Uh oh!
There was an error while loading. Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork 0
feat(authup): mount an operator console theme#5
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Uh oh!
There was an error while loading. Please reload this page.
Merged
Changes from all commits
Commits
Show all changes
3 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Uh oh!
There was an error while loading. Please reload this page.
Jump to
Jump to file
Failed to load files.
Loading
Uh oh!
There was an error while loading. Please reload this page.
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| # Operator theme mounted from an inline files map, covering the path-keyed | ||
| # ConfigMap projection (a "/" key must land in a subdirectory) and the env | ||
| # wiring. THEME_DIRECTORY_PATH is ignored by an authup image that predates | ||
| # console theming, so the rollout assertion holds either way. | ||
| server: | ||
| theme: | ||
| enabled: true | ||
| fragmentsEnabled: true | ||
| files: | ||
| theme.json: | | ||
| { | ||
| "version": 1, | ||
| "title": "Sign in to ACME", | ||
| "stylesheet": "assets/theme.css", | ||
| "tokens": { | ||
| "--authup-periwinkle": "#c0392b" | ||
| }, | ||
| "tokensDark": { | ||
| "--authup-auth-accent": "#e06c5a" | ||
| } | ||
| } | ||
| assets/theme.css: | | ||
| .a-auth-shell-card { border-radius: 2px; } | ||
| fragments/head.html: | | ||
| <meta name="operator" content="acme"> | ||
| adminConsole: | ||
| enabled: false |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -6,6 +6,7 @@ Strict-boolean variables are always quoted: authup crashes the boot on | ||
| unparsable boolean strings by design. | ||
| */}} | ||
| {{- define "authup.server.configEnv" -}} | ||
| {{- include "authup.server.validateTheme" . -}} | ||
| DB_TYPE: {{ include "authup.database.type" . | quote }} | ||
| DB_HOST: {{ include "authup.database.host" . | quote }} | ||
| DB_PORT: {{ include "authup.database.port" . | quote }} | ||
| @@ -36,7 +37,7 @@ CLIENT_SYSTEM_ENABLED: "true" | ||
| CLIENT_SYSTEM_SECRET_RESET: "true" | ||
| {{- end }} | ||
| {{- end }} | ||
| {{- $reserved := list "DB_TYPE" "DB_HOST" "DB_PORT" "DB_USERNAME" "DB_DATABASE" "DB_PASSWORD" "PUBLIC_URL" "TRUSTED_ORIGINS" "TRUST_PROXY" "REGISTRATION_ENABLED" "PASSWORD_RECOVERY_ENABLED" "EMAIL_VERIFICATION_ENABLED" "MFA_ENABLED" "MFA_REQUIRED" "USER_ADMIN_PASSWORD" "USER_ADMIN_PASSWORD_RESET" "CLIENT_SYSTEM_ENABLED" "CLIENT_SYSTEM_SECRET" "CLIENT_SYSTEM_SECRET_RESET" "REDIS" "SMTP" "SECRETS_ENCRYPTION_KEY" }} | ||
| {{- $reserved := list "DB_TYPE" "DB_HOST" "DB_PORT" "DB_USERNAME" "DB_DATABASE" "DB_PASSWORD" "PUBLIC_URL" "TRUSTED_ORIGINS" "TRUST_PROXY" "REGISTRATION_ENABLED" "PASSWORD_RECOVERY_ENABLED" "EMAIL_VERIFICATION_ENABLED" "MFA_ENABLED" "MFA_REQUIRED" "THEME_DIRECTORY_PATH" "THEME_FRAGMENTS_ENABLED" "USER_ADMIN_PASSWORD" "USER_ADMIN_PASSWORD_RESET" "CLIENT_SYSTEM_ENABLED" "CLIENT_SYSTEM_SECRET" "CLIENT_SYSTEM_SECRET_RESET" "REDIS" "SMTP" "SECRETS_ENCRYPTION_KEY" }} | ||
| {{- range $key, $value := .Values.server.config }} | ||
| {{- if has $key $reserved }} | ||
| {{- fail (printf "authup: server.config.%s collides with a first-class chart value — set it through the dedicated value instead." $key) }} | ||
| @@ -138,6 +139,134 @@ provisioning files, config file). | ||
| {{- end }} | ||
| {{- end -}} | ||
| {{/* | ||
| Theme volume / volumeMount, deliberately NOT part of the shared server | ||
| helpers: the migration Job is a pre-upgrade HOOK, and hooks precede regular | ||
| resources, so on the upgrade that first enables theming it would reference a | ||
| ConfigMap that does not exist yet and hang. A migration run has no use for | ||
| the theme either way. | ||
| */}} | ||
| {{/* | ||
| Theme environment, kept OUT of authup.server.configEnv for the same reason | ||
| as the volume: the migration Job inlines configEnv, and pointing | ||
| THEME_DIRECTORY_PATH at a directory that Job does not mount would describe | ||
| a pod that does not exist. Nothing reads it there today (the migration | ||
| command boots only config + logger, never the http module), but the env | ||
| should not contradict the pod it is in. | ||
| THEME_* stays in configEnv's reserved-key list regardless, so a | ||
| `server.config` entry cannot emit a duplicate key into the same ConfigMap. | ||
| */}} | ||
| {{- define "authup.server.themeEnv" -}} | ||
| {{- if include "authup.server.themeMounted" . }} | ||
