SILVER
/
DC_CMS
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Use direct Authentik origin for CMS OIDC

This commit is contained in:
DCCONSTRUCTIONS 2026-07-06 10:09:46 +03:00
parent a836d3639b
commit 5004627476
4 changed files with 30 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
infra/.env.example
View File

@ -39,9 +39,7 @@ CMS_BOOTSTRAP_ADMIN_NAME=DCTOUCH CMS Admin
CMS_AUTH_ENABLED=true
CMS_BASE_URL=http://cms.local.nodedc:8210
CMS_OIDC_ISSUER=http://cms-auth.local.nodedc:8210/application/o/dc-cms/
CMS_OIDC_INTERNAL_BASE_URL=http://reverse-proxy
CMS_OIDC_INTERNAL_HOST=cms-auth.local.nodedc
CMS_OIDC_INTERNAL_PROTO=http
CMS_OIDC_INTERNAL_BASE_URL=http://authentik-server:9000
CMS_OIDC_CLIENT_ID=dc-cms
CMS_OIDC_CLIENT_SECRET=replace-with-random-secret
CMS_OIDC_REDIRECT_URI=http://cms.local.nodedc:8210/auth/callback

4
infra/.env.synology.example
View File

@ -40,9 +40,7 @@ CMS_BOOTSTRAP_ADMIN_NAME=DCTOUCH CMS Admin
CMS_AUTH_ENABLED=true
CMS_BASE_URL=https://cms.dcserve.ru
CMS_OIDC_ISSUER=https://auth.dcserve.ru/application/o/dc-cms/
CMS_OIDC_INTERNAL_BASE_URL=http://reverse-proxy
CMS_OIDC_INTERNAL_HOST=auth.dcserve.ru
CMS_OIDC_INTERNAL_PROTO=https
CMS_OIDC_INTERNAL_BASE_URL=http://authentik-server:9000
CMS_OIDC_CLIENT_ID=dc-cms
CMS_OIDC_CLIENT_SECRET=replace-with-random-secret
CMS_OIDC_REDIRECT_URI=https://cms.dcserve.ru/auth/callback

4
infra/docker-compose.yml
View File

@ -38,9 +38,7 @@ services:
SITE_ROOT: /sites/nodedc
CMS_AUTH_ENABLED: ${CMS_AUTH_ENABLED:-true}
CMS_OIDC_ISSUER: ${CMS_OIDC_ISSUER:?cms oidc issuer required}
CMS_OIDC_INTERNAL_BASE_URL: ${CMS_OIDC_INTERNAL_BASE_URL:-}
CMS_OIDC_INTERNAL_HOST: ${CMS_OIDC_INTERNAL_HOST:-}
CMS_OIDC_INTERNAL_PROTO: ${CMS_OIDC_INTERNAL_PROTO:-}
CMS_OIDC_INTERNAL_BASE_URL: ${CMS_OIDC_INTERNAL_BASE_URL:-http://authentik-server:9000}
CMS_OIDC_CLIENT_ID: ${CMS_OIDC_CLIENT_ID:?cms oidc client id required}
CMS_OIDC_CLIENT_SECRET: ${CMS_OIDC_CLIENT_SECRET:?cms oidc client secret required}
CMS_OIDC_REDIRECT_URI: ${CMS_OIDC_REDIRECT_URI:?cms oidc redirect uri required}

44
server/admin-server.mjs
View File

@ -211,8 +211,6 @@ const authConfig = {
baseUrl: String(process.env.CMS_BASE_URL || "").trim(),
issuer: trailingSlashUrl(process.env.CMS_OIDC_ISSUER),
internalBaseUrl: String(process.env.CMS_OIDC_INTERNAL_BASE_URL || "").trim(),
internalHost: String(process.env.CMS_OIDC_INTERNAL_HOST || "").trim(),
internalProto: String(process.env.CMS_OIDC_INTERNAL_PROTO || "").trim(),
clientId: String(process.env.CMS_OIDC_CLIENT_ID || "").trim(),
clientSecret: String(process.env.CMS_OIDC_CLIENT_SECRET || "").trim(),
redirectUri: String(process.env.CMS_OIDC_REDIRECT_URI || "").trim(),
@ -368,23 +366,10 @@ function oidcInternalFetchUrl(rawUrl) {
return internalBaseUrl;
}
function oidcFetchHeaders(headers) {
const nextHeaders = new Headers(headers || {});
if (!authConfig.internalBaseUrl) return nextHeaders;
const publicIssuer = new URL(authConfig.issuer);
const forwardedHost = authConfig.internalHost || publicIssuer.host;
const forwardedProto = authConfig.internalProto || publicIssuer.protocol.replace(/:$/, "");
nextHeaders.set("host", forwardedHost);
nextHeaders.set("x-forwarded-host", forwardedHost);
nextHeaders.set("x-forwarded-proto", forwardedProto);
return nextHeaders;
}
async function fetchOidc(rawUrl, options = {}) {
return fetch(oidcInternalFetchUrl(rawUrl), {
...options,
headers: oidcFetchHeaders(options.headers),
headers: options.headers,
});
}
@ -400,6 +385,31 @@ async function fetchOidcJson(rawUrl, options = {}) {
return { response, payload };
}
function publicOidcUrl(rawUrl) {
if (!rawUrl) return "";
const publicIssuerUrl = new URL(authConfig.issuer);
const sourceUrl = new URL(rawUrl, publicIssuerUrl);
publicIssuerUrl.pathname = sourceUrl.pathname;
publicIssuerUrl.search = sourceUrl.search;
publicIssuerUrl.hash = "";
return publicIssuerUrl.toString();
}
function normalizeDiscovery(payload) {
return {
...payload,
issuer: authConfig.issuer,
authorization_endpoint: publicOidcUrl(payload.authorization_endpoint),
token_endpoint: publicOidcUrl(payload.token_endpoint),
userinfo_endpoint: publicOidcUrl(payload.userinfo_endpoint),
end_session_endpoint: publicOidcUrl(payload.end_session_endpoint),
introspection_endpoint: publicOidcUrl(payload.introspection_endpoint),
revocation_endpoint: publicOidcUrl(payload.revocation_endpoint),
device_authorization_endpoint: publicOidcUrl(payload.device_authorization_endpoint),
jwks_uri: publicOidcUrl(payload.jwks_uri),
};
}
async function loadOidcDiscovery() {
assertAuthConfigured();
if (discoveryCache) return discoveryCache;
@ -410,7 +420,7 @@ async function loadOidcDiscovery() {
if (!response.ok || !payload) {
throw new Error(`Не удалось загрузить OIDC discovery: ${response.status}`);
}
discoveryCache = payload;
discoveryCache = normalizeDiscovery(payload);
return discoveryCache;
})().finally(() => {
discoveryPromise = null;