From 3f76a96de8a5ece5a0a28b41b269c5187d222e40 Mon Sep 17 00:00:00 2001 From: charles Date: Mon, 16 Feb 2026 15:35:41 +0100 Subject: [PATCH] =?UTF-8?q?=E2=9C=A8(core)=20automate=20oidc-store-refresh?= =?UTF-8?q?-token-key=20generation?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit OIDC_STORE_REFRESH_TOKEN_KEY is a mandatory secret key. We can not push it on github and we want any contributor to be able to run the app by only running bootstrap. We then must generate the variable in the bootstrap. Signed-off-by: charles --- Makefile | 8 +++++++- bin/fernetkey | 6 ------ bin/generate-oidc-store-refresh-token-key.sh | 12 ++++++++++++ docs/search.md | 2 +- env.d/development/common | 4 ---- 5 files changed, 20 insertions(+), 12 deletions(-) delete mode 100755 bin/fernetkey create mode 100755 bin/generate-oidc-store-refresh-token-key.sh diff --git a/Makefile b/Makefile index 13319999..2f7c18fc 100644 --- a/Makefile +++ b/Makefile @@ -79,10 +79,16 @@ create-env-local-files: @touch env.d/development/kc_postgresql.local .PHONY: create-env-local-files +generate-secret-keys: +generate-secret-keys: ## generate secret keys to be stored in common.local + @bin/generate-oidc-store-refresh-token-key.sh +.PHONY: generate-secret-keys + pre-bootstrap: \ data/media \ data/static \ - create-env-local-files + create-env-local-files \ + generate-secret-keys .PHONY: pre-bootstrap post-bootstrap: \ diff --git a/bin/fernetkey b/bin/fernetkey deleted file mode 100755 index 8bbac109..00000000 --- a/bin/fernetkey +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env bash - -# shellcheck source=bin/_config.sh -source "$(dirname "${BASH_SOURCE[0]}")/_config.sh" - -_dc_run app-dev python -c 'from cryptography.fernet import Fernet;import sys; sys.stdout.write("\n" + Fernet.generate_key().decode() + "\n");' diff --git a/bin/generate-oidc-store-refresh-token-key.sh b/bin/generate-oidc-store-refresh-token-key.sh new file mode 100755 index 00000000..36fa37e7 --- /dev/null +++ b/bin/generate-oidc-store-refresh-token-key.sh @@ -0,0 +1,12 @@ +#!/usr/bin/env bash + +# Generate the secret OIDC_STORE_REFRESH_TOKEN_KEY and store it to common.local + +set -eo pipefail + +COMMON_LOCAL="env.d/development/common.local" + +OIDC_STORE_REFRESH_TOKEN_KEY=$(openssl rand -base64 32) + +echo "OIDC_STORE_REFRESH_TOKEN_KEY=${OIDC_STORE_REFRESH_TOKEN_KEY}" > "${COMMON_LOCAL}" +echo "✓ OIDC_STORE_REFRESH_TOKEN_KEY generated and stored in ${COMMON_LOCAL}" diff --git a/docs/search.md b/docs/search.md index cb077eae..f2de68ad 100644 --- a/docs/search.md +++ b/docs/search.md @@ -38,4 +38,4 @@ OIDC_STORE_REFRESH_TOKEN_KEY="" ``` `OIDC_STORE_REFRESH_TOKEN_KEY` must be a valid Fernet key (32 url-safe base64-encoded bytes). -To create one, use the `bin/fernetkey` command. +To create one, use the `bin/generate-oidc-store-refresh-token-key.sh` command. diff --git a/env.d/development/common b/env.d/development/common index 601b5f40..558b3f7a 100644 --- a/env.d/development/common +++ b/env.d/development/common @@ -55,10 +55,6 @@ OIDC_AUTH_REQUEST_EXTRA_PARAMS={"acr_values": "eidas1"} OIDC_STORE_ACCESS_TOKEN=True OIDC_STORE_REFRESH_TOKEN=True # Store the encrypted refresh token in the session. -# Must be a valid Fernet key (32 url-safe base64-encoded bytes) -# To create one, use the bin/fernetkey command. -# OIDC_STORE_REFRESH_TOKEN_KEY="your-32-byte-encryption-key==" - # AI AI_FEATURE_ENABLED=true AI_BASE_URL=https://openaiendpoint.com