hzhang
54b6103880
- Generic OIDC (Authlib discovery) Authorization Code flow; backend
issues the existing HS256 JWT on success. Unbound identities are
rejected (no auto-provisioning).
- User.oidc_issuer/oidc_subject (unique together) + startup migration.
- PUT/DELETE /users/{id}/oidc-binding (admin or account-manager;
JWT or API key; 409 on conflict). Self-link /auth/oidc/link
(non-OIDC_ONLY only). Public GET /auth/config.
- HARBORFORGE_OIDC_ONLY: /auth/token rejected, create/update ignore
password (passwordless users; API keys + OIDC still work).
- Dockerfile ARG/ENV HARBORFORGE_OIDC_ONLY; authlib+itsdangerous deps;
SessionMiddleware for OIDC state. Fixed _user_response to expose
the new binding fields.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
53 lines
1.3 KiB
Docker
53 lines
1.3 KiB
Docker
# Stage 1: build dependencies
|
|
FROM python:3.11-slim AS builder
|
|
|
|
WORKDIR /app
|
|
|
|
# Install build dependencies
|
|
RUN apt-get update && apt-get install -y \
|
|
build-essential \
|
|
default-libmysqlclient-dev \
|
|
pkg-config \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Pre-download wheels to avoid recompiling bcrypt from source
|
|
RUN pip install --no-cache-dir --prefix=/install \
|
|
'bcrypt==4.0.1' \
|
|
'cffi>=2.0' \
|
|
'pycparser>=2.0'
|
|
|
|
# Install Python dependencies
|
|
COPY requirements.txt .
|
|
RUN pip install --no-cache-dir --prefix=/install -r requirements.txt
|
|
|
|
# Stage 2: slim runtime
|
|
FROM python:3.11-slim
|
|
|
|
WORKDIR /app
|
|
|
|
# Install runtime dependencies only (no build tools)
|
|
RUN apt-get update && apt-get install -y \
|
|
default-libmysqlclient-dev \
|
|
curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Copy installed packages from builder
|
|
COPY --from=builder /install /usr/local
|
|
|
|
# Copy application code
|
|
COPY app/ ./app/
|
|
COPY requirements.txt ./
|
|
|
|
# Make entrypoint
|
|
COPY entrypoint.sh .
|
|
RUN chmod +x entrypoint.sh
|
|
|
|
# OIDC-only mode: when "true", password login is rejected, user creation
|
|
# ignores passwords (passwordless users that sign in via a bound OIDC
|
|
# identity / API keys). Overridable at runtime via the same env var.
|
|
ARG HARBORFORGE_OIDC_ONLY=false
|
|
ENV HARBORFORGE_OIDC_ONLY=${HARBORFORGE_OIDC_ONLY}
|
|
|
|
EXPOSE 8000
|
|
ENTRYPOINT ["./entrypoint.sh"]
|