Edouard Vanbelle
65 lines
3.0 KiB
Bash
65 lines
3.0 KiB
Bash
# OxiCloud test-server env file for the SSO-only, NO-auto-redirect posture.
|
|
#
|
|
# Same as server-with-oidc-only.env EXCEPT OXICLOUD_AUTH_POLICIES is not
|
|
# set. Proves the /login middleware is opt-in — with AUTH_METHODS=oidc
|
|
# alone the SPA still renders at /login (with just the SSO button) and
|
|
# the middleware falls through. Under this posture the user has to click
|
|
# the button to start the OIDC flow instead of being auto-redirected.
|
|
#
|
|
# Paired with tests/oidc/sso-only-no-policy.hurl; both driven by the
|
|
# `run-sso-only.sh` runner in a two-phase sequence.
|
|
|
|
# ── Shared test config (mirrors server.env) ────────────────────────────────
|
|
DATABASE_URL=postgres://oxicloud_test:oxicloud_test@localhost:5433/oxicloud_test
|
|
OXICLOUD_DB_CONNECTION_STRING=postgres://oxicloud_test:oxicloud_test@localhost:5433/oxicloud_test
|
|
OXICLOUD_STATIC_PATH=./static
|
|
OXICLOUD_JWT_SECRET=test-secret-do-not-use-in-prod-minimum-32-chars
|
|
OXICLOUD_ENABLE_AUTH=true
|
|
OXICLOUD_ENABLE_TRASH=true
|
|
OXICLOUD_ENABLE_SEARCH=true
|
|
OXICLOUD_ENABLE_FILE_SHARING=true
|
|
OXICLOUD_ENABLE_MUSIC=true
|
|
OXICLOUD_EXPOSE_SYSTEM_USERS=true
|
|
OXICLOUD_WOPI_ENABLED=false
|
|
OXICLOUD_NEXTCLOUD_ENABLED=true
|
|
|
|
RUST_LOG="warn,audit=info,oxicloud::infrastructure::services::oidc_service=info,oxicloud::application::services::auth_application_service=info"
|
|
|
|
OXICLOUD_RATE_LIMIT_REFRESH_MAX=3600
|
|
OXICLOUD_RATE_LIMIT_LOGIN_MAX=3600
|
|
OXICLOUD_RATE_LIMIT_REGISTER_MAX=3600
|
|
OXICLOUD_TRUST_PROXY_CIDR=0.0.0.0/0
|
|
|
|
# Mock SMTP — kept wired even though magic-link login is disabled under the
|
|
# OIDC master rule, so the invite/mail transport doesn't 503 unconfigured.
|
|
OXICLOUD_SMTP_MOCK=true
|
|
OXICLOUD_SMTP_HOST=localhost
|
|
OXICLOUD_SMTP_PORT=25
|
|
OXICLOUD_SMTP_FROM='OxiCloud Tests <test@oxicloud.local>'
|
|
OXICLOUD_SMTP_TLS=none
|
|
OXICLOUD_ALLOW_EXTERNAL_USERS=true
|
|
|
|
# ── OIDC client wired at the fake-idp sidecar (SSO-only) ───────────────────
|
|
OXICLOUD_OIDC_ENABLED=true
|
|
OXICLOUD_OIDC_ISSUER_URL=http://localhost:1081
|
|
OXICLOUD_OIDC_CLIENT_ID=oxicloud-test
|
|
OXICLOUD_OIDC_CLIENT_SECRET=test-client-secret-not-used-in-prod
|
|
OXICLOUD_OIDC_REDIRECT_URI=http://localhost:8090/api/auth/oidc/callback
|
|
OXICLOUD_OIDC_SCOPES="openid profile email"
|
|
OXICLOUD_OIDC_FRONTEND_URL=http://localhost:8090
|
|
OXICLOUD_OIDC_AUTO_PROVISION=true
|
|
OXICLOUD_OIDC_PROVIDER_NAME=MockSSO-NoPolicy
|
|
OXICLOUD_OIDC_ADMIN_GROUPS=admin-users
|
|
|
|
# Same modern SSO-only mechanism as server-with-oidc-only.env.
|
|
OXICLOUD_AUTH_METHODS=oidc
|
|
|
|
# ── The DELIBERATE OMISSION ────────────────────────────────────────────────
|
|
# OXICLOUD_AUTH_POLICIES is NOT set here. This is the whole point of the
|
|
# test — with AUTH_METHODS=oidc alone, the login middleware in
|
|
# src/interfaces/web/mod.rs::oidc_standalone_login_redirect must fall
|
|
# through (SPA shell served at /login) instead of returning 302. The
|
|
# with-policy variant (server-with-oidc-only.env) proves the flip side.
|
|
|
|
OXICLOUD_REQUIRE_VERIFIED_EMAIL=false
|