Skip to content

add oauth oidc #2074

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dmitry-sinina merged 5 commits into from
Aug 6, 2026
Merged

add oauth oidc #2074

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8364a5d
add oauth oidc
dmitry-sinina Aug 1, 2026
6142b1d
fixes
dmitry-sinina Aug 1, 2026
0e5546a
fixes
dmitry-sinina Aug 4, 2026
6a1f782
remove comments
dmitry-sinina Aug 4, 2026
3eab9da
remove comments
dmitry-sinina Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,10 @@ config/click_house.yml
config/secrets.yml
config/ldap.yml
config/oidc.yml
# Signs the id_tokens yeti issues as an OIDC provider — reading it is enough to
# forge an identity for any admin. Deploy it out of band. The test suite uses
# this same path, generated by the Makefile's $(oidc_test_key) rule.
config/oidc_signing_key.pem
coverage
debian/files
debian/yeti-web
Expand Down
5 changes: 5 additions & 0 deletions Gemfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,11 @@ gem 'responders'
gem 'activeadmin-oidc', github: 'activeadmin-plugins/activeadmin-oidc'
gem 'devise', '>= 4.6.0'
gem 'doorkeeper', '~> 5.9'
# OIDC layer on top of Doorkeeper: id_token, /.well-known/openid-configuration,
# JWKS and userinfo. Always configured (it has to be — see
# config/initializers/doorkeeper_openid_connect.rb), but exposes nothing unless
# YetiConfig.oauth.oidc.enabled.
gem 'doorkeeper-openid_connect', '~> 1.10'
gem 'ostruct', '~> 0.6.3'

