mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-26 09:52:11 +03:00
2acc8e84db
* feat(auth): optional OIDC for dashboard admin gate (password remains fallback) - Settings: oidcEnabled + issuer/client/secret/scopes/redirect/allowedSubjects - Public routes: /api/auth/oidc/ prefix (authorize + callback reachable) - isAuthRequired: full OIDC config acts as auth method (gate requires login); partial does not (bootstrap preserved) - New endpoints: - GET /api/auth/oidc/login — IdP redirect (absolute redirect_uri from request + discovery) - GET /api/auth/oidc/callback — code exchange, ID token validation (jose + JWKS), optional sub/email whitelist, mints identical 30d auth_token JWT + cookie as password login, redirects to /dashboard - require-login endpoint now returns oidcEnabled - Login UI: conditional OIDC button when enabled; password form untouched as fallback - Tests: - public-api-routes: OIDC prefixes are public - api-auth: isAuthRequired true with full OIDC (no password); partial OIDC keeps bootstrap semantics No new deps. No changes to proxy, keys, managementPassword, policies, MCP, CLI. Single-admin preserved. * feat(auth): add integration test and fixes for OIDC dashboard login gate - Add comprehensive integration test for /api/auth/oidc/callback (happy path + error paths: invalid_state, subject_not_allowed, not_configured, token_exchange, id_token_invalid, missing_code, server_misconfigured) - Use static test seam (oidcCallbackInternals) for cookie store - Mark setupComplete on first successful OIDC login (bootstrap parity) - Ensure all redirects use absolute URLs (Next.js 16 compatibility) - Verify identical auth_token JWT/cookie behavior as password path - No new dependencies; reuses jose + fetch Password login remains fully supported as fallback. * fix(auth): address all Gemini Code Assist review comments for OIDC dashboard login gate - Add module-level JWKS client cache (Record) + getJwksClient helper - Wrap token exchange fetch + .json() in try/catch with 10s timeout - Add 5s timeout to discovery fetch in both /login and /callback routes - Case-insensitive email comparison in oidcAllowedSubjects whitelist - Make oidc_state cookie 'secure' dynamic based on request protocol (matches auth_token) - Expose clearJwksCache on test seam for isolation All reviewer suggestions applied (adjusted for project rules on Map/Record). Tests: 53/53 pass. * fix(auth): wire OIDC config into updateSettingsSchema + SECURITY_IMPACTING_KEYS + encrypt/decrypt + non-empty subjects guard (address maintainer review) * fix(auth): declare storedPasswordHash + align bootstrap contract for oidcEnabled The security-impacting-keys re-auth gate in PATCH /api/settings assigned to `storedPasswordHash` without ever declaring it (no `let`/`const`), so every PATCH touching a SECURITY_IMPACTING_KEYS field (requireLogin, newPassword, oidcEnabled, oidcClientSecret, the bypass toggles) threw a ReferenceError in strict-mode ESM and fell through to the generic 500 handler. That masked the expected 400/401/200 outcomes in settings-audit and settings-route-password password-migration tests. Declare it as a block-scoped `const` where it's first assigned. Also updates the login-bootstrap-route contract tests: the public /api/settings/require-login GET now legitimately includes `oidcEnabled` in its response (the login page needs it to decide whether to render the OIDC button) — the three closed-shape assertions are extended to expect `oidcEnabled: false`, matching route.ts's existing behavior. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: mikolaj92 <mikolaj92@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouzapw@users.noreply.github.com>
58 lines
3.0 KiB
TypeScript
58 lines
3.0 KiB
TypeScript
import test from "node:test";
|
|
import assert from "node:assert/strict";
|
|
|
|
import { isPublicApiRoute } from "../../src/shared/constants/publicApiRoutes.ts";
|
|
|
|
test("isPublicApiRoute allows public management prefixes", () => {
|
|
assert.equal(isPublicApiRoute("/api/auth/login"), true);
|
|
assert.equal(isPublicApiRoute("/api/v1/chat/completions"), true);
|
|
assert.equal(isPublicApiRoute("/api/oauth/cursor/callback"), true);
|
|
});
|
|
|
|
test("isPublicApiRoute keeps cloud read/auth routes public but not cloud write routes", () => {
|
|
assert.equal(isPublicApiRoute("/api/cloud/auth", "POST"), true);
|
|
assert.equal(isPublicApiRoute("/api/cloud/model/resolve", "POST"), true);
|
|
assert.equal(isPublicApiRoute("/api/cloud/models/alias", "GET"), true);
|
|
|
|
assert.equal(isPublicApiRoute("/api/cloud/credentials/update", "PUT"), false);
|
|
assert.equal(isPublicApiRoute("/api/cloud/models/alias", "PUT"), false);
|
|
assert.equal(isPublicApiRoute("/api/cloud/unknown", "GET"), false);
|
|
});
|
|
|
|
test("isPublicApiRoute allows readonly health and require-login bootstrap routes", () => {
|
|
assert.equal(isPublicApiRoute("/api/health/ping", "GET"), true);
|
|
assert.equal(isPublicApiRoute("/api/health/ping", "HEAD"), true);
|
|
assert.equal(isPublicApiRoute("/api/health/ping", "OPTIONS"), true);
|
|
assert.equal(isPublicApiRoute("/api/health/ping", "DELETE"), false);
|
|
|
|
assert.equal(isPublicApiRoute("/api/monitoring/health", "GET"), true);
|
|
assert.equal(isPublicApiRoute("/api/monitoring/health", "HEAD"), true);
|
|
assert.equal(isPublicApiRoute("/api/monitoring/health", "OPTIONS"), true);
|
|
assert.equal(isPublicApiRoute("/api/monitoring/health", "DELETE"), false);
|
|
|
|
assert.equal(isPublicApiRoute("/api/settings/require-login", "GET"), true);
|
|
assert.equal(isPublicApiRoute("/api/settings/require-login", "HEAD"), true);
|
|
assert.equal(isPublicApiRoute("/api/settings/require-login", "OPTIONS"), true);
|
|
assert.equal(isPublicApiRoute("/api/settings/require-login", "POST"), false);
|
|
});
|
|
|
|
test("isPublicApiRoute rejects non-public management routes", () => {
|
|
assert.equal(isPublicApiRoute("/api/settings"), false);
|
|
assert.equal(isPublicApiRoute("/api/providers"), false);
|
|
});
|
|
|
|
test("isPublicApiRoute allows /api/usage/om-usage (handler enforces its own API key auth)", () => {
|
|
assert.equal(isPublicApiRoute("/api/usage/om-usage"), true);
|
|
assert.equal(isPublicApiRoute("/api/usage/om-usage", "GET"), true);
|
|
assert.equal(isPublicApiRoute("/api/usage/om-usage", "OPTIONS"), true);
|
|
});
|
|
test("isPublicApiRoute allows OIDC dashboard login routes (auth gate replacement)", () => {
|
|
assert.equal(isPublicApiRoute("/api/auth/oidc/login"), true);
|
|
assert.equal(isPublicApiRoute("/api/auth/oidc/callback"), true);
|
|
assert.equal(isPublicApiRoute("/api/auth/oidc/login", "GET"), true);
|
|
assert.equal(isPublicApiRoute("/api/auth/oidc/callback", "GET"), true);
|
|
// The prefix is in PUBLIC_API_ROUTE_PREFIXES, so all methods on the subtree are public (the handlers decide what they accept).
|
|
// This mirrors how /api/auth/login works.
|
|
assert.equal(isPublicApiRoute("/api/auth/oidc/callback", "POST"), true);
|
|
});
|