mirror of
https://github.com/iflytek/skillhub.git
synced 2026-08-28 11:25:00 +00:00
6fe4c4ac15
* fix(runtime): pass auth environment variables to containers
The web container's envsubst in 30-runtime-config.sh only substituted
SKILLHUB_WEB_API_BASE_URL and SKILLHUB_PUBLIC_BASE_URL, leaving auth-related
variables (authDirectEnabled, authSessionBootstrapEnabled, etc.) as literal
${...} strings in runtime-config.js. Additionally, compose.release.yml did not
pass SKILLHUB_WEB_AUTH_DIRECT_ENABLED or SKILLHUB_WEB_AUTH_DIRECT_PROVIDER to
the web container, nor SKILLHUB_AUTH_DIRECT_ENABLED to the server container.
This made it impossible to enable direct (username/password) authentication
for intranet deployments without OAuth2, even though the frontend template and
backend already supported it.
Changes:
- compose.release.yml: add SKILLHUB_AUTH_DIRECT_ENABLED to server env
- compose.release.yml: add auth direct and session bootstrap vars to web env
- 30-runtime-config.sh: expand envsubst to cover all runtime-config.js template variables
- .env.release.example: document the new auth configuration variables
All new variables default to false/empty, preserving existing GitHub OAuth behavior.
* fix: remove session bootstrap frontend config from compose
Per reviewer feedback: exposing SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_* in the
compose without matching SKILLHUB_AUTH_SESSION_BOOTSTRAP_ENABLED on the server
would cause 403 errors when frontend attempts bootstrap.
Keep this PR focused on direct auth only. Bootstrap variables are still handled
in 30-runtime-config.sh with false defaults, so runtime-config.js will have
authSessionBootstrapEnabled: "false" and frontend will not trigger bootstrap.
---------
Co-authored-by: wowo <zhenggui5228@126.com>
Co-authored-by: PR Review Helper <review-helper@local>
27 lines
1.4 KiB
Bash
27 lines
1.4 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
: "${SKILLHUB_WEB_API_BASE_URL:=}"
|
|
: "${SKILLHUB_PUBLIC_BASE_URL:=}"
|
|
: "${SKILLHUB_WEB_AUTH_DIRECT_ENABLED:=false}"
|
|
: "${SKILLHUB_WEB_AUTH_DIRECT_PROVIDER:=}"
|
|
|
|
# Session-bootstrap variables are defaulted here so envsubst writes
|
|
# `authSessionBootstrapEnabled: "false"` into runtime-config.js instead of leaving
|
|
# the literal `${...}` placeholder. They are intentionally NOT exposed in
|
|
# compose.release.yml or .env.release.example: the matching server-side switch
|
|
# does not exist yet, so surfacing the toggle would let the frontend hit
|
|
# /api/v1/auth/session/bootstrap and receive 403. See PR #280 discussion.
|
|
: "${SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_ENABLED:=false}"
|
|
: "${SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_PROVIDER:=}"
|
|
: "${SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_AUTO:=false}"
|
|
|
|
# Generate runtime-config.js
|
|
envsubst '${SKILLHUB_WEB_API_BASE_URL} ${SKILLHUB_PUBLIC_BASE_URL} ${SKILLHUB_WEB_AUTH_DIRECT_ENABLED} ${SKILLHUB_WEB_AUTH_DIRECT_PROVIDER} ${SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_ENABLED} ${SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_PROVIDER} ${SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_AUTO}' \
|
|
< /usr/share/nginx/html/runtime-config.js.template \
|
|
> /usr/share/nginx/html/runtime-config.js
|
|
|
|
# Generate registry/skill.md with actual public URL
|
|
envsubst '${SKILLHUB_PUBLIC_BASE_URL}' \
|
|
< /usr/share/nginx/html/registry/skill.md.template \
|
|
> /usr/share/nginx/html/registry/skill.md
|