Tizian 「ティツィアーン」
f549fa59df
halkyon_oidc_server and its generated client halkyon_oidc_client: any provider following OpenID Connect's code flow, beside Serverpod's own providers, with a preset for SimpleLogin (no PKCE, no `typ`). Nothing of Halkyon's is in it; BSD-3-Clause, `publish_to: none` for now. - Attempts in `halkyon_oidc_attempt` (ADR 0020's D13): the ID PostgreSQL's gen_random_uuid(), a state and a nonce of 32 random bytes, PKCE's verifier where used, the caller if signed in; ten minutes, taken once. A host may begin the state with a marker. - The code exchanged by the module itself, so a provider out of reach (a timeout, a 5xx) is told apart from a refused code; the ID token checked with dart_jsonwebtoken's algorithms (ADR 0020's D12): the provider's algorithms alone, the key its `kid` names, of the right type; issuer, audience and `azp`, expiry, time issued, `nbf`, a minute's leeway; the attempt's nonce; a `sub`. - Keys kept an hour, fetched again for an unknown `kid` at most once a minute; discovery checked against the issuer; every request with a timeout. - Identities in `halkyon_oidc_identity`: the provider's key and the `sub`, one per person and provider, deleted with the person. - The stock endpoint (`OidcIdpBaseEndpoint`), and the parts for a host with rules of its own: begin, verify, keep and takeKept, link, accountOf, unlink; merging people; a limit per network. - The forwarding page, moved here from halkyon_base in the next commit. The package's main library is the code generator's, as halkyon_base's; a host imports `package:halkyon_oidc_server/oidc.dart`. ADR 0023's point 5 no longer names OAuth2PkceUtil, which the module doesn't use. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
40 lines
916 B
YAML
40 lines
916 B
YAML
# The module's test server: every port 0, so the tests find free ones and can run
|
|
# side by side. The database is the embedded PostgreSQL Serverpod starts and
|
|
# manages itself (`dataPath`): no Docker needed, `dart test` is enough. Its password
|
|
# and the tests' other secrets are in config/passwords.yaml (git-ignored; see the
|
|
# README for the keys).
|
|
|
|
apiServer:
|
|
port: 0
|
|
publicHost: localhost
|
|
publicPort: 0
|
|
publicScheme: http
|
|
|
|
insightsServer:
|
|
port: 0
|
|
publicHost: localhost
|
|
publicPort: 0
|
|
publicScheme: http
|
|
|
|
webServer:
|
|
port: 0
|
|
publicHost: localhost
|
|
publicPort: 0
|
|
publicScheme: http
|
|
|
|
database:
|
|
host: localhost
|
|
port: 9090
|
|
name: halkyon_oidc_test
|
|
user: postgres
|
|
dataPath: .serverpod/test/pgdata
|
|
|
|
redis:
|
|
enabled: false
|
|
host: localhost
|
|
port: 9091
|
|
|
|
# Session logs are never kept, for privacy, as on every Halkyon server.
|
|
sessionLogs:
|
|
persistentEnabled: false
|
|
consoleEnabled: true
|