mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.8
b48ab523c7
Baserow's native SSO is Enterprise-only, so gate the community image with the shared Keycloak oauth2-proxy and patch urls.py (via a custom Dockerfile) with a trusted-header bridge. The bridge provisions/repairs a local Baserow user from the oauth2-proxy identity headers and mints native refresh/access/user_session tokens, mirroring Baserow's own SSO redirect contract (?token=&user_session=). proxy.conf.j2 performs the nginx handoff: an authenticated browser without a jwt_token cookie is 302'd to /api/infinito/sso/login/, which redirects back to /?token=&user_session= for the frontend middleware to consume. bootstrap_admin marks the superuser email_verified + completed_onboarding to skip onboarding. Replace the LDAP service/variant with proxy-gating and rewrite the seaweedfs + persona Playwright tests to drive Baserow through its API using the SSO-minted JWT. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
20 lines
460 B
Python
20 lines
460 B
Python
# ruff: noqa: F821
|
|
import os as _infinito_sso_os
|
|
|
|
if _infinito_sso_os.environ.get("PROXY_HEADER_SSO", "").lower() in (
|
|
"true",
|
|
"1",
|
|
"yes",
|
|
"on",
|
|
):
|
|
from django.urls import include as _infinito_sso_include
|
|
from django.urls import path as _infinito_sso_path
|
|
|
|
urlpatterns = [
|
|
_infinito_sso_path(
|
|
"api/infinito/sso/",
|
|
_infinito_sso_include("baserow.infinito_sso"),
|
|
),
|
|
*urlpatterns,
|
|
]
|