fix(platform): isolate authentik admin styling

2026-05-25 01:08:50 +03:00
parent e9def6672c
commit c1ac8b1a10
16 changed files with 670 additions and 61 deletions
@@ -0,0 +1,113 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+DOCKER_BIN="${DOCKER_BIN:-/usr/local/bin/docker}"
+PLATFORM_DIR="${PLATFORM_DIR:-/volume1/docker/nodedc-platform/platform}"
+LAUNCHER_SOURCE_DIR="${LAUNCHER_SOURCE_DIR:-/volume1/docker/nodedc-platform/launcher/source}"
+ENV_FILE="${ENV_FILE:-${PLATFORM_DIR}/.env.synology}"
+COMPOSE_FILE="${COMPOSE_FILE:-${PLATFORM_DIR}/docker-compose.platform-http.yml}"
+
+if [[ ! -x "${DOCKER_BIN}" ]]; then
+  DOCKER_BIN="$(command -v docker)"
+fi
+
+cd "${PLATFORM_DIR}"
+
+echo "== storage permissions =="
+mkdir -p ../launcher/server-storage ../launcher/uploads
+chown -R 1000:1000 ../launcher/server-storage ../launcher/uploads
+chmod -R u+rwX,g+rwX ../launcher/server-storage ../launcher/uploads
+
+echo "== launcher image build =="
+cd "${LAUNCHER_SOURCE_DIR}"
+"${DOCKER_BIN}" build --no-cache -t nodedc/launcher:local .
+
+echo "== platform services recreate =="
+cd "${PLATFORM_DIR}"
+"${DOCKER_BIN}" compose \
+  --env-file "${ENV_FILE}" \
+  -f "${COMPOSE_FILE}" \
+  up -d --force-recreate --no-deps reverse-proxy authentik-server authentik-worker launcher
+
+echo "== clear authentik global brand css =="
+DOCKER_BIN="${DOCKER_BIN}" bash "${PLATFORM_DIR}/clear-authentik-brand-css.sh"
+
+echo "== launcher storage check =="
+"${DOCKER_BIN}" exec nodedc-platform-launcher-1 sh -lc \
+  'touch /app/server/storage/.write-test /app/server/storage/uploads/.write-test && rm /app/server/storage/.write-test /app/server/storage/uploads/.write-test && echo storage-ok'
+
+echo "== launcher -> authentik api check =="
+"${DOCKER_BIN}" exec nodedc-platform-launcher-1 sh -lc '
+  echo "$NODEDC_AUTHENTIK_BASE_URL"
+  getent hosts nodedc-platform-authentik-server
+  for attempt in 1 2 3 4 5 6 7 8 9 10; do
+    if wget -qSO- \
+      --header "Authorization: Bearer $NODEDC_AUTHENTIK_SERVICE_TOKEN" \
+      "$NODEDC_AUTHENTIK_BASE_URL/api/v3/core/groups/?search=nodedc_admin" \
+      >/tmp/authentik-api-check.json \
+      2>/tmp/authentik-api-check.headers; then
+      head -n 25 /tmp/authentik-api-check.headers
+      exit 0
+    fi
+    head -n 25 /tmp/authentik-api-check.headers || true
+    echo "authentik-api-not-ready attempt=$attempt"
+    sleep 10
+  done
+  exit 1
+'
+
+echo "== auth flow check =="
+auth_flow=""
+for attempt in 1 2 3 4 5 6 7 8 9 10; do
+  if auth_flow="$(
+    curl -k -fsS --compressed https://id.nodedc.ru/if/flow/default-authentication-flow/
+  )"; then
+    break
+  fi
+  echo "auth-flow-not-ready attempt=${attempt}"
+  sleep 10
+done
+printf '%s' "$auth_flow" \
+  | grep -aE 'syncFormFieldsBeforeSubmit|branding_custom_css = ""|Запросить доступ'
+
+echo "== public admin closed check =="
+id_admin_status="$(
+  curl -k -sS -o /dev/null -w '%{http_code}' https://id.nodedc.ru/if/admin/
+)"
+if [[ "$id_admin_status" != "404" ]]; then
+  echo "public id admin is not closed: status=${id_admin_status}"
+  exit 1
+fi
+echo "public-id-admin-closed-ok"
+
+echo "== technical admin css check =="
+auth_admin_page="$(
+  curl -k -fsS --compressed -H 'Host: auth-admin.nas.nodedc' http://127.0.0.1:18080/if/admin/
+)"
+printf '%s' "$auth_admin_page" \
+  | grep -aE '<style data-id="brand-css"></style>|authentikBrand.branding_custom_css = ""'
+
+auth_admin_flow="$(
+  curl -k -fsS --compressed -H 'Host: auth-admin.nas.nodedc' http://127.0.0.1:18080/if/flow/default-authentication-flow/
+)"
+if printf '%s' "$auth_admin_flow" | grep -aq '<style data-id="nodedc-auth-login-css">'; then
+  echo "admin host still has NODE.DC auth CSS"
+  exit 1
+fi
+echo "auth-admin-css-ok"
+
+echo "== launcher bundle check =="
+launcher_asset="$(
+  curl -k -fsS --compressed -H 'Accept: text/html' https://hub.nodedc.ru/ \
+    | grep -aoE 'index-[A-Za-z0-9_-]+\.js' \
+    | head -n 1
+)"
+test -n "$launcher_asset"
+if curl -k -fsS --compressed "https://hub.nodedc.ru/assets/${launcher_asset}" \
+  | grep -aq 'Заявка ожидает подтверждения'; then
+  echo "old pending gate still present"
+  exit 1
+fi
+echo "launcher-pending-gate-ok"
+
+echo "runtime-apply-ok"