luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(19): WR-02+WR-04 centralize OIDC config (env-or-app_config) and discover auth endpoint

Browse Source
This commit is contained in:
Lucas Berger
2026-06-17 20:26:47 -04:00
parent c4d8d76a4c
commit 322929aebe
2 changed files with 110 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/routes/me.ts
+19 -15
View File
@@ -41,6 +41,7 @@ import {
CredentialValidationError,
} from '../broker/credentialSync.js';
import { hashPassword, verifyPassword } from '../auth/localCredentials.js';
import { resolveOidcConfig, discoverAuthorizationEndpoint } from '../auth/oidcConfig.js';
// Side-effect import: brings in the ContextVariableMap augmentation for c.get('user')
import '../auth/devBypass.js';
@@ -324,22 +325,25 @@ meRouter.post('/link-oidc', async (c) => {
'HS256',
);
// Build the OIDC authorization URL if OIDC is configured (else return null — PWA disables button)
const issuer = process.env.OIDC_ISSUER ?? null;
const clientId = process.env.OIDC_CLIENT_ID ?? null;
const redirectUri = process.env.OIDC_REDIRECT_URI ?? null;
// Build the OIDC authorization URL if OIDC is configured (else return null — PWA disables button).
// WR-04: resolve issuer/clientId/redirectUri from env-OR-app_config (single source of truth,
// consistent with /api/auth/mode and the OIDC fallback middleware) so a wizard-configured
// instance does not report oidcEnabled:true while returning authorizationUrl:null here.
// WR-02: discover the authorization_endpoint from the provider's discovery document instead
// of hardcoding Authelia's /api/oidc/authorization path.
let authorizationUrl: string | null = null;
if (issuer && clientId && redirectUri) {
// Construct the authorization URL. plan 19-03 will handle the full PKCE flow;
// for now encode the signed state so the callback can read linkUserId.
const url = new URL(`${issuer.replace(/\/$/, '')}/api/oidc/authorization`);
url.searchParams.set('response_type', 'code');
url.searchParams.set('client_id', clientId);
url.searchParams.set('redirect_uri', redirectUri);
url.searchParams.set('scope', 'openid profile email');
url.searchParams.set('state', signedState);
authorizationUrl = url.toString();
const oidc = await resolveOidcConfig();
if (oidc) {
const authEndpoint = await discoverAuthorizationEndpoint(oidc.issuer);
if (authEndpoint) {
const url = new URL(authEndpoint);
url.searchParams.set('response_type', 'code');
url.searchParams.set('client_id', oidc.clientId);
url.searchParams.set('redirect_uri', oidc.redirectUri);
url.searchParams.set('scope', 'openid profile email');
url.searchParams.set('state', signedState);
authorizationUrl = url.toString();
}
}
return c.json({ signedState, authorizationUrl }, 200);