fix: add missing auth.oidc validation in helm chart#528
fix: add missing auth.oidc validation in helm chart#5285rk7n wants to merge 3 commits intojonwiggins:mainfrom
Conversation
jonwiggins
left a comment
jonwiggins
left a comment
There was a problem hiding this comment.
Thanks for catching this — the helm validator was definitely missing OIDC.
One blocker before this is ready: the validation should key on .Values.auth.oidc.issuerUrl, not .clientId. Everywhere else in the chart and runtime, OIDC presence is detected via issuerUrl:
helm/optio/templates/secrets.yaml:42only emitsOIDC_*env vars whenauth.oidc.issuerUrlis setapps/api/src/services/oauth/index.ts:35activates the provider only whenprocess.env.OIDC_ISSUER_URLis set
As-is, a user who sets only auth.oidc.clientId (without issuerUrl) would pass helm validation but get no actual OIDC provider at runtime — recreating the silent-misconfig class the validator exists to prevent. Your updated error message even hints at this with "with corresponding clientSecret/issuerUrl as needed".
Could you swap the check to .Values.auth.oidc.issuerUrl (or require both)? Once that's done it's good to go.
| {{- $hasProvider := or .Values.auth.github.clientId (or .Values.auth.google.clientId (or .Values.auth.gitlab.clientId .Values.auth.oidc.issuerUrl)) -}} | ||
| {{- if not $hasProvider -}} | ||
| {{- fail "At least one OAuth provider must be configured when auth is enabled. Set auth.github.clientId, auth.google.clientId, or auth.gitlab.clientId (with corresponding clientSecret)." -}} | ||
| {{- fail "At least one OAuth provider must be configured when auth is enabled. Set auth.github.clientId, auth.google.clientId, auth.gitlab.clientId, or auth.oidc.issuerUrl (with corresponding clinetId, clientSecret as needed)." -}} |
There was a problem hiding this comment.
Tiny typo: clinetId → clientId in this user-facing error message.
There was a problem hiding this comment.
Oh sorry for that. Fix typo in the messages now.
2 participants
Summary
The Helm chart template is currently missing values validation for OIDC authentication. This MR updates the template helpers to correctly validate and support OIDC configuration.
Changes
Added an missing conditional check (OR logic) in the Helm template helpers to support and validate
auth.oidc.clientIdconfigurations.Testing
pnpm turbo test)pnpm turbo typecheck)helm lint)Related
Closes #
Screenshots