theta42/proxy
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Per-host SSO: data model + normalization (#57)

Browse Source 
Add Host fields sso_enabled / sso_allow_users / sso_allow_groups (empty
allow-lists = any authenticated user) and normalize them (parseAllowList). SSO
reuses conf.oidc and is OR'd with basic auth. Enforcement (session cookie + Lua
+ nginx auth location) lands separately. Unit tests included.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
William Mantly
2026-07-11 12:01:54 -04:00
parent 42a00dd3bf
commit 653c79f099
3 changed files with 57 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nodejs/models/host.js
+6
View File
@@ -47,6 +47,12 @@ class Host extends Table{
'basicauth_enabled': {default: false, isRequired: false, type: 'boolean',},
'basicauth_realm': {default: 'Restricted', isRequired: false, type: 'string', min: 1, max: 128},
'basicauth_users': {default: function(){return {}}, isRequired: false, type: 'object',},
// Per-host SSO (OIDC via conf.oidc) — enforced by a signed session cookie
// checked in ops/nginx_conf/hostfeatures.lua. Empty allow-lists mean "any
// authenticated user". basic auth and SSO are OR'd (either satisfies).
'sso_enabled': {default: false, isRequired: false, type: 'boolean',},
'sso_allow_users': {default: function(){return []}, isRequired: false, type: 'object',},
'sso_allow_groups': {default: function(){return []}, isRequired: false, type: 'object',},
'req_headers': {default: function(){return {}}, isRequired: false, type: 'object',},
'resp_headers': {default: function(){return {}}, isRequired: false, type: 'object',},
'ip_allow': {default: function(){return []}, isRequired: false, type: 'object',},