From 804ce1ae0cbbc66364d3e49ef19a55b656b0f3f8 Mon Sep 17 00:00:00 2001 From: Doxa Maps Date: Mon, 28 Sep 2026 04:32:57 +0000 Subject: [PATCH] Cloud container: OIDC_AUTO_SIGNIN, so the Studio can sign in inside a dashboard frame With it on, oauth2-proxy skips its button page. For a user already signed in to the provider the sign-in is then redirects only, and the provider's no-framing headers never apply, so a framed Studio signs itself in. --- deployment/cloud/README.md | 1 + deployment/cloud/entry.sh | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/deployment/cloud/README.md b/deployment/cloud/README.md index ed205bd31..3319483e1 100644 --- a/deployment/cloud/README.md +++ b/deployment/cloud/README.md @@ -68,6 +68,7 @@ there. Only then does it swap the new build in. | `PB_OIDC_CLIENT_SECRET` (+ `PB_OIDC_CLIENT_ID`, default `dx-maps-pb-dev`) | turns pb-dev into the team backend: laptops use it directly (`DX_PB_URL=https:///pb`), and people sign in to PocketBase through the same OIDC provider, with its own client whose redirect URI is `https:///pb/api/oauth2-redirect`. Only members of `OIDC_ALLOWED_GROUPS` get in (a sign-in hook baked into the image and pinned; the repo's own hooks never run). Password sign-in is off, new collections are superuser-only until a migration opens them, and data never leaves `/data` | | `PRODUCTION_BRANCH` | the branch `/cdn/` is built from (default `production`); the dev server keeps following `BRANCH`. Promote with `git push origin main:production` | | `CDN_AUTOBUILD_MINUTES` | rebuild `/cdn/` by itself once `PRODUCTION_BRANCH` has held a new commit this long (default `2`; `0` = only the admin button) | +| `OIDC_AUTO_SIGNIN` | `1` skips the "Sign in with …" button and goes straight to the provider, so the Studio can sign in inside a frame (a dashboard tile) for anyone already signed in to the provider. Default off | | `SUBDOMAIN_APPS` | publish plugins as their own PUBLIC sites: `host=bundle/profile`, comma-separated, e.g. `research-gallery.example.org=doxa-maps-spa/doxa-maps-spa`. Served from the `/cdn` build by a separate server on `SUBDOMAIN_PORT` (default `5176`) that answers only those hosts and only with published files; point each host's proxy route at that port. No sign-in is skipped anywhere else | | `PUBLIC_API_BASE` | the public API URL written into the build's `runtime-config.js` (e.g. `https:///api-prod`) | | `BUILD_MAX_OLD_SPACE_MB` | Node heap cap for a build (default `1536`) | diff --git a/deployment/cloud/entry.sh b/deployment/cloud/entry.sh index c1845bbe6..208c42cca 100755 --- a/deployment/cloud/entry.sh +++ b/deployment/cloud/entry.sh @@ -79,6 +79,10 @@ if [ -z "${OIDC_ISSUER:-}" ]; then exec bun x vite --config "$CONFIG" fi +# OIDC_AUTO_SIGNIN=1: no "Sign in with …" button page; an unsigned visitor goes straight to the provider. It lets +# the Studio sign in INSIDE a frame (e.g. a dashboard tile): for a user already signed in to the provider the whole +# round trip is redirects, so the provider's own no-framing headers never apply. +AUTO=(); [ "${OIDC_AUTO_SIGNIN:-0}" = 1 ] && AUTO=(--skip-provider-button) # OIDC gate: oauth2-proxy owns the public port; Vite listens on localhost behind it, so the Plugin # Studio, every map and the hot-reload websocket are all behind the same sign-in. : "${OIDC_CLIENT_ID:?}" "${OIDC_CLIENT_SECRET:?}" "${OIDC_REDIRECT_URL:?}" @@ -142,6 +146,7 @@ oauth2-proxy \ "${ALLOW[@]}" \ --email-domain='*' \ --provider-display-name="${OIDC_DISPLAY_NAME:-your identity provider}" \ + "${AUTO[@]}" \ --upstream=http://127.0.0.1:5174/ \ --upstream=http://127.0.0.1:5175/cdn/ \ --upstream=http://127.0.0.1:5175/api-prod/ \