feat: add stable OIDC authentication

2026-07-12 05:14:23 +08:00
parent 1e82253f43
commit b9c0e1a7a5
13 changed files with 861 additions and 23 deletions
@@ -23,9 +23,28 @@ CONFIG_JWT_SECRET=this is a very secret secret
 # - hybrid: both sources are accepted and separated by gateway_users.source.
 IDENTITY_MODE=hybrid

+# Auth Center stable OIDC verification. Keep legacy HS256 during the staged rollout.
+OIDC_ENABLED=false
+OIDC_ISSUER=https://auth.51easyai.com/issuer/shared
+OIDC_AUDIENCE=https://api.51easyai.com/gateway
+OIDC_TENANT_ID=
+OIDC_ROLE_PREFIX=gateway.
+OIDC_REQUIRED_SCOPES=gateway.access
+OIDC_JWKS_CACHE_TTL_SECONDS=300
+OIDC_ACCEPT_LEGACY_HS256=true
+OIDC_CLIENT_ID=
+OIDC_REDIRECT_URI=http://localhost:5178/auth/callback
+AI_GATEWAY_WEB_BASE_PATH=/
+AI_GATEWAY_GO_BUILD_IMAGE=golang:1.26.3-alpine
+AI_GATEWAY_API_RUNTIME_IMAGE=alpine:3.22
+AI_GATEWAY_NODE_BUILD_IMAGE=node:22-alpine
+AI_GATEWAY_WEB_RUNTIME_IMAGE=nginx:1.27-alpine
+
 # Used when the gateway delegates OpenAPI sk-* validation, user/group sync, file upload, and settlement callbacks.
 SERVER_MAIN_BASE_URL=http://localhost:3000
 SERVER_MAIN_INTERNAL_TOKEN=change-me
+SERVER_MAIN_INTERNAL_KEY=gateway
+SERVER_MAIN_INTERNAL_SECRET=change-me

 # Gateway writes progress events locally, then calls this server-main endpoint.
 # server-main receives the callback and pushes it through the existing WebSocket gateway.