From 334ce1395576e94a8df55ae366998ce74eb5d26e Mon Sep 17 00:00:00 2001 From: Konstantin Tursunov Date: Mon, 13 Jul 2026 16:33:45 +0300 Subject: [PATCH 1/6] feat(dev-compose): AUTH_MODE toggle + fix authenticator dev bring-up Add a single AUTH_MODE switch to the compose dev stack and fix the authenticator so it can actually start when auth is enabled. Toggle: - AUTH_MODE={off|oidc} in dev-compose.sh derives the gateway config (no-auth.yaml vs insight.yaml) and the frontend login mode (dev-impersonation vs OIDC), enforcing the two never coexist. Adds a --auth flag and .env.compose.example docs. Default: off. - docker-compose.yml: the api-gateway command now reads ${API_GATEWAY_CONFIG} (was hardcoded to no-auth.yaml). Authenticator dev bring-up fixes (required for AUTH_MODE=oidc): - dev-compose.sh builds the authenticator bin and installs it to the bind-mount path (was never built -> compose created the mount source as an empty dir -> OCI 'mount a directory onto a file' error on up). - docker-compose.yml mounts deploy/compose/authenticator-dev-keys at /app/keys (signing_keys_path was set but the dir was never mounted). - dev-compose.sh generates the dev ES256 key with ec_param_enc:named_curve (macOS LibreSSL otherwise emits explicit EC params the authenticator's p256 PKCS#8 loader rejects). Verified: AUTH_MODE=off brings the full stack up green (gateway no-auth, FE dev-impersonation, UI 200). AUTH_MODE=oidc brings the stack up but /auth/callback still 500s pending the authenticator->Identity caller-id fix (tracked separately). Signed-off-by: Konstantin Tursunov --- .env.compose.example | 31 ++++++++++++---------- dev-compose.sh | 63 +++++++++++++++++++++++++++++++++++++------- docker-compose.yml | 5 +++- 3 files changed, 75 insertions(+), 24 deletions(-) diff --git a/.env.compose.example b/.env.compose.example index 62667f591..1641bc940 100644 --- a/.env.compose.example +++ b/.env.compose.example @@ -118,20 +118,23 @@ SEEDED_LOCAL_CH= # Replace with the UUID present in your persons.insight_tenant_id. TENANT_DEFAULT_ID=00000000-df51-5b42-9538-d2b56b7ee953 -# The api-gateway dev command uses no-auth.yaml (auth_disabled=true) by -# default — all requests get root context. The plugin demands a non-empty -# issuer_url even when auth is off, so no-auth.yaml ships with a -# placeholder (https://no-auth.local/oauth2/default) that is never -# actually contacted. -# -# To enable real OIDC: edit src/backend/services/api-gateway/config/no-auth.yaml -# directly (it's bind-mounted; watchexec reloads). Flip auth_disabled to -# false, set oidc-authn-plugin.issuer_url + audience and -# auth-info.client_id / scopes. See CONTRIBUTING.md "Switch the gateway -# to real OIDC". -# -# The variables below are kept for the frontend (which reads -# VITE_OIDC_ISSUER / VITE_OIDC_CLIENT_ID). +# ── Auth mode ───────────────────────────────────────────────────────── +# AUTH_MODE is the single switch for authentication; dev-compose.sh derives +# every downstream knob from it (gateway config file + frontend login mode): +# off = api-gateway runs no-auth.yaml (auth_disabled=true, root context) +# and the frontend dev-impersonates VITE_DEV_USER_EMAIL. No login. +# oidc = api-gateway runs insight.yaml (auth enforced) and the frontend +# runs the real OIDC login via the authenticator + fakeidp. +# Override per run with `./dev-compose.sh up --auth=oidc`. +# NOTE: oidc brings the stack up, but /auth/callback currently 500s until the +# authenticator->Identity caller-id fix lands (tracked separately), and for +# browser login you also need `127.0.0.1 fakeidp` in /etc/hosts. +AUTH_MODE=off + +# The OIDC_* vars below are advanced overrides. In