mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

feat(server): activate projected authentication safely

Browse Source
This commit is contained in:
User
2026-08-22 01:01:36 +02:00
parent 903c0b4de5
commit 3d9a9f0675
32 changed files with 1837 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/config.ts
+22 -3
View File
@@ -5,6 +5,7 @@ import {
type AuthenticationConfigProvider,
type AuthMode,
} from "./auth/config.js";
import { createProjectedAuthenticationConfigProvider } from "./auth/runtime-projection.js";
import type { WorkspaceRegistryConfig } from "./workspaces/types.js";
export interface AppConfig {
@@ -176,13 +177,31 @@ function positiveDimension(value: string | undefined, fallback: number): number
}
export function loadConfig(env: Record<string, string | undefined>): AppConfig {
const authConfigFile = absoluteAuthPath(env.THT_AUTH_CONFIG_FILE ?? "/run/thothii-auth/auth.yaml", "file");
const defaultAuthConfigFile = "/run/thothii-auth/auth.yaml";
const authConfigFile = absoluteAuthPath(env.THT_AUTH_CONFIG_FILE ?? defaultAuthConfigFile, "file");
const authStateRoot = absoluteAuthPath(env.THT_AUTH_STATE_ROOT ?? "/data/auth", "state root");
const hasAuthenticationConfig = authConfigFileExists(authConfigFile);
const runtimeProjectionRoot = env.THT_AUTH_RUNTIME_PROJECTION_ROOT;
let hasAuthenticationConfig = false;
let authentication: AuthenticationConfigProvider | undefined;
if (runtimeProjectionRoot !== undefined) {
let projectionRoot: string;
try {
projectionRoot = absoluteAuthPath(runtimeProjectionRoot, "runtime projection root");
} catch {
throw new Error("authentication configuration is invalid");
}
if (env.THT_AUTH_CONFIG_FILE !== undefined && env.THT_AUTH_CONFIG_FILE !== defaultAuthConfigFile) {
throw new Error("authentication configuration is invalid");
}
authentication = createProjectedAuthenticationConfigProvider(projectionRoot);
hasAuthenticationConfig = true;
} else {
hasAuthenticationConfig = authConfigFileExists(authConfigFile);
authentication = hasAuthenticationConfig ? createAuthenticationConfigProvider(authConfigFile) : undefined;
}
if (hasAuthenticationConfig && env.AUTH_MODE !== undefined) {
throw new Error("authentication configuration and AUTH_MODE cannot both be set");
}
const authentication = hasAuthenticationConfig ? createAuthenticationConfigProvider(authConfigFile) : undefined;
let authMode: AuthMode;
if (authentication) {
authMode = authentication.current().value.mode;