From 6df2da9c99deec02140a53b078a15ed2e581163b Mon Sep 17 00:00:00 2001 From: Doxa Maps Date: Mon, 28 Sep 2026 04:32:57 +0000 Subject: [PATCH] Cloud container: OIDC_AUTO_SIGNIN, so the Studio can sign in inside a dashboard frame With it on, oauth2-proxy skips its button page. For a user already signed in to the provider the sign-in is then redirects only, and the provider's no-framing headers never apply, so a framed Studio signs itself in. UNVERIFIED: never run live in a framed dashboard (written 2026-09-28 04:32Z, not landed until the 14:38Z merge-all order). Checked only statically: bash -n passes, and the argument switch yields --skip-provider-button for 1 and nothing for unset or 0 under set -u. Replayed onto development: AUTO is now defined inside the OIDC gate block (ACCESS != public), next to the ALLOW list, and passed before --upstream="$ROOT". Default off, so no running container changes. --- deployment/cloud/README.md | 1 + deployment/cloud/entry.sh | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/deployment/cloud/README.md b/deployment/cloud/README.md index 643234ae1..69d7b3d0d 100644 --- a/deployment/cloud/README.md +++ b/deployment/cloud/README.md @@ -113,6 +113,7 @@ there. Only then does it swap the new build in. | `PRODUCTION_BRANCH` | the branch `/cdn/` is built from (default `main`); the dev server keeps following `BRANCH`. It moves only on a publish | | `EMBED_BASE_URL` | the address the published `dx-maps/` folder sits under, so the manifests' copy-paste snippets are absolute: `https:///cdn` (it is served at `/cdn/dx-maps/`), or a research subdomain's `https://research.` (served at `/dx-maps/`). Unset, the snippets stay relative (`./…`) and other sites can't paste them | | `CDN_AUTOBUILD_MINUTES` | rebuild `/cdn/` by itself once `PRODUCTION_BRANCH` has held a new commit this long (default `2`; `0` = only the admin button) | +| `OIDC_AUTO_SIGNIN` | `1` skips the "Sign in with …" button and goes straight to the provider, so the Studio can sign in inside a frame (a dashboard tile) for anyone already signed in to the provider. Default off | | `SUBDOMAIN_APPS` | publish plugins as their own PUBLIC sites: `host=bundle/profile`, comma-separated, e.g. `research-gallery.example.org=doxa-maps-spa/doxa-maps-spa`. Served from the `/cdn` build by a separate server on `SUBDOMAIN_PORT` (default `5176`) that answers only those hosts and only with published files; point each host's proxy route at that port. No sign-in is skipped anywhere else | | `PUBLIC_API_BASE` | the public API URL written into the build's `runtime-config.js` (e.g. `https:///api-prod`) | | `BUILD_MAX_OLD_SPACE_MB` | Node heap cap for a build (default `1536`) | diff --git a/deployment/cloud/entry.sh b/deployment/cloud/entry.sh index 2b0aaef05..92dd43aa1 100755 --- a/deployment/cloud/entry.sh +++ b/deployment/cloud/entry.sh @@ -118,6 +118,10 @@ if [ -z "${OIDC_ISSUER:-}" ] && [ "${ACCESS:-}" != public ]; then fi if [ "${ACCESS:-}" != public ]; then + # OIDC_AUTO_SIGNIN=1: no "Sign in with …" button page; an unsigned visitor goes straight to the provider. It lets + # the Studio sign in INSIDE a frame (e.g. a dashboard tile): for a user already signed in to the provider the whole + # round trip is redirects, so the provider's own no-framing headers never apply. + AUTO=(); [ "${OIDC_AUTO_SIGNIN:-0}" = 1 ] && AUTO=(--skip-provider-button) # OIDC gate: oauth2-proxy owns the public port; Vite listens on localhost behind it, so the Plugin # Studio, every map and the hot-reload websocket are all behind the same sign-in. : "${OIDC_CLIENT_ID:?}" "${OIDC_CLIENT_SECRET:?}" "${OIDC_REDIRECT_URL:?}" @@ -212,6 +216,7 @@ oauth2-proxy \ "${ALLOW[@]}" \ --email-domain='*' \ --provider-display-name="${OIDC_DISPLAY_NAME:-your identity provider}" \ + "${AUTO[@]}" \ --upstream="$ROOT" \ --upstream=http://127.0.0.1:5175/cdn/ \ --upstream=http://127.0.0.1:5175/api-prod/ \