feat: improve Keycloak device auth page to include SSO options

.github/scripts/setup-keycloak.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-export KC_VERSION=25.0.1
+export KC_VERSION=26.2.5
 curl -LO  https://github.com/keycloak/keycloak/releases/download/"${KC_VERSION}"/keycloak-"${KC_VERSION}".zip
 
 unzip -q keycloak-${KC_VERSION}.zip

controlplane/.env.example

@@ -16,6 +16,7 @@ CLICKHOUSE_MIGRATION_DSN="clickhouse://default:changeme@localhost:9000?database=
 
 # Security
 AUTH_JWT_SECRET="fkczyomvdprgvtmvkuhvprxuggkbgwld"
+AUTH_SSO_COOKIE_DOMAIN=
 
 # Keycloak
 KC_REALM="cosmo"

controlplane/package.json

@@ -49,7 +49,7 @@
     "@graphql-eslint/eslint-plugin": "^3.20.1",
     "@graphql-inspector/core": "^6.2.1",
     "@graphql-tools/utils": "^10.1.2",
-    "@keycloak/keycloak-admin-client": "^25.0.2",
+    "@keycloak/keycloak-admin-client": "26.2.5",
     "@octokit/webhooks-types": "^7.6.1",
     "@tiptap/core": "^2.1.13",
     "@wundergraph/composition": "workspace:*",

controlplane/src/core/auth-utils.ts

@@ -21,6 +21,7 @@ import { AuthenticationError } from './errors/errors.js';
 export type AuthUtilsOptions = {
   webBaseUrl: string;
   webErrorPath: string;
+  ssoCookieDomain: string | undefined;
   jwtSecret: string;
   oauth: {
     clientID: string;
@@ -112,7 +113,7 @@ export default class AuthUtils {
   createSsoCookie(res: FastifyReply, ssoSlug: string) {
     const currentDate = new Date();
     const userSsoCookie = cookie.serialize(cosmoIdpHintCookieName, ssoSlug, {
-      domain: this.webDomain,
+      domain: this.opts.ssoCookieDomain ?? this.webDomain,
       sameSite: 'lax',
       expires: new Date(currentDate.setFullYear(currentDate.getFullYear() + 1)),
       path: '/',

controlplane/src/core/build-server.ts

@@ -82,6 +82,7 @@ export interface BuildConfig {
   auth: {
     webBaseUrl: string;
     secureCookie?: boolean;
+    ssoCookieDomain?: string;
     webErrorPath: string;
     secret: string;
     redirectUri: string;
@@ -235,6 +236,7 @@ export default async function build(opts: BuildConfig) {
       cookieName: pkceCodeVerifierCookieName,
     },
     webBaseUrl: opts.auth.webBaseUrl,
+    ssoCookieDomain: opts.auth.ssoCookieDomain,
     webErrorPath: opts.auth.webErrorPath,
   });
 

controlplane/src/core/env.schema.ts

@@ -57,6 +57,14 @@ export const envVariables = z
      * Auth
      */
     AUTH_JWT_SECRET: z.string().min(32).max(32),
+    AUTH_SSO_COOKIE_DOMAIN: z
+      .string()
+      .transform((val) => (val?.trim() === '' ? undefined : val))
+      .optional()
+      .refine(
+        (val) => !val || /^[\d.a-z-]+$/i.test(val),
+        'AUTH_SSO_COOKIE_DOMAIN must be a valid domain (e.g. ".example.com")',
+      ),
     AUTH_REDIRECT_URI: z.string().url(),
     /**
      * Database

controlplane/src/index.ts

@@ -24,6 +24,7 @@ const {
   AUTH_REDIRECT_URI,
   WEB_BASE_URL,
   AUTH_JWT_SECRET,
+  AUTH_SSO_COOKIE_DOMAIN,
   KC_REALM,
   KC_LOGIN_REALM,
   KC_CLIENT_ID,
@@ -100,6 +101,7 @@ const options: BuildConfig = {
     secret: AUTH_JWT_SECRET,
     webBaseUrl: WEB_BASE_URL,
     webErrorPath: '/auth/error',
+    ssoCookieDomain: AUTH_SSO_COOKIE_DOMAIN,
   },
   webhook: {
     url: WEBHOOK_URL,