rsp2k/headplane
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

feat: support oidc client_secret_path with env interpolation

Browse source
This commit is contained in:
Aarnav Tale 2025-03-11 18:15:56 -04:00
parent 9c8a2c0120
commit 01f432cedc
No known key found for this signature in database
5 changed files with 116 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

30
server/context/loader.ts
View file

@ -3,7 +3,7 @@ import { env } from 'node:process';
import { type } from 'arktype';
import dotenv from 'dotenv';
import { parseDocument } from 'yaml';
import { testOidc } from '~/utils/oidc';
import { getOidcSecret, testOidc } from '~/utils/oidc';
import log, { hpServer_loadLogger } from '~server/utils/log';
import mutex from '~server/utils/mutex';
import { HeadplaneConfig, coalesceConfig, validateConfig } from './parser';
@ -20,6 +20,11 @@ declare namespace globalThis {
config_strict?: boolean;
};
let __oidc_context: {
valid: boolean;
secret: string;
};
let __integration_context: HeadplaneConfig['integration'];
}
@ -113,8 +118,27 @@ export async function hp_loadConfig() {
process.exit(1);
}
if (config.oidc?.strict_validation) {
testOidc(config.oidc);
// OIDC Related Checks
if (config.oidc) {
if (!config.oidc.client_secret && !config.oidc.client_secret_path) {
log.error('CFGX', 'OIDC configuration is missing a secret, disabling');
log.error(
'CFGX',
'Please specify either `oidc.client_secret` or `oidc.client_secret_path`',
);
}
if (config.oidc?.strict_validation) {
const result = await testOidc(config.oidc);
if (!result) {
log.error('CFGX', 'OIDC configuration failed validation, disabling');
}
globalThis.__oidc_context = {
valid: result,
secret: getOidcSecret() ?? '',
};
}
}
globalThis.__cookie_context = {

3
server/context/parser.ts
View file

@ -24,7 +24,8 @@ const serverConfig = type({
const oidcConfig = type({
issuer: 'string.url',
client_id: 'string',
client_secret: 'string',
client_secret: 'string?',
client_secret_path: 'string?',
token_endpoint_auth_method:
'"client_secret_basic" | "client_secret_post" | "client_secret_jwt"',
redirect_uri: 'string.url?',