feat: add stable OIDC authentication

2026-07-12 05:14:23 +08:00
parent 1e82253f43
commit b9c0e1a7a5
13 changed files with 861 additions and 23 deletions
@@ -21,6 +21,16 @@ type Config struct {
 	JWTSecret                       string
 	ServerMainBaseURL               string
 	ServerMainInternalToken         string
+	ServerMainInternalKey           string
+	ServerMainInternalSecret        string
+	OIDCEnabled                     bool
+	OIDCIssuer                      string
+	OIDCAudience                    string
+	OIDCTenantID                    string
+	OIDCRolePrefix                  string
+	OIDCRequiredScopes              []string
+	OIDCJWKSCacheTTLSeconds         int
+	OIDCAcceptLegacyHS256           bool
 	PublicBaseURL                   string
 	WebBaseURL                      string
 	LocalGeneratedStorageDir        string
@@ -49,6 +59,16 @@ func Load() Config {
 			"/",
 		),
 		ServerMainInternalToken:     env("SERVER_MAIN_INTERNAL_TOKEN", ""),
+		ServerMainInternalKey:       env("SERVER_MAIN_INTERNAL_KEY", "gateway"),
+		ServerMainInternalSecret:    env("SERVER_MAIN_INTERNAL_SECRET", env("SERVER_MAIN_INTERNAL_TOKEN", "")),
+		OIDCEnabled:                 env("OIDC_ENABLED", "false") == "true",
+		OIDCIssuer:                  strings.TrimRight(env("OIDC_ISSUER", ""), "/"),
+		OIDCAudience:                env("OIDC_AUDIENCE", ""),
+		OIDCTenantID:                env("OIDC_TENANT_ID", ""),
+		OIDCRolePrefix:              env("OIDC_ROLE_PREFIX", "gateway."),
+		OIDCRequiredScopes:          splitCSV(env("OIDC_REQUIRED_SCOPES", "gateway.access")),
+		OIDCJWKSCacheTTLSeconds:     envInt("OIDC_JWKS_CACHE_TTL_SECONDS", 300),
+		OIDCAcceptLegacyHS256:       env("OIDC_ACCEPT_LEGACY_HS256", "true") == "true",
 		PublicBaseURL:               strings.TrimRight(env("AI_GATEWAY_PUBLIC_BASE_URL", env("PUBLIC_BASE_URL", "")), "/"),
 		WebBaseURL:                  strings.TrimRight(env("AI_GATEWAY_WEB_BASE_URL", env("GATEWAY_WEB_BASE_URL", env("PUBLIC_WEB_BASE_URL", ""))), "/"),
 		LocalGeneratedStorageDir:    env("AI_GATEWAY_GENERATED_STORAGE_DIR", env("LOCAL_GENERATED_STORAGE_DIR", env("AI_GATEWAY_STATIC_STORAGE_DIR", DefaultLocalGeneratedStorageDir))),
@@ -121,6 +141,17 @@ func normalizePostgresURL(raw string) string {
 	return parsed.String()
 }

+func splitCSV(value string) []string {
+	items := strings.Split(value, ",")
+	result := make([]string, 0, len(items))
+	for _, item := range items {
+		if trimmed := strings.TrimSpace(item); trimmed != "" {
+			result = append(result, trimmed)
+		}
+	}
+	return result
+}
+
 func withDatabase(raw string, databaseName string) string {
 	parsed, err := url.Parse(raw)
 	if err != nil || databaseName == "" {