scriptoriumadmin/skillhub
1
0
Fork 0
mirror of https://github.com/iflytek/skillhub.git synced 2026-10-10 03:27:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3
skillhub/.env.release.example
dongmucat ace0cb2dd8 fix(auth): address CAS SSO review — XXE, AccessPolicy, timeouts, release wiring 
Blockers:
- Harden XML parsing against XXE (disallow DOCTYPE, external entities/DTDs,
  enable FEATURE_SECURE_PROCESSING) and switch to UTF-8 byte decoding.
- Generalize AccessPolicy.evaluate from OAuthClaims to IdentityClaims; extract
  IdentityAuthenticator so OAuth and CAS share allow/deny/pending evaluation.
  CAS callback now goes through the policy instead of bypassing it with a
  direct bindOrCreate call.
- Configure JDK HttpClient with connect/read timeouts (5s/10s) and disable
  HTTP redirects to prevent ticket exfiltration via a malicious CAS server.

Major:
- Require HTTPS for skillhub.auth.cas.service-url in addition to server-url.
- Stop logging raw service tickets; log claims.subject() instead.
- Remove the dead authCasEnabled web flag — the backend AuthMethodCatalog is
  the single source of truth for CAS visibility, matching how OAuth works.
- Wire SKILLHUB_AUTH_CAS_* env vars into compose.release.yml and add a fully
  documented section in .env.release.example.

Minor:
- CasProtocolVersion enum replaces string comparisons in the validator.
- JSON multi-value array attributes are preserved as List<String> instead of
  silently dropping all but the first element.
- AuthMethod.methodType union adds 'CAS_REDIRECT'.
- application.yml notes that service-url must equal
  ${SKILLHUB_PUBLIC_BASE_URL}/api/v1/auth/cas/callback.

Tests:
- CasTicketValidatorTest tightens URL matching to assert ticket/service/format
  parameters and adds XXE + billion-laughs regression cases.
- IdentityAuthenticatorTest covers ALLOW / PENDING / DENY paths.
- AuthMethodCatalogTest exercises both cas.enabled=true and =false.
- isExternalRedirectMethod predicate extracted and unit-tested.
2026-05-27 15:19:11 +08:00

