3a16d6e9b1
- Replace next-auth v5 beta with better-auth v1.6.2 (stable releases)
- Add multi-provider OAuth support with admin UI configuration
- New oauthProviders table with encrypted secrets (AES-256-GCM)
- Env var bootstrap (OAUTH_*) syncs to DB, UI-created providers fully editable
- OAuth provider REST API: GET/POST/PUT/DELETE /api/v1/oauth-providers
- Settings page "Authentication Providers" section for admin management
- Account linking uses new accounts table (multi-provider per user)
- Username plugin for credentials sign-in (replaces email@localhost pattern)
- bcrypt password compatibility (existing hashes work)
- Database-backed sessions via Kysely adapter (bun:sqlite direct)
- Configurable rate limiting via AUTH_RATE_LIMIT_* env vars
- All DB columns migrated from snake_case to camelCase
- All TypeScript types/models migrated to camelCase properties
- Removed casing: "snake_case" from Drizzle config
- Callback URL format: {baseUrl}/api/auth/oauth2/callback/{providerId}
- package-lock.json removed and gitignored (using bun.lock)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
38 lines
1012 B
YAML
38 lines
1012 B
YAML
# Dex OIDC provider configuration for E2E tests.
|
|
# Provides static test users and a pre-configured OAuth client.
|
|
issuer: http://localhost:5556/dex
|
|
|
|
storage:
|
|
type: memory
|
|
|
|
web:
|
|
http: 0.0.0.0:5556
|
|
|
|
oauth2:
|
|
# Speed up tests — short-lived tokens
|
|
responseTypes: ["code"]
|
|
skipApprovalScreen: true
|
|
|
|
staticClients:
|
|
- id: cpm-test-client
|
|
secret: cpm-test-secret
|
|
name: "CPM E2E Test"
|
|
redirectURIs:
|
|
- "http://localhost:3000/api/auth/oauth2/callback/dex"
|
|
|
|
enablePasswordDB: true
|
|
|
|
staticPasswords:
|
|
# Primary test user — will be granted forward auth access
|
|
- email: "alice@test.local"
|
|
# password: "password"
|
|
hash: "$2a$10$95mdmT5F.icxrUmXEC9Jf.pX2RWgMO0FD6.yqrrVnRwTzA/UrT7g2"
|
|
username: "alice"
|
|
userID: "alice-001"
|
|
# Secondary test user — will NOT be granted forward auth access (for denial tests)
|
|
- email: "bob@test.local"
|
|
# password: "password"
|
|
hash: "$2a$10$95mdmT5F.icxrUmXEC9Jf.pX2RWgMO0FD6.yqrrVnRwTzA/UrT7g2"
|
|
username: "bob"
|
|
userID: "bob-002"
|