AUTH_MODE=oidc dev-compose.sh +# defaults them to the in-stack fakeidp/authenticator; set them to point at a +# real IdP instead. The frontend reads VITE_OIDC_ISSUER / VITE_OIDC_CLIENT_ID; +# dev-compose.sh clears them in AUTH_MODE=off. OIDC_ISSUER= # Also the authenticator's OIDC client_id (must equal fakeidp's default aud so # the id_token audience matches). Defaults to `insight-authenticator`. diff --git a/dev-compose.sh b/dev-compose.sh index 1b2a8e7cf..754025afb 100755 --- a/dev-compose.sh +++ b/dev-compose.sh @@ -105,6 +105,9 @@ Options: --build-only=svc1,svc2 Build only these; everything else from ghcr. --frontend-mode=MODE Override FRONTEND_MODE for this run. (dev | built | ghcr) + --auth=MODE Override AUTH_MODE for this run (off | oidc). + off = no-auth gateway + FE dev-impersonation; + oidc = auth-enforced gateway + OIDC login. --no-frontend Don't start any frontend variant. --skip-build Don't rebuild artefacts — reuse what's already in deploy/compose/build/. @@ -127,7 +130,10 @@ ensure_authenticator_dev_key() { [[ -f "$key" ]] && return 0 mkdir -p "$dir" echo "=== Generating dev ES256 signing key for the authenticator ($key) ===" - if ! openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out "$key" 2>/dev/null; then + # ec_param_enc:named_curve is REQUIRED: LibreSSL (macOS default openssl) + # otherwise emits explicit EC parameters, which the authenticator's p256 + # PKCS#8 loader rejects ("expected OBJECT IDENTIFIER, got SEQUENCE"). + if ! openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -pkeyopt ec_param_enc:named_curve -out "$key" 2>/dev/null; then echo "WARN: openssl unavailable — the authenticator will fail to start without $key" >&2 return 1 fi @@ -139,6 +145,7 @@ cmd_up() { local from_ghcr_csv="" local build_only_csv="" local frontend_mode_override="" + local auth_mode_override="" local skip_build=false local no_frontend=false @@ -152,6 +159,8 @@ cmd_up() { --build-only) build_only_csv="$2"; shift 2 ;; --frontend-mode=*) frontend_mode_override="${1#*=}"; shift ;; --frontend-mode) frontend_mode_override="$2"; shift 2 ;; + --auth=*) auth_mode_override="${1#*=}"; shift ;; + --auth) auth_mode_override="$2"; shift 2 ;; --skip-build) skip_build=true; shift ;; --no-frontend) no_frontend=true; shift ;; --start-airbyte|--start-argo) @@ -179,6 +188,35 @@ cmd_up() { [[ -n "$frontend_mode_override" ]] && FRONTEND_MODE="$frontend_mode_override" FRONTEND_MODE="${FRONTEND_MODE:-dev}" + # ── Auth mode: single switch that derives the gateway config + FE login. + # off = gateway no-auth.yaml + FE dev-impersonation (VITE_DEV_USER_EMAIL). + # oidc = gateway insight.yaml (auth enforced) + FE real OIDC via authenticator. + # These exports drive docker-compose's ${API_GATEWAY_CONFIG}, ${OIDC_ISSUER}, + # ${OIDC_CLIENT_ID}, and ${VITE_DEV_USER_EMAIL}, and enforce that + # dev-impersonation and OIDC never coexist (one XOR the other). + [[ -n "$auth_mode_override" ]] && AUTH_MODE="$auth_mode_override" + AUTH_MODE="${AUTH_MODE:-off}" + case "$AUTH_MODE" in + off) + export API_GATEWAY_CONFIG="/app/config/no-auth.yaml" + export OIDC_ISSUER="" OIDC_CLIENT_ID="" + export VITE_DEV_USER_EMAIL="${VITE_DEV_USER_EMAIL:-dev@company.nonpresent}" + ;; + oidc) + export API_GATEWAY_CONFIG="/app/config/insight.yaml" + export OIDC_ISSUER="${OIDC_ISSUER:-http://localhost:8083}" + export OIDC_CLIENT_ID="${OIDC_CLIENT_ID:-insight-authenticator}" + export VITE_DEV_USER_EMAIL="" + echo "NOTE: AUTH_MODE=oidc — /auth/callback still 500s until the" >&2 + echo " authenticator->Identity caller-id fix lands; add" >&2 + echo " '127.0.0.1 fakeidp' to /etc/hosts for browser login." >&2 + ;; + *) + echo "ERROR: AUTH_MODE must be off|oidc (got: $AUTH_MODE)" >&2 + return 1 + ;; + esac + # ── Resolve which services go to ghcr ──────────────────────────── local all_backend="api-gateway analytics identity" local ghcr_list="" @@ -260,7 +298,10 @@ YML # ── Build phase ────────────────────────────────────────────────── if [[ "$skip_build" != "true" ]]; then echo "=== Building artefacts (skip with --skip-build) ===" - local rust_bins="" + # authenticator is always built from source (no ghcr flip for it) and its + # binary is bind-mounted as a file — omit it and compose auto-creates the + # mount source as an empty directory, failing container init. + local rust_bins="authenticator" contains "$ghcr_list" api-gateway || rust_bins="$rust_bins insight-api-gateway" contains "$ghcr_list" analytics || rust_bins="$rust_bins analytics" rust_bins=$(trim "$rust_bins") @@ -275,9 +316,10 @@ YML apt-get update && apt-get install -y --no-install-recommends \ protobuf-compiler libprotobuf-dev pkg-config libssl-dev > /dev/null cargo build --release$bin_flags - mkdir -p /out/api-gateway /out/analytics + mkdir -p /out/api-gateway /out/analytics /out/authenticator [ -f /target/release/insight-api-gateway ] && install -m 0755 /target/release/insight-api-gateway /out/api-gateway/insight-api-gateway || true [ -f /target/release/analytics ] && install -m 0755 /target/release/analytics /out/analytics/analytics || true + [ -f /target/release/authenticator ] && install -m 0755 /target/release/authenticator /out/authenticator/authenticator || true " fi if ! contains "$ghcr_list" identity; then @@ -395,9 +437,10 @@ pick it up via ENABLE_AUTO_RELOAD. Targets: api-gateway Rust gateway binary only. analytics Rust analytics binary only. + authenticator Rust authenticator binary only. identity .NET 9 publish output. frontend pnpm build → dist/. - rust Both Rust services. + rust All three Rust services. all Everything (Rust + .NET + frontend). EOF } @@ -423,20 +466,22 @@ cmd_build() { apt-get update && apt-get install -y --no-install-recommends \ protobuf-compiler libprotobuf-dev pkg-config libssl-dev > /dev/null cargo build --release$bin_flags - mkdir -p /out/api-gateway /out/analytics + mkdir -p /out/api-gateway /out/analytics /out/authenticator [ -f /target/release/insight-api-gateway ] && install -m 0755 /target/release/insight-api-gateway /out/api-gateway/insight-api-gateway || true [ -f /target/release/analytics ] && install -m 0755 /target/release/analytics /out/analytics/analytics || true + [ -f /target/release/authenticator ] && install -m 0755 /target/release/authenticator /out/authenticator/authenticator || true " } case "$target" in - api-gateway) build_rust_bins insight-api-gateway ;; - analytics) build_rust_bins analytics ;; - rust) build_rust_bins insight-api-gateway analytics ;; + api-gateway) build_rust_bins insight-api-gateway ;; + analytics) build_rust_bins analytics ;; + authenticator) build_rust_bins authenticator ;; + rust) build_rust_bins insight-api-gateway analytics authenticator ;; identity) "${compose_cmd[@]}" run --rm build-dotnet ;; frontend) "${compose_cmd[@]}" run --rm build-frontend ;; all) - build_rust_bins insight-api-gateway analytics + build_rust_bins insight-api-gateway analytics authenticator "${compose_cmd[@]}" run --rm build-dotnet "${compose_cmd[@]}" run --rm build-frontend ;; diff --git a/docker-compose.yml b/docker-compose.yml index ed241bcc6..d8216a55c 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -213,7 +213,9 @@ services: - "--" - "/app/insight-api-gateway" - "-c" - - "/app/config/no-auth.yaml" + # Auth mode: dev-compose.sh sets API_GATEWAY_CONFIG from AUTH_MODE + # (off -> no-auth.yaml, oidc -> insight.yaml). Defaults to