forwardedProto = authConfig.internalProto || publicIssuer.protocol.replace(/:$/, "");
-  nextHeaders.set("host", forwardedHost);
-  nextHeaders.set("x-forwarded-host", forwardedHost);
-  nextHeaders.set("x-forwarded-proto", forwardedProto);
-  return nextHeaders;
-}
-
 async function fetchOidc(rawUrl, options = {}) {
   return fetch(oidcInternalFetchUrl(rawUrl), {
     ...options,
-    headers: oidcFetchHeaders(options.headers),
+    headers: options.headers,
   });
 }
 
@@ -400,6 +385,31 @@ async function fetchOidcJson(rawUrl, options = {}) {
   return { response, payload };
 }
 
+function publicOidcUrl(rawUrl) {
+  if (!rawUrl) return "";
+  const publicIssuerUrl = new URL(authConfig.issuer);
+  const sourceUrl = new URL(rawUrl, publicIssuerUrl);
+  publicIssuerUrl.pathname = sourceUrl.pathname;
+  publicIssuerUrl.search = sourceUrl.search;
+  publicIssuerUrl.hash = "";
+  return publicIssuerUrl.toString();
+}
+
+function normalizeDiscovery(payload) {
+  return {
+    ...payload,
+    issuer: authConfig.issuer,
+    authorization_endpoint: publicOidcUrl(payload.authorization_endpoint),
+    token_endpoint: publicOidcUrl(payload.token_endpoint),
+    userinfo_endpoint: publicOidcUrl(payload.userinfo_endpoint),
+    end_session_endpoint: publicOidcUrl(payload.end_session_endpoint),
+    introspection_endpoint: publicOidcUrl(payload.introspection_endpoint),
+    revocation_endpoint: publicOidcUrl(payload.revocation_endpoint),
+    device_authorization_endpoint: publicOidcUrl(payload.device_authorization_endpoint),
+    jwks_uri: publicOidcUrl(payload.jwks_uri),
+  };
+}
+
 async function loadOidcDiscovery() {
   assertAuthConfigured();
   if (discoveryCache) return discoveryCache;
@@ -410,7 +420,7 @@ async function loadOidcDiscovery() {
       if (!response.ok || !payload) {
         throw new Error(`Не удалось загрузить OIDC discovery: ${response.status}`);
       }
-      discoveryCache = payload;
+      discoveryCache = normalizeDiscovery(payload);
       return discoveryCache;
     })().finally(() => {
       discoveryPromise = null;