127 lines
5.5 KiB
Text
Raw Permalink Blame History

# `latest` tracks the latest stable release image.
# For deterministic environments, pin a release tag like `v0.1.0`.
# Use `edge` only when you explicitly want the latest build from `main`.
SKILLHUB_VERSION=latest
SKILLHUB_SERVER_IMAGE=ghcr.io/iflytek/skillhub-server
SKILLHUB_WEB_IMAGE=ghcr.io/iflytek/skillhub-web
SKILLHUB_SCANNER_IMAGE=ghcr.io/iflytek/skillhub-scanner
POSTGRES_IMAGE=postgres:16-alpine
REDIS_IMAGE=redis:7-alpine
# Public entrypoint seen by browsers/CLI, no trailing slash.
# Default to localhost so `runtime.sh up` works as a zero-config quickstart.
SKILLHUB_PUBLIC_BASE_URL=http://localhost
# Frontend usually keeps this empty and proxies to the backend through nginx.
SKILLHUB_WEB_API_BASE_URL=
SKILLHUB_API_UPSTREAM=http://server:8080
POSTGRES_BIND_ADDRESS=127.0.0.1
POSTGRES_PORT=5432
POSTGRES_DB=skillhub
POSTGRES_USER=skillhub
POSTGRES_PASSWORD=change-this-postgres-password
REDIS_BIND_ADDRESS=127.0.0.1
REDIS_PORT=6379
API_PORT=8080
WEB_PORT=80
SESSION_COOKIE_SECURE=false
# Zero-config runtime validation uses local storage.
# Switch to `s3` and fill the fields below before a real production deployment.
SKILLHUB_STORAGE_PROVIDER=local
SKILLHUB_STORAGE_S3_ENDPOINT=https://oss-cn-example.aliyuncs.com
SKILLHUB_STORAGE_S3_PUBLIC_ENDPOINT=
SKILLHUB_STORAGE_S3_BUCKET=skillhub-prod
# Static credentials for S3-compatible storage (MinIO, Alibaba OSS, etc.).
# Leave both blank to use IAM authentication (EC2 instance profile, ECS task role, EKS IRSA).
SKILLHUB_STORAGE_S3_ACCESS_KEY=replace-me
SKILLHUB_STORAGE_S3_SECRET_KEY=replace-me
SKILLHUB_STORAGE_S3_REGION=cn-shanghai
SKILLHUB_STORAGE_S3_FORCE_PATH_STYLE=false
# Aliyun OSS rejects aws-chunked encoding; set to true when targeting Aliyun OSS.
SKILLHUB_STORAGE_S3_DISABLE_CHUNKED_ENCODING=true
SKILLHUB_STORAGE_S3_AUTO_CREATE_BUCKET=false
SKILLHUB_STORAGE_S3_PRESIGN_EXPIRY=PT10M
# Bootstrap local admin account for first login. Rotate or disable after initial setup.
BOOTSTRAP_ADMIN_ENABLED=true
BOOTSTRAP_ADMIN_USER_ID=docker-admin
BOOTSTRAP_ADMIN_USERNAME=admin
BOOTSTRAP_ADMIN_PASSWORD=ChangeMe!2026
BOOTSTRAP_ADMIN_DISPLAY_NAME=Platform Admin
BOOTSTRAP_ADMIN_EMAIL=admin@example.com
# Optional override. Defaults to ${SKILLHUB_PUBLIC_BASE_URL}/device.
DEVICE_AUTH_VERIFICATION_URI=
# Optional: configure real GitHub OAuth before exposing the stack to other users.
OAUTH2_GITHUB_CLIENT_ID=
OAUTH2_GITHUB_CLIENT_SECRET=
# Optional: configure real GitLab OAuth before exposing the stack to other users.
# Set OAUTH2_GITLAB_BASE_URI to your self-hosted GitLab URL when applicable.
OAUTH2_GITLAB_CLIENT_ID=
OAUTH2_GITLAB_CLIENT_SECRET=
OAUTH2_GITLAB_BASE_URI=https://gitlab.com
OAUTH2_GITLAB_DISPLAY_NAME=GitLab
# Optional: OIDC login (e.g. Keycloak, Okta, Azure AD).
# Replace "OIDC" in variable names with your registration id (uppercase).
# The registration id becomes identity_binding.provider_code — keep it stable.
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_CLIENT_ID=
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_CLIENT_SECRET=
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_PROVIDER=oidc
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_AUTHORIZATION_GRANT_TYPE=authorization_code
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_REDIRECT_URI={baseUrl}/login/oauth2/code/{registrationId}
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_SCOPE=openid,profile,email
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_CLIENT_NAME=OIDC
SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_OIDC_ISSUER_URI=
# Direct (username/password) authentication for environments without OAuth2.
# To enable, set BOTH:
# - SKILLHUB_AUTH_DIRECT_ENABLED=true (server: enables the /api/v1/auth/direct endpoint)
# - SKILLHUB_WEB_AUTH_DIRECT_ENABLED=true (web: surfaces the username/password form)
# Set SKILLHUB_WEB_AUTH_DIRECT_PROVIDER to the provider id (e.g. "local").
SKILLHUB_AUTH_DIRECT_ENABLED=false
SKILLHUB_WEB_AUTH_DIRECT_ENABLED=false
SKILLHUB_WEB_AUTH_DIRECT_PROVIDER=
# CAS 2.0 / 3.0 SSO. To enable:
# - SKILLHUB_AUTH_CAS_ENABLED=true
# - SKILLHUB_AUTH_CAS_SERVER_URL=https://cas.example.com (CAS server base URL, must be HTTPS)
# - SKILLHUB_AUTH_CAS_SERVICE_URL=https://skillhub.example.com/api/v1/auth/cas/callback
# (must equal ${SKILLHUB_PUBLIC_BASE_URL}/api/v1/auth/cas/callback)
# Once enabled, /api/v1/auth/methods exposes a CAS_REDIRECT entry to the web UI automatically.
SKILLHUB_AUTH_CAS_ENABLED=false
SKILLHUB_AUTH_CAS_SERVER_URL=
SKILLHUB_AUTH_CAS_SERVICE_URL=
SKILLHUB_AUTH_CAS_PROTOCOL_VERSION=3.0
# Override CAS attribute names if your server does not return uid/cn/mail.
SKILLHUB_AUTH_CAS_ATTR_USERNAME=uid
SKILLHUB_AUTH_CAS_ATTR_DISPLAY_NAME=cn
SKILLHUB_AUTH_CAS_ATTR_EMAIL=mail
# Development-only: allow http:// CAS server / service URLs. Never set this in production.
SKILLHUB_AUTH_CAS_ALLOW_INSECURE=false
# SMTP configuration for password reset verification emails.
SPRING_MAIL_HOST=
SPRING_MAIL_PORT=587
SPRING_MAIL_USERNAME=
SPRING_MAIL_PASSWORD=
SPRING_MAIL_SMTP_AUTH=true
SPRING_MAIL_SMTP_STARTTLS_ENABLE=true
SPRING_MAIL_PROPERTIES_MAIL_SMTP_SSL_ENABLE=false
SPRING_MAIL_PROPERTIES_MAIL_SMTP_SSL_TRUST=
SKILLHUB_AUTH_PASSWORD_RESET_CODE_EXPIRY=PT10M
SKILLHUB_AUTH_PASSWORD_RESET_FROM_ADDRESS=noreply@example.com
SKILLHUB_AUTH_PASSWORD_RESET_FROM_NAME=SkillHub
# Security scanner is enabled by default. Set to false to disable scanning.
SKILLHUB_SECURITY_SCANNER_ENABLED=true
# Scanner LLM configuration (optional, for AI-powered scanning features)
SKILL_SCANNER_LLM_API_KEY=
SKILL_SCANNER_LLM_BASE_URL=
SKILL_SCANNER_LLM_MODEL=
Reference in a new issue View git blame Copy permalink