mirror of
https://github.com/iflytek/skillhub.git
synced 2026-09-24 00:55:35 +00:00
f29ac241fc
Adds Feishu (Lark) as a public sign-in option: it authenticates a
SkillHub platform account and nothing more. No Organization membership,
no directory sync, no Namespace grants.
Feishu deviates from standard OAuth in two ways this handles:
its userinfo response is wrapped in a {code, msg, data} envelope, and it
reports errors with HTTP 200. FeishuOAuth2UserService unwraps that
envelope into flat attributes; FeishuClaimsExtractor maps them to the
shared OAuthClaims, so account decisions still run through the unified
identity core added in R1-A.
Subject and email semantics, which decide whether a login can reach an
existing account:
- open_id is the only subject. union_id stays in extra rather than
acting as a fallback: a subject that can change between logins would
split one person across two platform accounts. Promoting union_id
later needs an explicit alias migration.
- A blank or missing open_id fails the login instead of binding the
literal string "null".
- emailVerified is always false. Feishu emails are imported by an
organization admin and never confirmed with the user, so they carry no
verification signal and cannot be used to join an existing account.
Operational bounds: the userinfo call has connect and read timeouts so an
unresponsive Feishu endpoint cannot hold a login thread, and the
OAuth2Error description carries only the provider error code, because an
upstream message can quote the request URI and with it the access token.
Like the GitHub and GitLab extractors, the claims extractor logs nothing.
The login button follows the existing config-driven catalog: with no
client id configured, /api/v1/auth/methods does not list Feishu and no
button renders. No frontend code change is needed; the icon resolves by
provider name.
Adapted from the implementation in #696 by @yhd4711499, re-extracted onto
current main with the subject, logging and timeout changes above.
Part of R1-A2 (public Provider adapters) per
openspec/changes/enterprise-identity-platform/rollout-plan.md.
