fix(dev-compose): authenticator dev bring-up (build binary, mount + named-curve key) by ktursunov · Pull Request #1750 · constructorfabric/insight

ktursunov · 2026-07-13T13:34:19Z

What

Fixes the authenticator dev bring-up in the compose stack so its container starts cleanly instead of crash-looping. The compose stack stays no-auth (the working default) — an earlier AUTH_MODE toggle / OIDC path was explored and removed because OIDC login can't complete yet (authenticator→Identity person-resolution returns 401; tracked separately).

Fixes

Build the authenticator binary. dev-compose.sh never compiled/installed authenticator, so compose created the bind-mount source as an empty directory → up failed with the OCI "mount a directory onto a file" error. Now built + installed (adds a build authenticator target too).
Mount the dev signing key. docker-compose.yml set signing_keys_path: /app/keys but never mounted the keys dir there → the authenticator crash-looped on the missing key. Adds deploy/compose/authenticator-dev-keys:/app/keys:ro.
Generate a loadable key. ensure_authenticator_dev_key now uses ec_param_enc:named_curve (macOS LibreSSL otherwise emits explicit EC params the p256 PKCS#8 loader rejects) and self-heals an existing bad-format key.
prune cleans it up. prune now removes deploy/compose/authenticator-dev-keys/ (was leaving a stale gitignored private key behind).
e2e consistency. authenticator/tests/run-e2e.sh uses the same named-curve encoding (isolated in its own mktemp dir — never clashes with the compose key).

Testing

bash -n on dev-compose.sh + insight-init.sh pass.
./dev-compose.sh up brings the full stack up green (no-auth); the authenticator container starts cleanly (key loads, gear starts) instead of crash-looping.

Note

Branch is named feat/compose-auth-mode-toggle for historical reasons — the toggle was removed; the PR now scopes to the authenticator dev bring-up fixes only.

Summary by CodeRabbit

Bug Fixes
- Improved development authentication key handling by detecting incompatible keys and regenerating them automatically.
- Ensured the authenticator is built and available when starting the development stack.
- Mounted development authentication keys into the authenticator service for reliable local use.
Documentation
- Clarified development authentication behavior, including frontend impersonation and OIDC environment variable usage.
Chores
- Added an authenticator build target and included its artifacts in cleanup operations.

Add a single AUTH_MODE switch to the compose dev stack and fix the authenticator so it can actually start when auth is enabled. Toggle: - AUTH_MODE={off|oidc} in dev-compose.sh derives the gateway config (no-auth.yaml vs insight.yaml) and the frontend login mode (dev-impersonation vs OIDC), enforcing the two never coexist. Adds a --auth flag and .env.compose.example docs. Default: off. - docker-compose.yml: the api-gateway command now reads ${API_GATEWAY_CONFIG} (was hardcoded to no-auth.yaml). Authenticator dev bring-up fixes (required for AUTH_MODE=oidc): - dev-compose.sh builds the authenticator bin and installs it to the bind-mount path (was never built -> compose created the mount source as an empty dir -> OCI 'mount a directory onto a file' error on up). - docker-compose.yml mounts deploy/compose/authenticator-dev-keys at /app/keys (signing_keys_path was set but the dir was never mounted). - dev-compose.sh generates the dev ES256 key with ec_param_enc:named_curve (macOS LibreSSL otherwise emits explicit EC params the authenticator's p256 PKCS#8 loader rejects). Verified: AUTH_MODE=off brings the full stack up green (gateway no-auth, FE dev-impersonation, UI 200). AUTH_MODE=oidc brings the stack up but /auth/callback still 500s pending the authenticator->Identity caller-id fix (tracked separately). Signed-off-by: Konstantin Tursunov <Konstantin.Tursunov@constructor.tech>

coderabbitai · 2026-07-13T13:34:30Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 4817cc93-ee1b-4f94-83de-54a58f5b643a

📥 Commits

Reviewing files that changed from the base of the PR and between 394fda8 and 9192adb.

📒 Files selected for processing (1)

docker-compose.yml

🚧 Files skipped from review as they are similar to previous changes (1)

docker-compose.yml

📝 Walkthrough

Walkthrough

The compose development stack now validates and mounts P-256 authenticator keys, always builds the authenticator binary, supports an explicit build target, removes generated keys during pruning, and documents frontend impersonation and OIDC variable usage.

Changes

Authenticator development stack

Layer / File(s)	Summary
Development key provisioning and mounting `dev-compose.sh`, `docker-compose.yml`	Existing authenticator keys are validated for named-curve P-256 compatibility, incompatible keys are regenerated, and the key directory is mounted read-only into the authenticator service.
Authenticator build targets `dev-compose.sh`	The `up`, standalone, `rust`, and `all` build paths build and install the authenticator binary.
Development stack lifecycle and guidance `.env.compose.example`, `dev-compose.sh`	Environment comments describe default-tenant context, frontend dev impersonation, and frontend-only OIDC variables; pruning removes generated authenticator keys.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: fixing dev-compose authenticator bring-up by building the binary, mounting keys, and handling P-256 key format.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