# Seamless JWT authentication for Rails API
Expand Down
113 changes: 59 additions & 54 deletions Gemfile.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,46 +105,46 @@ GEM
specs:
action_text-trix (2.1.19)
railties
actioncable (8.1.3)
actionpack (= 8.1.3)
activesupport (= 8.1.3)
actioncable (8.1.3.1)
actionpack (= 8.1.3.1)
activesupport (= 8.1.3.1)
nio4r (~> 2.0)
websocket-driver (>= 0.6.1)
zeitwerk (~> 2.6)
actionmailbox (8.1.3)
actionpack (= 8.1.3)
activejob (= 8.1.3)
activerecord (= 8.1.3)
activestorage (= 8.1.3)
activesupport (= 8.1.3)
actionmailbox (8.1.3.1)
actionpack (= 8.1.3.1)
activejob (= 8.1.3.1)
activerecord (= 8.1.3.1)
activestorage (= 8.1.3.1)
activesupport (= 8.1.3.1)
mail (>= 2.8.0)
actionmailer (8.1.3)
actionpack (= 8.1.3)
actionview (= 8.1.3)
activejob (= 8.1.3)
activesupport (= 8.1.3)
actionmailer (8.1.3.1)
actionpack (= 8.1.3.1)
actionview (= 8.1.3.1)
activejob (= 8.1.3.1)
activesupport (= 8.1.3.1)
mail (>= 2.8.0)
rails-dom-testing (~> 2.2)
actionpack (8.1.3)
actionview (= 8.1.3)
activesupport (= 8.1.3)
actionpack (8.1.3.1)
actionview (= 8.1.3.1)
activesupport (= 8.1.3.1)
nokogiri (>= 1.8.5)
rack (>= 2.2.4)
rack-session (>= 1.0.1)
rack-test (>= 0.6.3)
rails-dom-testing (~> 2.2)
rails-html-sanitizer (~> 1.6)
useragent (~> 0.16)
actiontext (8.1.3)
actiontext (8.1.3.1)
action_text-trix (~> 2.1.15)
actionpack (= 8.1.3)
activerecord (= 8.1.3)
activestorage (= 8.1.3)
activesupport (= 8.1.3)
actionpack (= 8.1.3.1)
activerecord (= 8.1.3.1)
activestorage (= 8.1.3.1)
activesupport (= 8.1.3.1)
globalid (>= 0.6.0)
nokogiri (>= 1.8.5)
actionview (8.1.3)
activesupport (= 8.1.3)
actionview (8.1.3.1)
activesupport (= 8.1.3.1)
builder (~> 3.1)
erubi (~> 1.11)
rails-dom-testing (~> 2.2)
Expand All @@ -171,28 +171,28 @@ GEM
kaminari (>= 1.2.1)
railties (>= 6.1)
ransack (>= 4.0)
activejob (8.1.3)
activesupport (= 8.1.3)
activejob (8.1.3.1)
activesupport (= 8.1.3.1)
globalid (>= 0.3.6)
activemodel (8.1.3)
activesupport (= 8.1.3)
activemodel (8.1.3.1)
activesupport (= 8.1.3.1)
activemodel-serializers-xml (1.0.3)
activemodel (>= 5.0.0.a)
activesupport (>= 5.0.0.a)
builder (~> 3.1)
activerecord (8.1.3)
activemodel (= 8.1.3)
activesupport (= 8.1.3)
activerecord (8.1.3.1)
activemodel (= 8.1.3.1)
activesupport (= 8.1.3.1)
timeout (>= 0.4.0)
activerecord-import (2.2.0)
activerecord (>= 4.2)
activestorage (8.1.3)
actionpack (= 8.1.3)
activejob (= 8.1.3)
activerecord (= 8.1.3)
activesupport (= 8.1.3)
activestorage (8.1.3.1)
actionpack (= 8.1.3.1)
activejob (= 8.1.3.1)
activerecord (= 8.1.3.1)
activesupport (= 8.1.3.1)
marcel (~> 1.0)
activesupport (8.1.3)
activesupport (8.1.3.1)
base64
bigdecimal
concurrent-ruby (~> 1.0, >= 1.3.1)
Expand Down Expand Up @@ -317,6 +317,10 @@ GEM
docile (1.4.1)
doorkeeper (5.9.3)
railties (>= 5)
doorkeeper-openid_connect (1.10.5)
doorkeeper (>= 5.5, < 6.0)
jwt (>= 2.5)
ostruct (>= 0.5)
draper (4.0.6)
actionpack (>= 5.0)
activemodel (>= 5.0)
Expand Down Expand Up @@ -457,7 +461,7 @@ GEM
csv
mini_mime (>= 1.0.0)
multi_xml (>= 0.5.2)
httpx (1.8.0)
httpx (1.8.1)
http-2 (>= 1.2.0)
i18n (1.15.2)
concurrent-ruby (~> 1.0)
Expand Down Expand Up @@ -832,20 +836,20 @@ GEM
rack (>= 1.3)
rackup (2.3.1)
rack (>= 3)
rails (8.1.3)
actioncable (= 8.1.3)
actionmailbox (= 8.1.3)
actionmailer (= 8.1.3)
actionpack (= 8.1.3)
actiontext (= 8.1.3)
actionview (= 8.1.3)
activejob (= 8.1.3)
activemodel (= 8.1.3)
activerecord (= 8.1.3)
activestorage (= 8.1.3)
activesupport (= 8.1.3)
rails (8.1.3.1)
actioncable (= 8.1.3.1)
actionmailbox (= 8.1.3.1)
actionmailer (= 8.1.3.1)
actionpack (= 8.1.3.1)
actiontext (= 8.1.3.1)
actionview (= 8.1.3.1)
activejob (= 8.1.3.1)
activemodel (= 8.1.3.1)
activerecord (= 8.1.3.1)
activestorage (= 8.1.3.1)
activesupport (= 8.1.3.1)
bundler (>= 1.15.0)
railties (= 8.1.3)
railties (= 8.1.3.1)
rails-dom-testing (2.3.0)
activesupport (>= 5.0.0)
minitest
Expand All @@ -857,9 +861,9 @@ GEM
rack
railties (>= 5.1)
semantic_logger (~> 4.16)
railties (8.1.3)
actionpack (= 8.1.3)
activesupport (= 8.1.3)
railties (8.1.3.1)
actionpack (= 8.1.3.1)
activesupport (= 8.1.3.1)
irb (~> 1.13)
rackup (>= 1.0.0)
rake (>= 12.2)
Expand Down Expand Up @@ -1106,6 +1110,7 @@ DEPENDENCIES
delayed_job_active_record
devise (>= 4.6.0)
doorkeeper (~> 5.9)
doorkeeper-openid_connect (~> 1.10)
draper
dry-validation (~> 1.0)
elasticsearch
Expand Down
32 changes: 25 additions & 7 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@ exclude_files := config/database.yml \
config/click_house.yml \
config/policy_roles.yml \
config/secrets.yml \
config/oidc_signing_key.pem \
config/cdr_processors.yml.distr \
*.o \
*.a
Expand All @@ -42,6 +43,12 @@ bundle_bin := $(gems)/bin/bundle
bundler_gems := $(CURDIR)/vendor/bundle
export GEM_PATH := $(gems):$(bundler_gems)

# RSA key for the OIDC provider, generated rather than committed. Same path an
# operator deploys to, so a dev box has one key for `rails s` and for the specs.
# It lives in config/, which $(app_files) packages — $(exclude_files) is what
# keeps it out of the .deb, and must stay that way.
oidc_test_key := config/oidc_signing_key.pem

