Sienna Meridian SatterwhiteandLinus Rath
c3f60448ad
Add three environment variables for deployments with external identity providers (Keycloak, Authentik, Ory Hydra, etc.): - OAUTH_EXTRA_SCOPES: append additional scopes to the default "openid email profile" (e.g. "offline_access" for refresh tokens) - OAUTH_SCOPES: full override of the requested OAuth scopes - COOKIE_SECURE: override the Secure flag on auth cookies (useful for reverse proxy setups where the internal hop is HTTP) Without these, deploying Bulwark with an external OIDC provider that requires `offline_access` for refresh tokens is impossible — sessions die on every page refresh because no refresh token is issued. All three are backwards-compatible: unset = identical to current behavior.
10 lines
521 B
TypeScript
10 lines
521 B
TypeScript
const DEFAULT_SCOPES = 'openid email profile';
|
|
const EXTRA_SCOPES = process.env.OAUTH_EXTRA_SCOPES || '';
|
|
export const OAUTH_SCOPES = process.env.OAUTH_SCOPES || (EXTRA_SCOPES ? `${DEFAULT_SCOPES} ${EXTRA_SCOPES}`.trim() : DEFAULT_SCOPES);
|
|
export const REFRESH_TOKEN_COOKIE = 'jmap_rt';
|
|
|
|
/** Get the cookie name for a given account slot (0-4). Slot 0 uses the legacy name. */
|
|
export function refreshTokenCookieName(slot: number): string {
|
|
return slot === 0 ? REFRESH_TOKEN_COOKIE : `${REFRESH_TOKEN_COOKIE}_${slot}`;
|
|
}
|