feat(auth): add upstream OIDC preflight check and staging validation overlay - #3
Open
binyangzhu000-sudo wants to merge 7 commits into
Conversation
…llout-prep-20260818
…overlay Public production requires AUTH_IDENTITY_MODE=upstream-oidc, but nothing in the repository let an operator confirm a candidate issuer before requesting DNS, secrets, and a deployment window, and the only way to exercise the mode was to promote straight to production. - scripts/check-upstream-oidc.mjs mirrors the discovery-time rules enforced by src/auth/upstream-oidc.ts and src/auth/config.ts, needs no build step or client secret, and prints the AUTH_UPSTREAM_ENDPOINT_HOSTS value implied by the discovery document. Endpoints commonly live on hosts other than the issuer, so that value is easy to get wrong by hand. - deploy/kubernetes/staging-upstream-oidc.example applies the production identity and credential profile to the staging hosts while keeping PLUGIN_RELEASE_TIER=staging. - docs/UPSTREAM_OIDC_REQUIREMENTS.md records every provider requirement, including the id_token email_verified boolean that discovery cannot prove.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
生产要求
AUTH_IDENTITY_MODE=upstream-oidc，但仓库里原先没有任何东西能让人在申请 DNS / 密钥 / 部署窗口之前先确认一个候选 issuer 合不合格；而且唯一能跑这个模式的路径是直接上生产。改了什么
scripts/check-upstream-oidc.mjs：把src/auth/upstream-oidc.ts与src/auth/config.ts在 discovery 阶段强制的规则逐条复刻成自检脚本。不需要 build、不需要 client secret、不需要集群，身份方自己就能跑。它还会直接打印 discovery 文档隐含的AUTH_UPSTREAM_ENDPOINT_HOSTS值——端点常常不在 issuer 主机上（Google 就是三个不同主机），手填极易漏。deploy/kubernetes/staging-upstream-oidc.example/：把生产的身份与凭据画像套到 staging 主机上（upstream-oidc+redis-subject-map+ 加密密钥环，删掉OIDC_USERS_JSON与MCP_ATLAS_SUBJECT_KEYS_JSON），但保留PLUGIN_RELEASE_TIER=staging，因此带 staging 字样的 issuer 在这里可用、在生产闸门仍被拒。docs/UPSTREAM_OIDC_REQUIREMENTS.md：记录 provider 必须满足的全部规则，含 discovery 层面验不出来的那条——id_token 的email_verified必须是布尔true。验证
tsc干净，npm test76/76 通过。accounts.google.com）19 项全过；四个 Atlas 候选域名全部 FAIL（三个不解析、www的 discovery 404）。kubectl kustomize验证渲染正确，生产 overlay 无回归。validate:production-config，输出PRODUCTION_CONFIG_VALID—— 说明生产 overlay 的变量集合完整自洽、不缺项。两点说明
fix/codex-oauth-callback-timeout-20260817而不是main，目的是把 review 范围收在本次新增的 6 个文件内。父分支自己的合并目标是一个独立待定问题：本仓库是公开仓库，而公开的main只有 32 个文件（纯 npm 版 MCP server），src/auth/、deploy/kubernetes/、reviewer 身份与取密码流程都只存在于未合并分支上——把它们合进main等于公开内网 K8s 清单、镜像仓库路径与 dev 域名。合并范围建议由仓库负责人决定。scripts/codex-oauth-e2e.mjs与npm run test:codex-oauth:chrome-live都从 stdin 读 reviewer 密码、无法驱动上游登录，所以启用期间浏览器流程需人工验证。这一点已写进deploy/kubernetes/README.md。关联
上游 provider 已在
AtlasCloudTeam/kubedl侧实现（PR AtlasCloudTeam/kubedl#601），已用本仓库的真实校验代码跨仓库验证通过。