# must match final destination in debian package
export RBENV_ROOT := $(app_dir)/vendor/rbenv
export PATH := $(RBENV_ROOT)/shims:$(PATH)
Expand Down Expand Up @@ -112,6 +119,16 @@ config/policy_roles.yml:
$(info:msg=Creating policy_roles.yml for build/tests)
cp config/policy_roles.yml.distr config/policy_roles.yml

$(oidc_test_key):
$(info:msg=Generating OIDC signing key for build/tests)
@# yeti_web.yml.ci turns the OIDC provider on, and the initializer refuses to
@# boot without a readable signing key — so every target that loads the Rails
@# environment needs this first. Generated by the same rake task operators
@# run in production, so the key here has the parameters a real one does.
@# It signs nothing but test tokens; a private key committed to the repo
@# trips secret scanning regardless of what it protects.
$(bundle_bin) exec rake 'oauth:oidc:generate_signing_key[$(oidc_test_key)]'


$(RBENV_ROOT)/versions/$(rbenv_version):
$(info:msg=Installing ruby $(rbenv_version) into $(RBENV_ROOT))
Expand Down Expand Up @@ -155,7 +172,7 @@ gems-test: bundler


.PHONY: docs
docs: gems-test config/database.yml config/yeti_web.yml config/policy_roles.yml config/secrets.yml config/click_house.yml
docs: gems-test config/database.yml config/yeti_web.yml config/policy_roles.yml $(oidc_test_key) config/secrets.yml config/click_house.yml
$(info:msg=Preparing test database for docs generation)
RAILS_ENV=test $(bundle_bin) exec rake \
db:drop \
Expand All @@ -170,14 +187,14 @@ docs: gems-test config/database.yml config/yeti_web.yml config/policy_roles.yml


.PHONY: assets
assets: gems config/database.yml config/yeti_web.yml config/policy_roles.yml config/secrets.yml
assets: gems config/database.yml config/yeti_web.yml config/policy_roles.yml $(oidc_test_key) config/secrets.yml
$(info:msg=Precompile assets)
RAILS_ENV=production RAILS_COMPILE_ASSETS=true $(bundle_bin) exec rake assets:precompile



.PHONY: prepare-test-db
prepare-test-db: gems-test config/database.yml config/yeti_web.yml config/policy_roles.yml
prepare-test-db: gems-test config/database.yml config/yeti_web.yml config/policy_roles.yml $(oidc_test_key)
$(info:msg=Preparing test database)
RAILS_ENV=test $(bundle_bin) exec rake parallel:drop
@# avoid race condition when createing pgq roles in parallel with
Expand All @@ -204,7 +221,7 @@ test: lint audit brakeman rspec


.PHONY: rspec
rspec: gems-test config/database.yml config/yeti_web.yml config/policy_roles.yml prepare-test-db config/click_house.yml config/secrets.yml
rspec: gems-test config/database.yml config/yeti_web.yml config/policy_roles.yml $(oidc_test_key) prepare-test-db config/click_house.yml config/secrets.yml
ifdef spec
$(info:msg=Testing spec $(spec))
RAILS_ENV=test $(bundle_bin) exec rspec "$(spec)"
Expand All @@ -229,12 +246,12 @@ else
endif

.PHONY: database_consistency
database_consistency: gems-test config/database.yml config/yeti_web.yml config/policy_roles.yml config/secrets.yml prepare-test-db
database_consistency: gems-test config/database.yml config/yeti_web.yml config/policy_roles.yml $(oidc_test_key) config/secrets.yml prepare-test-db
$(info:msg=Check the consistency of the database constraints with the application validations)
RAILS_ENV=test $(bundle_bin) exec database_consistency

.PHONY: annotations
annotations: gems-test config/database.yml config/yeti_web.yml config/policy_roles.yml config/secrets.yml prepare-test-db
annotations: gems-test config/database.yml config/yeti_web.yml config/policy_roles.yml $(oidc_test_key) config/secrets.yml prepare-test-db
$(info:msg=Check that model annotations are up to date)
RAILS_ENV=test $(bundle_bin) exec annotaterb models --frozen

Expand Down Expand Up @@ -280,7 +297,8 @@ clean:
rm -fv config/database.yml \
config/yeti_web.yml \
config/policy_roles.yml \
config/secrets.yml
config/secrets.yml \
$(oidc_test_key)
rm -fv bin/rspec


Expand Down
Loading
Loading