71d4c1817c
Laptops reach pb-dev's API without the site sign-in; PocketBase signs people in itself through the same OIDC provider (its own client), members of OIDC_ALLOWED_GROUPS only, password sign-in off. The group check is ONE hook baked into the image and pinned by SHA-256; hooks from the pulled repo still never run. The dashboard, _superusers and system collections stay behind the site sign-in for admins. It fails closed: without the baked gate or a working OIDC setup, /pb/ stays behind the site sign-in as before.
41 lines
2.1 KiB
JavaScript
41 lines
2.1 KiB
JavaScript
// pb-oidc.mjs — make the team PocketBase (pb-dev) sign people in through the team's OIDC provider.
|
|
// Run by entry.sh at every start, against PocketBase on localhost, as the superuser (env, never printed).
|
|
// users: sign-in ONLY through OIDC (password sign-in off); the group check is the image's baked hook.
|
|
// The client secret comes from the environment; nothing here, or in PocketBase's data, is in git.
|
|
const env = process.env
|
|
const PB = env.PB_LOCAL_URL || 'http://127.0.0.1:8090'
|
|
const need = (k) => env[k] || (console.error(`[pb-oidc] ${k} is not set: team sign-in NOT configured`), process.exit(1))
|
|
|
|
const call = async (method, path, body, token) => {
|
|
const r = await fetch(PB + path, { method, headers: { 'Content-Type': 'application/json', ...(token ? { Authorization: token } : {}) }, body: body && JSON.stringify(body) })
|
|
const j = await r.json().catch(() => ({}))
|
|
if (!r.ok) throw new Error(`${method} ${path}: ${r.status} ${j.message || ''}`)
|
|
return j
|
|
}
|
|
|
|
const issuer = need('OIDC_ISSUER').replace(/\/$/, '')
|
|
const disc = env.PB_OIDC_DISCOVERY_JSON ? JSON.parse(env.PB_OIDC_DISCOVERY_JSON)
|
|
: await (await fetch(issuer + '/.well-known/openid-configuration')).json()
|
|
const { token } = await call('POST', '/api/collections/_superusers/auth-with-password',
|
|
{ identity: need('PB_SUPERUSER_EMAIL'), password: need('PB_SUPERUSER_PASSWORD') })
|
|
|
|
await call('PATCH', '/api/collections/users', {
|
|
passwordAuth: { enabled: false, identityFields: ['email'] },
|
|
oauth2: {
|
|
enabled: true,
|
|
mappedFields: { id: '', name: 'name', username: '', avatarURL: '' },
|
|
providers: [{
|
|
name: 'oidc',
|
|
displayName: env.OIDC_DISPLAY_NAME || 'Team sign-in',
|
|
clientId: env.PB_OIDC_CLIENT_ID || 'dx-maps-pb-dev',
|
|
clientSecret: need('PB_OIDC_CLIENT_SECRET'),
|
|
authURL: disc.authorization_endpoint,
|
|
tokenURL: disc.token_endpoint,
|
|
userInfoURL: disc.userinfo_endpoint,
|
|
pkce: true,
|
|
extra: {},
|
|
}],
|
|
},
|
|
}, token)
|
|
if (env.PB_APP_URL) await call('PATCH', '/api/settings', { meta: { appURL: env.PB_APP_URL } }, token)
|
|
console.log(`[pb-oidc] users sign in through ${issuer} only (password sign-in off)`)
|