Co-authored-by: yhd4711499 <yhd4711499@users.noreply.github.com>
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
180 lines
7.9 KiB
Text
180 lines
7.9 KiB
Text
# `latest` tracks the latest stable release image.
|
|
# For deterministic environments, pin a release tag like `v0.1.0`.
|
|
# Use `edge` only when you explicitly want the latest build from `main`.
|
|
SKILLHUB_VERSION=latest
|
|
SKILLHUB_SERVER_IMAGE=ghcr.io/iflytek/skillhub-server
|
|
SKILLHUB_WEB_IMAGE=ghcr.io/iflytek/skillhub-web
|
|
SKILLHUB_SCANNER_IMAGE=ghcr.io/iflytek/skillhub-scanner
|
|
POSTGRES_IMAGE=postgres:16-alpine
|
|
REDIS_IMAGE=redis:7-alpine
|
|
|
|
# Public entrypoint seen by browsers/CLI, no trailing slash.
|
|
# Default to localhost so `runtime.sh up` works as a zero-config quickstart.
|
|
SKILLHUB_PUBLIC_BASE_URL=http://localhost
|
|
|
|
# Suite Bundle rollout controls. Confirmation is opt-in; review writes remain enabled
|
|
# for the single-server release Compose topology.
|
|
SKILLHUB_SUITE_BUNDLE_CONFIRMATION_ENABLED=false
|
|
SKILLHUB_SUITE_REVIEW_WRITES_ENABLED=true
|
|
|
|
# Frontend usually keeps this empty and proxies to the backend through nginx.
|
|
SKILLHUB_WEB_API_BASE_URL=
|
|
SKILLHUB_API_UPSTREAM=http://server:8080
|
|
# Keep false for direct exposure. Enable only behind a trusted proxy that replaces
|
|
# X-Forwarded-Proto and blocks direct access to the web container.
|
|
SKILLHUB_TRUST_FORWARDED_PROTO=false
|
|
|
|
# Sub-path deployment example. Keep all three public/browser values aligned:
|
|
# SKILLHUB_PUBLIC_BASE_URL=https://example.com/skillhub
|
|
# SKILLHUB_WEB_API_BASE_URL=/skillhub
|
|
# SKILLHUB_WEB_BASE_PATH=/skillhub/
|
|
# Leave empty so a fixed-base image keeps its baked base; set to a sub-path to override.
|
|
SKILLHUB_WEB_BASE_PATH=
|
|
|
|
POSTGRES_BIND_ADDRESS=127.0.0.1
|
|
POSTGRES_PORT=5432
|
|
POSTGRES_DB=skillhub
|
|
POSTGRES_USER=skillhub
|
|
POSTGRES_PASSWORD=change-this-postgres-password
|
|
|
|
REDIS_BIND_ADDRESS=127.0.0.1
|
|
REDIS_PORT=6379
|
|
|
|
# Optional external Redis connection. Leave these commented to use the bundled
|
|
# standalone Redis service. For Redis Cluster, every advertised node address
|
|
# must be reachable from the server container.
|
|
# SPRING_DATA_REDIS_CLUSTER_NODES=redis-0.example.com:6379,redis-1.example.com:6379,redis-2.example.com:6379
|
|
# SPRING_DATA_REDIS_CLUSTER_MAX_REDIRECTS=5
|
|
# SPRING_DATA_REDIS_USERNAME=
|
|
# SPRING_DATA_REDIS_PASSWORD=
|
|
# SPRING_DATA_REDIS_SSL_ENABLED=false
|
|
# SPRING_DATA_REDIS_CONNECT_TIMEOUT=5s
|
|
# SPRING_DATA_REDIS_TIMEOUT=3s
|
|
# SPRING_DATA_REDIS_CLIENT_NAME=skillhub
|
|
|
|
# Optional external Redis Sentinel. Sentinel takes precedence if both Sentinel
|
|
# and Cluster settings are present. Use separate credentials when Sentinel ACL
|
|
# differs from the Redis data nodes.
|
|
# SPRING_DATA_REDIS_SENTINEL_MASTER=mymaster
|
|
# SPRING_DATA_REDIS_SENTINEL_NODES=sentinel-0.example.com:26379,sentinel-1.example.com:26379,sentinel-2.example.com:26379