no-auth. + - "${API_GATEWAY_CONFIG:-/app/config/no-auth.yaml}" - "run" ports: - "${API_GATEWAY_PORT:-8080}:8080" @@ -327,6 +329,7 @@ services: volumes: - ./deploy/compose/build/authenticator/authenticator:/app/authenticator:ro - ./src/backend/services/authenticator/config:/app/config:ro + - ./deploy/compose/authenticator-dev-keys:/app/keys:ro command: - "/app/authenticator" # - "--" From 889eef9ef9264e709f3c9e72a7b21a7cba968e24 Mon Sep 17 00:00:00 2001 From: Konstantin Tursunov Date: Mon, 13 Jul 2026 16:42:51 +0300 Subject: [PATCH 2/6] fix(dev-compose): manage AUTH_MODE as an .env setting + self-heal the dev signing key - insight-init.sh writes AUTH_MODE (default off) into the generated .env.compose alongside FRONTEND_MODE, so the auth switch is a first-class setting rather than an implicit script default. - ensure_authenticator_dev_key now regenerates an existing key that is not a usable named-curve P-256 key (e.g. an older LibreSSL-generated explicit-params key), so `up` always leaves a key the authenticator can actually load. Signed-off-by: Konstantin Tursunov --- deploy/compose/insight-init.sh | 1 + dev-compose.sh | 9 ++++++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/deploy/compose/insight-init.sh b/deploy/compose/insight-init.sh index 03e59518f..f08953202 100755 --- a/deploy/compose/insight-init.sh +++ b/deploy/compose/insight-init.sh @@ -457,6 +457,7 @@ write_compose() { update_env_var "$env_file" VITE_DEV_USER_EMAIL "$DEV_USER_EMAIL" update_env_var "$env_file" FRONTEND_MODE "$fe_mode" update_env_var "$env_file" INSIGHT_FRONT_PATH "$fe_path" + update_env_var "$env_file" AUTH_MODE "off" # SEEDED_LOCAL_* gates the first-run auto-seed in dev-compose.sh. if [[ "$MARIADB_EXTERNAL" == "true" && "$seed_external" != "true" ]]; then diff --git a/dev-compose.sh b/dev-compose.sh index 754025afb..2a629d36f 100755 --- a/dev-compose.sh +++ b/dev-compose.sh @@ -127,7 +127,14 @@ EOF ensure_authenticator_dev_key() { local dir="deploy/compose/authenticator-dev-keys" local key="$dir/current.pem" - [[ -f "$key" ]] && return 0 + # Reuse an existing key only if it is a usable named-curve P-256 key. A key + # generated by an older dev-compose.sh on LibreSSL carries explicit EC + # parameters the authenticator's p256 loader rejects — regenerate those. + if [[ -f "$key" ]]; then + openssl asn1parse -in "$key" 2>/dev/null | grep -q prime256v1 && return 0 + echo "=== Regenerating authenticator dev key ($key): not named-curve P-256 ===" >&2 + rm -f "$key" + fi mkdir -p "$dir" echo "=== Generating dev ES256 signing key for the authenticator ($key) ===" # ec_param_enc:named_curve is REQUIRED: LibreSSL (macOS default openssl) From 06630ae7bb25165c7811fe5ad94ffc28826e256d Mon Sep 17 00:00:00 2001 From: Konstantin Tursunov Date: Mon, 13 Jul 2026 16:48:25 +0300 Subject: [PATCH 3/6] fix(dev-compose): prune removes the generated authenticator dev key MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit prune wiped build/, the override, and .env.compose but left deploy/compose/authenticator-dev-keys/ behind — a stale gitignored private key surviving a full state wipe. Remove it too (regenerated on the next up), and list it in the prune help + confirmation prose. Signed-off-by: Konstantin Tursunov --- dev-compose.