Edouard Vanbelle
84 lines
4.0 KiB
Bash
84 lines
4.0 KiB
Bash
# OxiCloud test-server env file for the OIDC integration test.
|
|
#
|
|
# Layered on top of server.env: identical to the default test-server
|
|
# config EXCEPT the OIDC client is enabled and pointed at the fake
|
|
# IdP under tests/oidc/fake_idp/ (a panva/node-oidc-provider wrapper
|
|
# started by tests/oidc/run.sh).
|
|
#
|
|
# Run pattern (used by tests/oidc/run.sh):
|
|
# bash tests/common/spawn-db.sh
|
|
# node tests/oidc/fake_idp/server.js & # auto-approve OIDC IdP on :1080
|
|
# ./target/debug/oxicloud --config tests/common/server-with-oidc.env
|
|
#
|
|
# `--config` makes the binary read THIS file verbatim — there is no
|
|
# auto-merge with server.env, so every variable the server needs has
|
|
# to be repeated here. Keeping the duplication explicit beats a sourcing
|
|
# scheme: dotenvy doesn't follow `source` directives, and the matrix of
|
|
# "which env file is in effect" is easier to read when each one is
|
|
# self-contained.
|
|
|
|
# ── Shared test config (mirrors server.env) ────────────────────────────────
|
|
DATABASE_URL=postgres://oxicloud_test:oxicloud_test@localhost:5433/oxicloud_test
|
|
OXICLOUD_DB_CONNECTION_STRING=postgres://oxicloud_test:oxicloud_test@localhost:5433/oxicloud_test
|
|
OXICLOUD_STATIC_PATH=./static
|
|
OXICLOUD_JWT_SECRET=test-secret-do-not-use-in-prod-minimum-32-chars
|
|
OXICLOUD_ENABLE_AUTH=true
|
|
OXICLOUD_ENABLE_TRASH=true
|
|
OXICLOUD_ENABLE_SEARCH=true
|
|
OXICLOUD_ENABLE_FILE_SHARING=true
|
|
OXICLOUD_ENABLE_MUSIC=true
|
|
OXICLOUD_EXPOSE_SYSTEM_USERS=true
|
|
OXICLOUD_WOPI_ENABLED=false
|
|
OXICLOUD_NEXTCLOUD_ENABLED=true
|
|
|
|
RUST_LOG="warn,audit=info,oxicloud::infrastructure::services::oidc_service=info,oxicloud::application::services::auth_application_service=info"
|
|
|
|
OXICLOUD_RATE_LIMIT_REFRESH_MAX=3600
|
|
OXICLOUD_RATE_LIMIT_LOGIN_MAX=3600
|
|
OXICLOUD_RATE_LIMIT_REGISTER_MAX=3600
|
|
OXICLOUD_TRUST_PROXY_CIDR=0.0.0.0/0
|
|
|
|
# Mock SMTP — same block as server.env. Required so `magic-link/send`
|
|
# reaches the policy gate (returns 403 MagicLinkLoginDisabled under the
|
|
# OIDC-master rule) instead of short-circuiting to 503 ServiceUnavailable
|
|
# because the invite service is unconfigured. The captured-mail endpoint
|
|
# is still available even when magic-link login is refused — invitations
|
|
# to non-OIDC recipients still route through this transport.
|
|
OXICLOUD_SMTP_MOCK=true
|
|
OXICLOUD_SMTP_HOST=localhost
|
|
OXICLOUD_SMTP_PORT=25
|
|
OXICLOUD_SMTP_FROM='OxiCloud Tests <test@oxicloud.local>'
|
|
OXICLOUD_SMTP_TLS=none
|
|
OXICLOUD_ALLOW_EXTERNAL_USERS=true
|
|
|
|
# ── OIDC client wired at the fake-idp sidecar ──────────────────────────────
|
|
# tests/oidc/fake_idp/server.js (panva/node-oidc-provider) publishes the
|
|
# issuer at the root URL; discovery is at /.well-known/openid-configuration
|
|
# under it. Update the `clients[0].client_id` field there in tandem if you
|
|
# rename the client.
|
|
OXICLOUD_OIDC_ENABLED=true
|
|
OXICLOUD_OIDC_ISSUER_URL=http://localhost:1080
|
|
OXICLOUD_OIDC_CLIENT_ID=oxicloud-test
|
|
OXICLOUD_OIDC_CLIENT_SECRET=test-client-secret-not-used-in-prod
|
|
# The IdP redirects back to this exact URL after auto-approving; must
|
|
# match the OxiCloud server's actual host + port (port 8087 from
|
|
# tests/api/test.env's base_url).
|
|
OXICLOUD_OIDC_REDIRECT_URI=http://localhost:8087/api/auth/oidc/callback
|
|
OXICLOUD_OIDC_SCOPES="openid profile email"
|
|
# Frontend redirect target after a successful callback. Tracks the
|
|
# d1bbe8ba fix: the backend appends `/login?oidc_code=…` to this base,
|
|
# so the value here is the SPA origin only.
|
|
OXICLOUD_OIDC_FRONTEND_URL=http://localhost:8087
|
|
OXICLOUD_OIDC_AUTO_PROVISION=true
|
|
OXICLOUD_OIDC_PROVIDER_NAME=MockSSO
|
|
# Group-to-role mapping. The fake IdP emits `groups: ["admin-users"]`
|
|
# in every id_token; with this env set, the JIT-provisioning code in
|
|
# auth_application_service.rs intersects the claim against this list
|
|
# and promotes the new user from `user` to `admin` on a non-empty
|
|
# match. This is the standard Authentik/Keycloak/Entra pattern: an
|
|
# IdP group becomes an OxiCloud role.
|
|
OXICLOUD_OIDC_ADMIN_GROUPS=admin-users
|
|
|
|
OXICLOUD_AUTH_METHODS=password,magic_link
|
|
OXICLOUD_REQUIRE_VERIFIED_EMAIL=false
|