|
|
# SPRING_DATA_REDIS_SENTINEL_USERNAME=
|
|
# SPRING_DATA_REDIS_SENTINEL_PASSWORD=
|
|
# SKILLHUB_REDIS_SENTINEL_CHECK_SENTINELS_LIST=true
|
|
|
|
API_PORT=8080
|
|
WEB_PORT=80
|
|
SESSION_COOKIE_SECURE=false
|
|
|
|
# Observability defaults require no Collector or tracing backend.
|
|
# Use json in container deployments when stdout is collected centrally.
|
|
SKILLHUB_TRACING_MODE=none
|
|
SKILLHUB_LOG_FORMAT=json
|
|
SKILLHUB_LOG_ASYNC_QUEUE_SIZE=1024
|
|
SKILLHUB_SERVICE_VERSION=unknown
|
|
SKILLHUB_SERVICE_ENVIRONMENT=production
|
|
SKILLHUB_TRACING_SAMPLING_PROBABILITY=0.1
|
|
# Set only with SKILLHUB_TRACING_MODE=otel-sdk.
|
|
MANAGEMENT_OTLP_TRACING_ENDPOINT=
|
|
SKILLHUB_OTLP_TIMEOUT=5s
|
|
SKILLHUB_OTLP_COMPRESSION=gzip
|
|
|
|
# Zero-config runtime validation uses local storage.
|
|
# Switch to `s3` and fill the fields below before a real production deployment.
|
|
SKILLHUB_STORAGE_PROVIDER=local
|
|
SKILLHUB_STORAGE_S3_ENDPOINT=https://oss-cn-example.aliyuncs.com
|
|
SKILLHUB_STORAGE_S3_PUBLIC_ENDPOINT=
|
|
SKILLHUB_STORAGE_S3_BUCKET=skillhub-prod
|
|
# Static credentials for S3-compatible storage (MinIO, Alibaba OSS, etc.).
|
|
# Leave both blank to use IAM authentication (EC2 instance profile, ECS task role, EKS IRSA).
|
|
SKILLHUB_STORAGE_S3_ACCESS_KEY=replace-me
|
|
SKILLHUB_STORAGE_S3_SECRET_KEY=replace-me
|
|
SKILLHUB_STORAGE_S3_REGION=cn-shanghai
|
|
SKILLHUB_STORAGE_S3_FORCE_PATH_STYLE=false
|
|
# Aliyun OSS rejects aws-chunked encoding; set to true when targeting Aliyun OSS.
|
|
SKILLHUB_STORAGE_S3_DISABLE_CHUNKED_ENCODING=true
|
|
SKILLHUB_STORAGE_S3_AUTO_CREATE_BUCKET=false
|
|
SKILLHUB_STORAGE_S3_PRESIGN_EXPIRY=PT10M
|
|
|
|
# Bootstrap local admin account for first login. Rotate or disable after initial setup.
|
|
BOOTSTRAP_ADMIN_ENABLED=true
|
|
BOOTSTRAP_ADMIN_USER_ID=docker-admin
|
|
BOOTSTRAP_ADMIN_USERNAME=admin
|
|
BOOTSTRAP_ADMIN_PASSWORD=ChangeMe!2026
|
|
BOOTSTRAP_ADMIN_DISPLAY_NAME=Platform Admin
|
|
BOOTSTRAP_ADMIN_EMAIL=admin@example.com
|
|
|
|
# Optional override. Defaults to ${SKILLHUB_PUBLIC_BASE_URL}/device.
|
|
DEVICE_AUTH_VERIFICATION_URI=
|
|
|
|
# Optional: configure real GitHub OAuth before exposing the stack to other users.
|
|
OAUTH2_GITHUB_CLIENT_ID=
|
|
OAUTH2_GITHUB_CLIENT_SECRET=
|
|
|
|
# Optional: configure real GitLab OAuth before exposing the stack to other users.
|
|
# Set OAUTH2_GITLAB_BASE_URI to your self-hosted GitLab URL when applicable.
|
|
OAUTH2_GITLAB_CLIENT_ID=
|
|
OAUTH2_GITLAB_CLIENT_SECRET=
|
|
OAUTH2_GITLAB_BASE_URI=https://gitlab.com
|
|
OAUTH2_GITLAB_DISPLAY_NAME=GitLab
|
|
|
|
# Optional: Feishu (Lark) login as a public sign-in provider. Leaving the client id empty keeps
|
|
# the button off the login page. Grant contact:user.base:readonly and
|
|
# contact:user.email:readonly on the Feishu open-platform app itself; scopes are not sent here.
|
|
# Set OAUTH2_FEISHU_AUTHORIZE_URI/OAUTH2_FEISHU_BASE_URI to the Lark endpoints for
|
|
# international tenants (open.larksuite.com).
|
|
OAUTH2_FEISHU_CLIENT_ID=
|
|
OAUTH2_FEISHU_CLIENT_SECRET=
|
|
OAUTH2_FEISHU_AUTHORIZE_URI=https://accounts.feishu.cn
|
|
OAUTH2_FEISHU_BASE_URI=https://open.feishu.cn
|
|
OAUTH2_FEISHU_DISPLAY_NAME=飞书
|
|
|
|
# Optional: OIDC login (e.g. Keycloak, Okta, Azure AD).
|
|
# Replace "OIDC" in variable names with your registration id (uppercase).
|
|
# The registration id becomes identity_binding.provider_code — keep it stable.
|
|
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_CLIENT_ID=
|
|
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_CLIENT_SECRET=
|
|
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_PROVIDER=oidc
|
|
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_AUTHORIZATION_GRANT_TYPE=authorization_code
|
|
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_REDIRECT_URI={baseUrl}/login/oauth2/code/{registrationId}
|
|
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_SCOPE=openid,profile,email
|
|
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_CLIENT_NAME=OIDC
|
|
SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_OIDC_ISSUER_URI=
|
|
|
|
# Direct (username/password) authentication for environments without OAuth2.
|
|
# To enable, set BOTH:
|
|
# - SKILLHUB_AUTH_DIRECT_ENABLED=true (server: enables the /api/v1/auth/direct endpoint)
|
|
# - SKILLHUB_WEB_AUTH_DIRECT_ENABLED=true (web: surfaces the username/password form)
|
|
# Set SKILLHUB_WEB_AUTH_DIRECT_PROVIDER to a direct provider id returned by
|
|
# /api/v1/auth/methods (e.g. "local"). Do not use the built-in auth method id
|
|
# "local-password" here; that method points at /api/v1/auth/local/login.
|
|
SKILLHUB_AUTH_DIRECT_ENABLED=false
|
|
SKILLHUB_WEB_AUTH_DIRECT_ENABLED=false
|
|
SKILLHUB_WEB_AUTH_DIRECT_PROVIDER=
|
|
|
|
# SMTP configuration for password reset verification emails.
|
|
SPRING_MAIL_HOST=
|
|
SPRING_MAIL_PORT=587
|
|
SPRING_MAIL_USERNAME=
|
|
SPRING_MAIL_PASSWORD=
|
|
SPRING_MAIL_SMTP_AUTH=true
|
|
SPRING_MAIL_SMTP_STARTTLS_ENABLE=true
|
|
SPRING_MAIL_PROPERTIES_MAIL_SMTP_SSL_ENABLE=false
|
|
SPRING_MAIL_PROPERTIES_MAIL_SMTP_SSL_TRUST=
|
|
SKILLHUB_AUTH_PASSWORD_RESET_CODE_EXPIRY=PT10M
|
|
SKILLHUB_AUTH_PASSWORD_RESET_FROM_ADDRESS=noreply@example.com
|
|
SKILLHUB_AUTH_PASSWORD_RESET_FROM_NAME=SkillHub
|
|
|
|
# Security scanner is enabled by default. Set to false to disable scanning.
|
|
SKILLHUB_SECURITY_SCANNER_ENABLED=true
|
|
|
|
# Built-in starter skills are installed by default. Set to false to skip initialization.
|
|
SKILLHUB_BUILTIN_SKILLS_ENABLED=true
|
|
|
|
# Required for signing anonymous download rate-limit cookies. Use a unique random value per deployment.
|
|
# runtime.sh generates and persists one automatically when this placeholder is still present.
|
|
SKILLHUB_DOWNLOAD_ANON_COOKIE_SECRET=replace-with-random-download-secret-32-bytes
|
|
|
|
# Scanner LLM configuration (optional, for AI-powered scanning features)
|
|
SKILL_SCANNER_LLM_API_KEY=
|
|
SKILL_SCANNER_LLM_BASE_URL=
|
|
SKILL_SCANNER_LLM_MODEL=
|