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/dev-compose.sh b/dev-compose.sh index 2a629d36f..654e9f840 100755 --- a/dev-compose.sh +++ b/dev-compose.sh @@ -574,6 +574,8 @@ The main pass removes: • named volumes: mariadb-data, clickhouse-data, clickhouse-logs, redis-data, redpanda-data, rust-target, frontend-node-modules • host-side build artefacts under deploy/compose/build/ + • the generated authenticator dev signing key + (deploy/compose/authenticator-dev-keys/) • generated deploy/compose/override.generated.yml • .env.compose @@ -592,6 +594,7 @@ This will permanently remove the local Insight stack state: • named volumes (mariadb-data, clickhouse-data, redis-data, redpanda-data, rust-target, frontend-node-modules, ...) • deploy/compose/build/ artefacts + • deploy/compose/authenticator-dev-keys/ (dev signing key) • deploy/compose/override.generated.yml • .env.compose @@ -628,6 +631,10 @@ EOF echo "Removing deploy/compose/build/..." rm -rf deploy/compose/build/ fi + if [[ -d deploy/compose/authenticator-dev-keys ]]; then + echo "Removing deploy/compose/authenticator-dev-keys/ (dev signing key)..." + rm -rf deploy/compose/authenticator-dev-keys/ + fi if [[ -f "$override" ]]; then echo "Removing $override..." rm -f "$override" From 581213d1ddef2d469e64a2844db606b1528d3467 Mon Sep 17 00:00:00 2001 From: Konstantin Tursunov Date: Mon, 13 Jul 2026 16:50:04 +0300 Subject: [PATCH 4/6] test(authenticator): use named-curve key in e2e, isolated from the compose dev key MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit run-e2e.sh generated its ES256 key without ec_param_enc:named_curve, so on macOS LibreSSL it emitted explicit EC params the p256 loader rejects — diverging from the compose dev key generation. Align the command (same named-curve encoding as dev-compose.sh). The e2e key stays in its own mktemp dir, so it never clashes with deploy/compose/authenticator-dev-keys/. Signed-off-by: Konstantin Tursunov --- src/backend/services/authenticator/tests/run-e2e.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/backend/services/authenticator/tests/run-e2e.sh b/src/backend/services/authenticator/tests/run-e2e.sh index 11fc09fe4..af99a80b2 100644 --- a/src/backend/services/authenticator/tests/run-e2e.sh +++ b/src/backend/services/authenticator/tests/run-e2e.sh @@ -29,8 +29,12 @@ cleanup() { trap cleanup EXIT echo "==> dev ES256 signing key" +# Isolated key dir (mktemp) so this never touches the compose dev key at +# deploy/compose/authenticator-dev-keys/. ec_param_enc:named_curve keeps the +# key loadable on macOS LibreSSL (explicit EC params fail the p256 loader) — +# same encoding dev-compose.sh's ensure_authenticator_dev_key uses. KEYS_DIR="$(mktemp -d)" -openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out "$KEYS_DIR/current.pem" +openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -pkeyopt ec_param_enc:named_curve -out "$KEYS_DIR/current.pem" echo "==> Redis" docker rm -f "$REDIS_CT" >/dev/null 2>&1 || true From 394fda8ad943aa2bfa541e0303a4bccdad8c6704 Mon Sep 17 00:00:00 2001 From: Konstantin Tursunov Date: Mon, 13 Jul 2026 17:17:15 +0300 Subject: [PATCH 5/6] refactor(dev-compose): drop the AUTH_MODE toggle, keep authenticator dev bring-up fixes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The oidc auth mode can't complete login yet (authenticator->Identity person-resolution 401, tracked separately), so remove the AUTH_MODE toggle and its oidc path entirely — the compose stack is no-auth only, as before (gateway command back to a hardcoded no-auth.yaml). Kept: the authenticator dev bring-up fixes, so its container starts cleanly instead of crash-looping even though it's off the auth path — builds the authenticator binary, mounts the dev signing key at /app/keys, generates the key with named-curve encoding (+ self-heals a bad one), prune removes it, and the e2e test uses the same encoding. Signed-off-by: Konstantin Tursunov --- .env.compose.example | 24 +++++++---------------- deploy/compose/insight-init.sh | 1 - dev-compose.sh | 35 ---------------------------------- docker-compose.yml | 4 +--- 4 files changed, 8 insertions(+), 56 deletions(-) diff --git a/.env.compose.example b/.env.compose.example index 1641bc940..09bb2fc25 100644 --- a/.env.compose.example +++ b/.env.compose.example @@ -118,23 +118,13 @@ SEEDED_LOCAL_CH= # Replace with the UUID present in your persons.insight_tenant_id. TENANT_DEFAULT_ID=00000000-df51-5b42-9538-d2b56b7ee953 -# ── Auth mode ───────────────────────────────────────────────────────── -# AUTH_MODE is the single switch for authentication; dev-compose.sh derives -# every downstream knob from it (gateway config file + frontend login mode): -# off = api-gateway runs no-auth.yaml (auth_disabled=true, root context) -# and the frontend dev-impersonates VITE_DEV_USER_EMAIL. No login. -# oidc = api-gateway runs insight.yaml (auth enforced) and the frontend -# runs the real OIDC login via the authenticator + fakeidp. -# Override per run with `./dev-compose.sh up --auth=oidc`. -# NOTE: oidc brings the stack up, but /auth/callback currently 500s until the -# authenticator->Identity caller-id fix lands (tracked separately), and for -# browser login you also need `127.0.0.1 fakeidp` in /etc/hosts. -AUTH_MODE=off - -# The OIDC_* vars below are advanced overrides. In AUTH_MODE=oidc dev-compose.sh -# defaults them to the in-stack fakeidp/authenticator; set them to point at a -# real IdP instead. The frontend reads VITE_OIDC_ISSUER / VITE_OIDC_CLIENT_ID; -# dev-compose.sh clears them in AUTH_MODE=off. +# The api-gateway runs no-auth.yaml (auth_disabled=true) — all requests get +# the default-tenant root context, and the frontend dev-impersonates +# VITE_DEV_USER_EMAIL (below). OIDC login via the authenticator is not wired +# up for the compose dev stack. +# +# The OIDC_* vars below are read by the frontend (VITE_OIDC_ISSUER / +# VITE_OIDC_CLIENT_ID) but are unused while dev-impersonation is active. OIDC_ISSUER= # Also the authenticator's OIDC client_id (must equal fakeidp's default aud so # the id_token audience matches). Defaults to `insight-authenticator`. diff --git a/deploy/compose/insight-init.sh b/deploy/compose/insight-init.sh index f08953202..03e59518f 100755 --- a/deploy/compose/insight-init.sh +++ b/deploy/compose/insight-init.sh @@ -457,7 +457,6 @@ write_compose() { update_env_var "$env_file" VITE_DEV_USER_EMAIL "$DEV_USER_EMAIL" update_env_var "$env_file" FRONTEND_MODE "$fe_mode" update_env_var "$env_file" INSIGHT_FRONT_PATH "$fe_path" - update_env_var "$env_file" AUTH_MODE "off" # SEEDED_LOCAL_* gates the first-run auto-seed in dev-compose.sh. if [[ "$MARIADB_EXTERNAL" == "true" && "$seed_external" != "true" ]]; then diff --git a/dev-compose.sh b/dev-compose.sh index 654e9f840..e80a4f662 100755 --- a/dev-compose.sh +++ b/dev-compose.sh @@ -105,9 +105,6 @@ Options: --build-only=svc1,svc2 Build only these; everything else from ghcr. --frontend-mode=MODE Override FRONTEND_MODE for this run. (dev | built | ghcr) - --auth=MODE Override AUTH_MODE for this run (off | oidc). - off = no-auth gateway + FE dev-impersonation; - oidc = auth-enforced gateway + OIDC login. --no-frontend Don't start any frontend variant. --skip-build Don't rebuild artefacts — reuse what's already in deploy/compose/build/. @@ -152,7 +149,6 @@ cmd_up() { local from_ghcr_csv="" local build_only_csv="" local frontend_mode_override="" - local auth_mode_override="" local skip_build=false local no_frontend=false @@ -166,8 +162,6 @@ cmd_up() { --build-only) build_only_csv="$2"; shift 2 ;; --frontend-mode=*) frontend_mode_override="${1#*=}"; shift ;; --frontend-mode) frontend_mode_override="$2"; shift 2 ;; - --auth=*) auth_mode_override="${1#*=}"; shift ;; - --auth) auth_mode_override="$2"; shift 