linusandClaude Sonnet 5
eb6f64a0c5
On every Authentik login the token's `groups` claim is compared against AUTHENTIK_LEITUNGSTEAM_GROUP (default "Leitungsteam") and mirrored to the new User.isLeitungsteam column. LT is global, not KC-scoped, so it lives on the User rather than as a per-KC Membership row: toAuthenticatedUser() synthesises a virtual global LEITUNGSTEAM membership from the flag, so RolesGuard / visibility / TeamerService keep working unchanged. - provision helper gains an isLeitungsteam arg and reconciles the flag both ways (grant on join, drop when the group is gone), capturing a User UPDATE to the sync log. - verifyAuthentikClaims() now also returns isLeitungsteam; strategy, WS path and onboarding all funnel through the shared helper + mapper. - new env var AUTHENTIK_LEITUNGSTEAM_GROUP. Tests: provision-user.spec.ts extended (flag up/down, virtual membership); npm test green at 55. Docs updated; ops note added that the Authentik provider must emit the groups claim. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
45 lines
1.7 KiB
Bash
45 lines
1.7 KiB
Bash
# Postgres connection used by Prisma
|
|
DATABASE_URL="postgresql://postgres:postgres@localhost:5432/kcapp?schema=public"
|
|
|
|
# Authentik OIDC issuer, e.g. https://auth.example.org/application/o/kc-app/
|
|
AUTHENTIK_ISSUER_URL="https://authentik.example.org/application/o/kc-app"
|
|
|
|
# Name of the Authentik group whose members are Leitungsteam. Mirrored to
|
|
# User.isLeitungsteam on every login (the access token must carry a `groups`
|
|
# claim; add the "groups" scope to the Authentik provider).
|
|
AUTHENTIK_LEITUNGSTEAM_GROUP="Leitungsteam"
|
|
|
|
# Secret used to sign guest/Konfi session tokens (local accounts only)
|
|
GUEST_JWT_SECRET="change-me"
|
|
|
|
# Secret used to sign local Gemeinde Teamer session tokens (password login)
|
|
TEAM_JWT_SECRET="change-me-too"
|
|
|
|
PORT=3000
|
|
|
|
# File storage: defaults to Nextcloud via WebDAV; set STORAGE_PROVIDER=s3 to
|
|
# use an S3-compatible bucket instead (see S3_* vars below).
|
|
STORAGE_PROVIDER="webdav"
|
|
WEBDAV_URL="https://nextcloud.example.org/remote.php/dav/files/kc-app"
|
|
WEBDAV_USERNAME="kc-app"
|
|
WEBDAV_PASSWORD="change-me"
|
|
|
|
# Only used when STORAGE_PROVIDER=s3
|
|
S3_BUCKET="kc-app"
|
|
S3_REGION="auto"
|
|
S3_ENDPOINT=""
|
|
S3_FORCE_PATH_STYLE="false"
|
|
S3_ACCESS_KEY_ID=""
|
|
S3_SECRET_ACCESS_KEY=""
|
|
|
|
# Unique id for THIS server instance (local on-site vs. cloud); used to tag
|
|
# replication log entries and avoid echoing changes back to their origin.
|
|
SERVER_ID="change-me-uuid"
|
|
|
|
# Local/cloud sync: set on the LOCAL (on-site) server to periodically push/
|
|
# pull against the cloud instance's API base URL. Leave SYNC_ENABLED=false
|
|
# on the cloud server (it only needs to expose /sync/ingest + /sync/export).
|
|
SYNC_ENABLED="false"
|
|
SYNC_PEER_URL="https://kc-app-cloud.example.org/api"
|
|
SYNC_SHARED_SECRET="change-me"
|