✨(core) automate oidc-store-refresh-token-key generation

OIDC_STORE_REFRESH_TOKEN_KEY is a mandatory secret key.
We can not push it on github and we want any contributor
to be able to run the app by only running bootstrap.
We then must generate the variable in the bootstrap.

Signed-off-by: charles <[email protected]>

Makefile

@@ -79,10 +79,16 @@ create-env-local-files:
 	@touch env.d/development/kc_postgresql.local
 .PHONY: create-env-local-files
 
+generate-secret-keys:
+generate-secret-keys: ## generate secret keys to be stored in common.local
+	@bin/generate-oidc-store-refresh-token-key.sh
+.PHONY: generate-secret-keys
+
 pre-bootstrap: \
 	data/media \
 	data/static \
-	create-env-local-files
+	create-env-local-files \
+	generate-secret-keys
 .PHONY: pre-bootstrap
 
 post-bootstrap: \

bin/fernetkey

@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-
-# shellcheck source=bin/_config.sh
-source "$(dirname "${BASH_SOURCE[0]}")/_config.sh"
-
-_dc_run app-dev python -c 'from cryptography.fernet import Fernet;import sys; sys.stdout.write("\n" + Fernet.generate_key().decode() + "\n");'

bin/generate-oidc-store-refresh-token-key.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+# Generate the secret OIDC_STORE_REFRESH_TOKEN_KEY and store it to common.local
+
+set -eo pipefail
+
+COMMON_LOCAL="env.d/development/common.local"
+
+OIDC_STORE_REFRESH_TOKEN_KEY=$(openssl rand -base64 32)
+
+echo "OIDC_STORE_REFRESH_TOKEN_KEY=${OIDC_STORE_REFRESH_TOKEN_KEY}" > "${COMMON_LOCAL}"
+echo "✓ OIDC_STORE_REFRESH_TOKEN_KEY generated and stored in ${COMMON_LOCAL}"

docs/search.md

@@ -38,4 +38,4 @@ OIDC_STORE_REFRESH_TOKEN_KEY="<your-32-byte-encryption-key==>"
 ```
 
 `OIDC_STORE_REFRESH_TOKEN_KEY` must be a valid Fernet key (32 url-safe base64-encoded bytes).
-To create one, use the `bin/fernetkey` command.
+To create one, use the `bin/generate-oidc-store-refresh-token-key.sh` command.

env.d/development/common

@@ -55,10 +55,6 @@ OIDC_AUTH_REQUEST_EXTRA_PARAMS={"acr_values": "eidas1"}
 OIDC_STORE_ACCESS_TOKEN=True
 OIDC_STORE_REFRESH_TOKEN=True # Store the encrypted refresh token in the session.
 
-# Must be a valid Fernet key (32 url-safe base64-encoded bytes)
-# To create one, use the bin/fernetkey command.
-# OIDC_STORE_REFRESH_TOKEN_KEY="your-32-byte-encryption-key=="
-
 # AI
 AI_FEATURE_ENABLED=true
 AI_BASE_URL=https://openaiendpoint.com