v0.34.16

src/config/routing.rs

@@ -217,10 +217,12 @@ fn compile_routing(
                 .clone()
                 .unwrap_or_else(|| config.diagnostic_headers.clone()),
             auth_provider: crate::auth_provider::Selection {
+                choice: host.authentication,
                 basic_enabled: host.basic_auth.enabled,
                 tinyauth: &host.tinyauth,
                 authelia: &host.authelia,
                 authentik: &host.authentik,
+                oidc: &host.oidc,
             }
             .compile(&desired_policy, &guarded_bindings)?,
             id: host.id.clone(),

src/config/tests.rs

@@ -35,9 +35,12 @@ mod tests {
         let mut legacy = encoded.as_object().unwrap().clone();
         legacy.remove("authelia");
         legacy.remove("authentik");
+        legacy.remove("oidc");
+        legacy.remove("authentication");
         let restored: crate::vhost::Vhost = serde_json::from_value(legacy.into()).unwrap();
         assert!(!restored.authelia.enabled);
         assert!(!restored.authentik.enabled);
+        assert!(!restored.oidc.enabled);
     }
 
     #[test]
@@ -46,6 +49,7 @@ mod tests {
             ("tinyauth", "authelia"),
             ("authelia", "authentik"),
             ("authentik", "basic"),
+            ("oidc", "tinyauth"),
         ] {
             let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
             let host = &mut config.vhosts[0];
@@ -54,6 +58,7 @@ mod tests {
                     "tinyauth" => host.tinyauth.enabled = true,
                     "authelia" => host.authelia.enabled = true,
                     "authentik" => host.authentik.enabled = true,
+                    "oidc" => host.oidc.enabled = true,
                     "basic" => host.basic_auth.enabled = true,
                     _ => unreachable!(),
                 }
@@ -65,6 +70,42 @@ mod tests {
         }
     }
 
+    #[test]
+    fn explicit_authentication_selection_roundtrips_and_legacy_remains_supported() {
+        let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
+        let mut host = config.vhosts.remove(0);
+        assert!(host.authentication.is_none());
+        host.authentication = Some(crate::auth_provider::Choice {
+            provider: crate::auth_provider::IdentityProvider::Authelia,
+            method: crate::auth_provider::IntegrationMethod::Oidc,
+        });
+        host.oidc.enabled = true;
+        host.oidc.issuer_url = "https://auth.test.com".into();
+        host.oidc.client_id = "app".into();
+        host.oidc.client_secret = "client-secret".into();
+        host.oidc.session_secret = "a-unique-testing-session-secret-32-bytes".into();
+        host.oidc.redirect_url = "https://localhost/_rustproxy/oidc/callback".into();
+        assert!(host.validate().is_ok());
+        let encoded = serde_json::to_value(&host).unwrap();
+        assert_eq!(
+            encoded["authentication"],
+            serde_json::json!({"provider":"authelia","method":"oidc"})
+        );
+        let restored: crate::vhost::Vhost = serde_json::from_value(encoded.clone()).unwrap();
+        assert_eq!(restored.authentication, host.authentication);
+        assert!(restored.validate().is_ok());
+        let mut legacy = encoded.as_object().unwrap().clone();
+        legacy.remove("authentication");
+        let old: crate::vhost::Vhost = serde_json::from_value(legacy.into()).unwrap();
+        assert!(old.authentication.is_none());
+        assert!(old.validate().is_ok());
+        host.authentication = Some(crate::auth_provider::Choice {
+            provider: crate::auth_provider::IdentityProvider::PocketId,
+            method: crate::auth_provider::IntegrationMethod::ForwardAuth,
+        });
+        assert!(host.validate().is_err());
+    }
+
     #[test]
     fn missing_http2_settings_use_release_defaults() {
         let config: Config = serde_json::from_value(serde_json::json!({})).unwrap();