2 ;; --skip-build) skip_build=true; shift ;; --no-frontend) no_frontend=true; shift ;; --start-airbyte|--start-argo) @@ -195,35 +189,6 @@ cmd_up() { [[ -n "$frontend_mode_override" ]] && FRONTEND_MODE="$frontend_mode_override" FRONTEND_MODE="${FRONTEND_MODE:-dev}" - # ── Auth mode: single switch that derives the gateway config + FE login. - # off = gateway no-auth.yaml + FE dev-impersonation (VITE_DEV_USER_EMAIL). - # oidc = gateway insight.yaml (auth enforced) + FE real OIDC via authenticator. - # These exports drive docker-compose's ${API_GATEWAY_CONFIG}, ${OIDC_ISSUER}, - # ${OIDC_CLIENT_ID}, and ${VITE_DEV_USER_EMAIL}, and enforce that - # dev-impersonation and OIDC never coexist (one XOR the other). - [[ -n "$auth_mode_override" ]] && AUTH_MODE="$auth_mode_override" - AUTH_MODE="${AUTH_MODE:-off}" - case "$AUTH_MODE" in - off) - export API_GATEWAY_CONFIG="/app/config/no-auth.yaml" - export OIDC_ISSUER="" OIDC_CLIENT_ID="" - export VITE_DEV_USER_EMAIL="${VITE_DEV_USER_EMAIL:-dev@company.nonpresent}" - ;; - oidc) - export API_GATEWAY_CONFIG="/app/config/insight.yaml" - export OIDC_ISSUER="${OIDC_ISSUER:-http://localhost:8083}" - export OIDC_CLIENT_ID="${OIDC_CLIENT_ID:-insight-authenticator}" - export VITE_DEV_USER_EMAIL="" - echo "NOTE: AUTH_MODE=oidc — /auth/callback still 500s until the" >&2 - echo " authenticator->Identity caller-id fix lands; add" >&2 - echo " '127.0.0.1 fakeidp' to /etc/hosts for browser login." >&2 - ;; - *) - echo "ERROR: AUTH_MODE must be off|oidc (got: $AUTH_MODE)" >&2 - return 1 - ;; - esac - # ── Resolve which services go to ghcr ──────────────────────────── local all_backend="api-gateway analytics identity" local ghcr_list="" diff --git a/docker-compose.yml b/docker-compose.yml index d8216a55c..19296a469 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -213,9 +213,7 @@ services: - "--" - "/app/insight-api-gateway" - "-c" - # Auth mode: dev-compose.sh sets API_GATEWAY_CONFIG from AUTH_MODE - # (off -> no-auth.yaml, oidc -> insight.yaml). Defaults to no-auth. - - "${API_GATEWAY_CONFIG:-/app/config/no-auth.yaml}" + - "/app/config/no-auth.yaml" - "run" ports: - "${API_GATEWAY_PORT:-8080}:8080" From a65828ac57e32c68301ecb3031734f7b64d1788a Mon Sep 17 00:00:00 2001 From: Konstantin Tursunov Date: Mon, 13 Jul 2026 17:26:51 +0300 Subject: [PATCH 6/6] revert: drop e2e key change from this PR (not part of dev-compose) run-e2e.sh is the authenticator's standalone test harness, not part of the compose dev stack. Scope this PR to the dev-compose bring-up only; the e2e named-curve alignment can go separately if wanted. Signed-off-by: Konstantin Tursunov --- src/backend/services/authenticator/tests/run-e2e.sh | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/src/backend/services/authenticator/tests/run-e2e.sh b/src/backend/services/authenticator/tests/run-e2e.sh index af99a80b2..11fc09fe4 100644 --- a/src/backend/services/authenticator/tests/run-e2e.sh +++ b/src/backend/services/authenticator/tests/run-e2e.sh @@ -29,12 +29,8 @@ cleanup() { trap cleanup EXIT echo "==> dev ES256 signing key" -# Isolated key dir (mktemp) so this never touches the compose dev key at -# deploy/compose/authenticator-dev-keys/. ec_param_enc:named_curve keeps the -# key loadable on macOS LibreSSL (explicit EC params fail the p256 loader) — -# same encoding dev-compose.sh's ensure_authenticator_dev_key uses. KEYS_DIR="$(mktemp -d)" -openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -pkeyopt ec_param_enc:named_curve -out "$KEYS_DIR/current.pem" +openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out "$KEYS_DIR/current.pem" echo "==> Redis" docker rm -f "$REDIS_CT" >/dev/null 2>&1 || true