mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 4.8
7dd22661d6
BookWyrm core has no OIDC/LDAP login, so behind the oauth2-proxy a gated visitor only reaches BookWyrm's own login form. Add a trusted-header SSO bridge (files/sso/header_auth.py: RemoteUser middleware + backend) that turns the oauth2-proxy identity (X-Forwarded-Preferred-Username, set by Keycloak after OIDC or LDAP-federated login) into a real BookWyrm session, auto-provisioning the local user. Active only when PROXY_HEADER_SSO is truthy (= sso is_proxy_gated, centralised in BOOKWYRM_SSO_PROXY_GATED). Supporting fixes: USE_S3_FOR_EXPORTS=false (exports stay local; SeaweedFS has no per-bucket ACL so private exports must not share the public media bucket) fixes the fresh-build settings crash / preferences 502; proxy_pass_request_body off on the keycloak sso_proxy /oauth2/ block so the auth_request subrequest no longer hangs 60s on gated POST bodies (504->500); split playwright.spec.js into per-test files; add positive (oidc/ldap -> authenticated session) + negative (forged header -> gated) SSO e2e tests; fix the avatar test (form-scoped Save locator + valid PNG); remove dead BookWyrm OIDC_* env; unit tests for the bridge + the gated settings patch. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
16 lines
1.0 KiB
Markdown
16 lines
1.0 KiB
Markdown
# Todos
|
|
|
|
- Store user exports in object storage instead of local container storage.
|
|
Currently `USE_S3_FOR_EXPORTS=false` (templates/env.j2): media (avatars, covers)
|
|
goes to the public objstore bucket, but private account exports stay on the
|
|
container's local filesystem. They cannot share the media bucket: the objstore
|
|
model gives one bucket per app and SeaweedFS enforces no per-prefix ACL, so an
|
|
anonymous-readable (`public: true`) media bucket would also expose `exports/`.
|
|
Clean fix requires extending the `objstore` lookup to resolve a second, named,
|
|
private (`public: false`) bucket per app (e.g. `bookwyrm-exports`), provision it
|
|
with the app's S3 key, and grant anon-read only on the media bucket. Then set
|
|
`USE_S3_FOR_EXPORTS=true` + `EXPORTS_STORAGE_BUCKET_NAME` to that private bucket
|
|
(BookWyrm already uses `default_acl: private` + `querystring_auth: True`, so
|
|
signed-URL access keeps exports private). Touches shared objstore infra, so it
|
|
belongs in its own PR alongside other private-data consumers.
|