gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(control-panel): add oidc account switching

Browse Source
This commit is contained in:
thanhnv
2026-07-18 14:05:35 +07:00
parent 03ddeb7123
commit ffff800295
5 changed files with 94 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/local-prod/idp/mock_idp.py
+68 -9
View File
@@ -1,6 +1,7 @@
#!/usr/bin/env python3
import json
import hmac
import html
import os
import time
import uuid
@@ -16,6 +17,20 @@ ISSUER = os.environ.get("CASAN_IDP_ISSUER", f"http://127.0.0.1:{PORT}")
DEFAULT_SUB = os.environ.get("CASAN_IDP_SUB", "oidc-ops")
DEFAULT_EMAIL = os.environ.get("CASAN_IDP_EMAIL", "oidc-ops@example.com")
DEFAULT_GROUPS = [g for g in os.environ.get("CASAN_IDP_GROUPS", "casan-org-admin,casan-approver").split(",") if g]
USERS = {
DEFAULT_SUB: {
"name": "Operations Owner",
"email": DEFAULT_EMAIL,
"groups": DEFAULT_GROUPS,
"description": "Creates and operates governed runs",
},
"oidc-reviewer": {
"name": "Independent Reviewer",
"email": "oidc-reviewer@example.com",
"groups": ["casan-approver"],
"description": "Reviews and approves another operator's proposal",
},
}
KID = "casan-local-prod-idp"
KEY = rsa.generate_private_key(public_exponent=65537, key_size=2048)
CODES = {}
@@ -41,14 +56,15 @@ def jwk():
}
def sign_claims(client_id="casan-control-panel", nonce="", ttl_s=300):
def sign_claims(identity=None, client_id="casan-control-panel", nonce="", ttl_s=300):
identity = identity or USERS[DEFAULT_SUB]
now = int(time.time())
claims = {
"iss": ISSUER,
"sub": DEFAULT_SUB,
"sub": identity.get("sub", DEFAULT_SUB),
"aud": client_id,
"email": DEFAULT_EMAIL,
"groups": DEFAULT_GROUPS,
"email": identity.get("email", DEFAULT_EMAIL),
"groups": identity.get("groups", DEFAULT_GROUPS),
"iat": now,
"exp": now + int(ttl_s),
}
@@ -67,6 +83,37 @@ class Handler(BaseHTTPRequestHandler):
self.end_headers()
self.wfile.write(body)
def send_html(self, code, body):
raw = body.encode()
self.send_response(code)
self.send_header("Content-Type", "text/html; charset=utf-8")
self.send_header("Content-Length", str(len(raw)))
self.send_header("Cache-Control", "no-store")
self.end_headers()
self.wfile.write(raw)
def login_page(self, query):
cards = []
base = {key: values[0] for key, values in query.items() if key != "user" and values}
for user_id, identity in USERS.items():
params = {**base, "user": user_id}
cards.append(
'<a class="identity" href="?{}">'
'<span class="avatar">{}</span><span><strong>{}</strong>'
'<small>{}</small><em>{}</em></span></a>'.format(
html.escape(urlencode(params), quote=True),
html.escape(identity["name"][0]),
html.escape(identity["name"]),
html.escape(user_id),
html.escape(identity["description"]),
)
)
template = """<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
<title>Sign in to CASAN</title><style>
*{box-sizing:border-box}body{margin:0;min-height:100vh;display:grid;place-items:center;background:radial-gradient(circle at top,#e0e7ff,#f8fafc 48%);font:15px system-ui;color:#0f172a}.panel{width:min(92vw,520px);background:#fff;border:1px solid #e2e8f0;border-radius:24px;padding:32px;box-shadow:0 24px 70px #47556922}.brand{color:#4f46e5;font-size:12px;font-weight:800;letter-spacing:.18em}.panel h1{margin:8px 0}.panel p{color:#64748b;margin:0 0 24px}.identity{display:flex;gap:14px;align-items:center;padding:16px;margin-top:12px;border:1px solid #e2e8f0;border-radius:16px;color:inherit;text-decoration:none;transition:.15s}.identity:hover{border-color:#818cf8;transform:translateY(-1px);box-shadow:0 10px 24px #6366f122}.avatar{display:grid;place-items:center;width:44px;height:44px;border-radius:14px;background:#eef2ff;color:#4f46e5;font-size:18px;font-weight:800}.identity span:last-child{display:grid;gap:2px}.identity small{color:#6366f1;font-weight:700}.identity em{color:#64748b;font-size:12px;font-style:normal}</style></head>
<body><main class="panel"><div class="brand">CASAN LOCAL OIDC</div><h1>Choose an identity</h1><p>Use separate operator and reviewer identities to preserve separation of duties.</p>__IDENTITY_CARDS__</main></body></html>"""
return template.replace("__IDENTITY_CARDS__", "".join(cards))
def do_GET(self): # noqa: N802
parsed = urlparse(self.path)
path = parsed.path
@@ -96,13 +143,18 @@ class Handler(BaseHTTPRequestHandler):
if not redirect_uri:
self.send_json(400, {"error": "missing_redirect_uri"})
return
user_id = q.get("user", [""])[0]
if user_id not in USERS:
self.send_html(200, self.login_page(q))
return
identity = USERS[user_id]
code = uuid.uuid4().hex
CODES[code] = {
"client_id": q.get("client_id", ["casan-control-panel"])[0],
"nonce": q.get("nonce", [""])[0],
"sub": DEFAULT_SUB,
"email": DEFAULT_EMAIL,
"groups": DEFAULT_GROUPS,
"sub": user_id,
"email": identity["email"],
"groups": identity["groups"],
}
params = {"code": code}
if q.get("state"):
@@ -112,7 +164,13 @@ class Handler(BaseHTTPRequestHandler):
self.send_header("Location", redirect_uri + sep + urlencode(params))
self.end_headers()
elif path == "/userinfo":
self.send_json(200, {"sub": DEFAULT_SUB, "email": DEFAULT_EMAIL, "groups": DEFAULT_GROUPS})
authorization = self.headers.get("Authorization", "")
token = authorization.removeprefix("Bearer ").strip()
try:
claims = jwt.decode(token, KEY.public_key(), algorithms=["RS256"], options={"verify_aud": False})
self.send_json(200, {"sub": claims["sub"], "email": claims["email"], "groups": claims["groups"]})
except Exception:
self.send_json(401, {"error": "invalid_token"})
else:
self.send_json(404, {"error": "not_found"})
@@ -156,7 +214,8 @@ class Handler(BaseHTTPRequestHandler):
if not rec:
self.send_json(400, {"error": "invalid_grant"})
return
token, claims = sign_claims(client_id=rec.get("client_id") or form.get("client_id", ["casan-control-panel"])[0],
token, claims = sign_claims(identity=rec,
client_id=rec.get("client_id") or form.get("client_id", ["casan-control-panel"])[0],
nonce=rec.get("nonce", ""))
self.send_json(200, {
"access_token": token,