… dev signing key - insight-init.sh writes AUTH_MODE (default off) into the generated .env.compose alongside FRONTEND_MODE, so the auth switch is a first-class setting rather than an implicit script default. - ensure_authenticator_dev_key now regenerates an existing key that is not a usable named-curve P-256 key (e.g. an older LibreSSL-generated explicit-params key), so `up` always leaves a key the authenticator can actually load. Signed-off-by: Konstantin Tursunov <Konstantin.Tursunov@constructor.tech>

prune wiped build/, the override, and .env.compose but left deploy/compose/authenticator-dev-keys/ behind — a stale gitignored private key surviving a full state wipe. Remove it too (regenerated on the next up), and list it in the prune help + confirmation prose. Signed-off-by: Konstantin Tursunov <Konstantin.Tursunov@constructor.tech>

…mpose dev key run-e2e.sh generated its ES256 key without ec_param_enc:named_curve, so on macOS LibreSSL it emitted explicit EC params the p256 loader rejects — diverging from the compose dev key generation. Align the command (same named-curve encoding as dev-compose.sh). The e2e key stays in its own mktemp dir, so it never clashes with deploy/compose/authenticator-dev-keys/. Signed-off-by: Konstantin Tursunov <Konstantin.Tursunov@constructor.tech>

…dev bring-up fixes The oidc auth mode can't complete login yet (authenticator->Identity person-resolution 401, tracked separately), so remove the AUTH_MODE toggle and its oidc path entirely — the compose stack is no-auth only, as before (gateway command back to a hardcoded no-auth.yaml). Kept: the authenticator dev bring-up fixes, so its container starts cleanly instead of crash-looping even though it's off the auth path — builds the authenticator binary, mounts the dev signing key at /app/keys, generates the key with named-curve encoding (+ self-heals a bad one), prune removes it, and the e2e test uses the same encoding. Signed-off-by: Konstantin Tursunov <Konstantin.Tursunov@constructor.tech>

coderabbitai

🧹 Nitpick comments (1)

dev-compose.sh (1)
253-254: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Consider checking ensure_authenticator_dev_key return value.

If openssl is unavailable, the function prints a warning and returns 1, but the caller ignores the exit code and proceeds with docker compose up. The authenticator container will then fail at startup with a missing key file. A simple guard would give a clearer early failure.
🛡️ Proposed fix
   # Ensure the authenticator's dev signing key exists before bring-up.
-  ensure_authenticator_dev_key
+  ensure_authenticator_dev_key || {
+    echo "ERROR: authenticator dev key generation failed — aborting up." >&2
+    return 1
+  }
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@dev-compose.sh` around lines 253 - 254, Update the caller of
ensure_authenticator_dev_key to check its return status and stop before docker
compose up when key generation fails, preserving a clear early failure instead
of continuing with a missing signing key.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@dev-compose.sh`:
- Around line 253-254: Update the caller of ensure_authenticator_dev_key to
check its return status and stop before docker compose up when key generation
fails, preserving a clear early failure instead of continuing with a missing
signing key.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d24406f7-f6c3-4869-b2e1-4934cc0e984c

📥 Commits

Reviewing files that changed from the base of the PR and between 3018e37 and 394fda8.

📒 Files selected for processing (4)

.env.compose.example
dev-compose.sh
docker-compose.yml
src/backend/services/authenticator/tests/run-e2e.sh

run-e2e.sh is the authenticator's standalone test harness, not part of the compose dev stack. Scope this PR to the dev-compose bring-up only; the e2e named-curve alignment can go separately if wanted. Signed-off-by: Konstantin Tursunov <Konstantin.Tursunov@constructor.tech>

ktursunov requested a review from a team as a code owner July 13, 2026 13:34

Konstantin Tursunov added 4 commits July 13, 2026 16:42

ktursunov changed the title ~~feat(dev-compose): AUTH_MODE toggle + fix authenticator dev bring-up~~ fix(dev-compose): authenticator dev bring-up (build binary, mount + named-curve key) Jul 13, 2026

coderabbitai Bot reviewed Jul 13, 2026

View reviewed changes

ktursunov requested a review from cyberantonz July 13, 2026 14:40

cyberantonz approved these changes Jul 13, 2026

View reviewed changes

Merge branch 'main' into feat/compose-auth-mode-toggle

9192adb

ktursunov enabled auto-merge July 14, 2026 06:49

ktursunov merged commit bcd0875 into constructorfabric:main Jul 14, 2026
11 checks passed

coderabbitai Bot mentioned this pull request Jul 14, 2026

feat(authenticator): nginx+auth step 06 — service tokens + internal listener #1751

Merged

This was referenced Jul 15, 2026

nginx+auth 07 — downstream gateway-JWT verification (R1) in analytics + identity #1777

Merged

feat(compose): improve local development workflow #1857

Merged

Navigation Menu

Uh oh!

fix(dev-compose): authenticator dev bring-up (build binary, mount + named-curve key) - #1750

fix(dev-compose): authenticator dev bring-up (build binary, mount + named-curve key)#1750
ktursunov merged 7 commits into
constructorfabric:mainfrom
ktursunov:feat/compose-auth-mode-toggle

ktursunov commented Jul 13, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 13, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ktursunov commented Jul 13, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Fixes

Testing

Note

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ktursunov commented Jul 13, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 13, 2026 •

edited

Loading