mirror of
https://github.com/Chewbaccalakis/rfid-database.git
synced 2026-09-09 16:01:56 -07:00
Nick TrochalakisandCursor Agent
cd1a2fe808
Request openid email profile, use client_secret_post, surface OIDC errors on /login, and expose a no-auth diagnostics endpoint so operators can verify the running container sees AUTH_OIDC_* and the callback URL. Co-authored-by: Cursor Agent <[email protected]>
31 lines
1.1 KiB
TypeScript
31 lines
1.1 KiB
TypeScript
import { jsonOk } from "@/lib/api/errors";
|
|
import { isOidcConfigured } from "@/lib/auth/oidc";
|
|
|
|
/**
|
|
* Public auth diagnostics (no secrets).
|
|
* Useful to verify the running container sees OIDC env vars.
|
|
*/
|
|
export async function GET() {
|
|
const authUrl = (process.env.AUTH_URL || "").replace(/\/$/, "");
|
|
const oidcEnabled = isOidcConfigured();
|
|
|
|
return jsonOk({
|
|
oidcEnabled,
|
|
oidcName: process.env.AUTH_OIDC_NAME || "SSO",
|
|
issuer: process.env.AUTH_OIDC_ISSUER || null,
|
|
clientIdSet: Boolean(process.env.AUTH_OIDC_CLIENT_ID?.trim()),
|
|
clientSecretSet: Boolean(process.env.AUTH_OIDC_CLIENT_SECRET?.trim()),
|
|
authUrl: authUrl || null,
|
|
authSecretSet: Boolean(
|
|
process.env.AUTH_SECRET?.trim() &&
|
|
process.env.AUTH_SECRET !== "change-me-to-a-long-random-string"
|
|
),
|
|
callbackUrl: authUrl
|
|
? `${authUrl}/api/auth/callback/oidc`
|
|
: "/api/auth/callback/oidc",
|
|
hint: oidcEnabled
|
|
? "OIDC looks configured. Register callbackUrl exactly in your IdP."
|
|
: "Set AUTH_OIDC_ISSUER, AUTH_OIDC_CLIENT_ID, and AUTH_OIDC_CLIENT_SECRET, then restart.",
|
|
});
|
|
}
|