mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.8
7dd22661d6
BookWyrm core has no OIDC/LDAP login, so behind the oauth2-proxy a gated visitor only reaches BookWyrm's own login form. Add a trusted-header SSO bridge (files/sso/header_auth.py: RemoteUser middleware + backend) that turns the oauth2-proxy identity (X-Forwarded-Preferred-Username, set by Keycloak after OIDC or LDAP-federated login) into a real BookWyrm session, auto-provisioning the local user. Active only when PROXY_HEADER_SSO is truthy (= sso is_proxy_gated, centralised in BOOKWYRM_SSO_PROXY_GATED). Supporting fixes: USE_S3_FOR_EXPORTS=false (exports stay local; SeaweedFS has no per-bucket ACL so private exports must not share the public media bucket) fixes the fresh-build settings crash / preferences 502; proxy_pass_request_body off on the keycloak sso_proxy /oauth2/ block so the auth_request subrequest no longer hangs 60s on gated POST bodies (504->500); split playwright.spec.js into per-test files; add positive (oidc/ldap -> authenticated session) + negative (forged header -> gated) SSO e2e tests; fix the avatar test (form-scoped Save locator + valid PNG); remove dead BookWyrm OIDC_* env; unit tests for the bridge + the gated settings patch. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
1.0 KiB
1.0 KiB
Todos
- Store user exports in object storage instead of local container storage.
Currently
USE_S3_FOR_EXPORTS=false(templates/env.j2): media (avatars, covers) goes to the public objstore bucket, but private account exports stay on the container's local filesystem. They cannot share the media bucket: the objstore model gives one bucket per app and SeaweedFS enforces no per-prefix ACL, so an anonymous-readable (public: true) media bucket would also exposeexports/. Clean fix requires extending theobjstorelookup to resolve a second, named, private (public: false) bucket per app (e.g.bookwyrm-exports), provision it with the app's S3 key, and grant anon-read only on the media bucket. Then setUSE_S3_FOR_EXPORTS=true+EXPORTS_STORAGE_BUCKET_NAMEto that private bucket (BookWyrm already usesdefault_acl: private+querystring_auth: True, so signed-URL access keeps exports private). Touches shared objstore infra, so it belongs in its own PR alongside other private-data consumers.