From f9990ddcc2a5c593bc0594dcaebd8e79c6e60905 Mon Sep 17 00:00:00 2001 From: Christophe Vila Date: Fri, 24 Jul 2026 21:41:32 +0200 Subject: [PATCH] geniusrund: construct the OIDC verifier and require its config at startup --- backend/cmd/geniusrund/main.go | 18 +++++++++++++++++- backend/start.sh | 8 ++++++++ 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/backend/cmd/geniusrund/main.go b/backend/cmd/geniusrund/main.go index 44b7ab6..f9ac804 100644 --- a/backend/cmd/geniusrund/main.go +++ b/backend/cmd/geniusrund/main.go @@ -12,6 +12,7 @@ import ( "time" "geniusrun/backend/internal/api" + "geniusrun/backend/internal/auth" "geniusrun/backend/internal/config" "geniusrun/backend/internal/garmin" "geniusrun/backend/internal/store" @@ -48,7 +49,22 @@ func main() { MinConfidence: cfg.MinConfidence, }, nil) - server := api.NewServer(db, garminClient, syncSvc) + authVerifier, err := auth.NewOIDCVerifier(context.Background(), auth.OIDCConfig{ + IssuerURL: cfg.OIDCIssuerURL, + ClientID: cfg.OIDCClientID, + ClientSecret: cfg.OIDCClientSecret, + RedirectURL: cfg.OIDCRedirectURL, + RequiredRole: cfg.OIDCRequiredRole, + }) + if err != nil { + log.Fatalf("oidc: %v", err) + } + + server := api.NewServer(db, garminClient, syncSvc, authVerifier, api.SessionConfig{ + Secret: cfg.SessionSecret, + Duration: cfg.SessionDuration, + Secure: cfg.SessionSecure, + }) ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM) defer stop() diff --git a/backend/start.sh b/backend/start.sh index 160a272..e67b1c8 100755 --- a/backend/start.sh +++ b/backend/start.sh @@ -6,4 +6,12 @@ export MCP_GARMIN_PYTHON="${MCP_GARMIN_PYTHON:-/Users/cvila/Dev/scm/scm.vilanet. export MCP_GARMIN_SERVER="${MCP_GARMIN_SERVER:-/Users/cvila/Dev/scm/scm.vilanet.fr/kriss/mcp-garmin/server.py}" export GENIUSRUN_DB_PATH="${GENIUSRUN_DB_PATH:-geniusrun.db}" +# OIDC login gate -- no safe default exists for a client secret or a +# session-signing key, so these must come from your own shell/CI secrets. +export GENIUSRUN_PUBLIC_BASE_URL="${GENIUSRUN_PUBLIC_BASE_URL:?set GENIUSRUN_PUBLIC_BASE_URL, e.g. https://geniusrun.example.com}" +export GENIUSRUN_OIDC_ISSUER_URL="${GENIUSRUN_OIDC_ISSUER_URL:?set GENIUSRUN_OIDC_ISSUER_URL, e.g. https://keycloak.example.com/realms/myrealm}" +export GENIUSRUN_OIDC_CLIENT_ID="${GENIUSRUN_OIDC_CLIENT_ID:?set GENIUSRUN_OIDC_CLIENT_ID}" +export GENIUSRUN_OIDC_CLIENT_SECRET="${GENIUSRUN_OIDC_CLIENT_SECRET:?set GENIUSRUN_OIDC_CLIENT_SECRET}" +export GENIUSRUN_SESSION_SECRET="${GENIUSRUN_SESSION_SECRET:?set GENIUSRUN_SESSION_SECRET to a random string >=32 characters}" + exec go run ./cmd/geniusrund