| THEME_DIRECTORY_PATH: {{ include "authup.server.themeMountPath" . | quote }} | ||
| THEME_FRAGMENTS_ENABLED: {{ .Values.server.theme.fragmentsEnabled | toString | quote }} | ||
| {{- end }} | ||
| {{- end -}} | ||
| {{- define "authup.server.themeVolumeMounts" -}} | ||
| {{- if include "authup.server.themeMounted" . }} | ||
| - name: theme | ||
| mountPath: {{ include "authup.server.themeMountPath" . }} | ||
| readOnly: true | ||
| {{- end }} | ||
| {{- end -}} | ||
| {{- define "authup.server.themeVolumes" -}} | ||
| {{- if include "authup.server.themeMounted" . }} | ||
| - name: theme | ||
| configMap: | ||
| name: {{ include "authup.server.themeConfigMapName" . }} | ||
| {{- /* Whole-volume projection on purpose: a subPath mount is frozen | ||
| until the pod restarts, which would destroy authup's live theme | ||
| reload. */}} | ||
| {{- if .Values.server.theme.existingConfigMap }} | ||
| {{- with .Values.server.theme.existingConfigMapItems }} | ||
| items: {{- include "authup.tplvalues.render" (dict "value" . "context" $) | nindent 6 }} | ||
| {{- end }} | ||
| {{- else }} | ||
| items: | ||
| {{- range $path, $content := .Values.server.theme.files }} | ||
| - key: {{ include "authup.server.themeConfigMapKey" $path }} | ||
| path: {{ $path }} | ||
| {{- end }} | ||
| {{- end }} | ||
| {{- end }} | ||
| {{- end -}} | ||
| {{/* | ||
| Absolute path the theme volume is mounted at, and the value of | ||
| THEME_DIRECTORY_PATH. A constant: the chart owns both ends. | ||
| */}} | ||
| {{- define "authup.server.themeMountPath" -}} | ||
| /etc/authup/theme | ||
| {{- end -}} | ||
| {{/* | ||
| Flatten a theme path into a valid ConfigMap key ("/" is not allowed in one). | ||
| The volume's items list projects it back, so the encoding never reaches the | ||
| operator. | ||
| */}} | ||
| {{- define "authup.server.themeConfigMapKey" -}} | ||
| {{- . | replace "/" "__" -}} | ||
| {{- end -}} | ||
| {{- define "authup.server.themeConfigMapName" -}} | ||
| {{- if .Values.server.theme.existingConfigMap -}} | ||
| {{- include "authup.tplvalues.render" (dict "value" .Values.server.theme.existingConfigMap "context" $) -}} | ||
| {{- else -}} | ||
| {{- printf "%s-theme" (include "authup.server.fullname" .) -}} | ||
| {{- end -}} | ||
| {{- end -}} | ||
| {{/* | ||
| True when a theme should be mounted at all. | ||
| */}} | ||
| {{- define "authup.server.themeMounted" -}} | ||
| {{- if and .Values.server.theme.enabled (or .Values.server.theme.files .Values.server.theme.existingConfigMap) -}} | ||
| true | ||
| {{- end -}} | ||
| {{- end -}} | ||
| {{/* | ||
| Render-time validation. The chart fails loud rather than shipping a | ||
| silently-inert theme: the dominant failure mode of theming is a page that | ||
| looks exactly like an un-themed page. | ||
| */}} | ||
| {{- define "authup.server.validateTheme" -}} | ||
| {{- if .Values.server.theme.enabled }} | ||
| {{- if not (or .Values.server.theme.files .Values.server.theme.existingConfigMap) }} | ||
| {{- fail "authup: server.theme.enabled requires server.theme.files or server.theme.existingConfigMap — an empty theme directory would render an un-themed page with no error." }} | ||
| {{- end }} | ||
| {{- if and .Values.server.theme.files .Values.server.theme.existingConfigMap }} | ||
| {{- fail "authup: set either server.theme.files or server.theme.existingConfigMap, not both — the existing ConfigMap would win and the inline files would be silently ignored." }} | ||
| {{- end }} | ||
| {{- range $path, $content := .Values.server.theme.files }} | ||
| {{- if hasPrefix "/" $path }} | ||
| {{- fail (printf "authup: server.theme.files key %q must be relative to the theme root." $path) }} | ||
| {{- end }} | ||
| {{- if contains ".." $path }} | ||
| {{- fail (printf "authup: server.theme.files key %q must not traverse out of the theme root." $path) }} | ||
| {{- end }} | ||
| {{- if contains "__" $path }} | ||
| {{- fail (printf "authup: server.theme.files key %q must not contain \"__\" — it is reserved for encoding the path separator into a ConfigMap key." $path) }} | ||
| {{- end }} | ||
coderabbitai[bot] marked this conversation as resolved.
Uh oh!There was an error while loading. Please reload this page. | ||
| {{- /* A ConfigMap data key must match ^[A-Za-z0-9._-]+$, so a path | ||
| carrying a space, a colon or any other character outside this set | ||
| would flatten into an INVALID key and fail at apply time with a | ||
| Kubernetes validation error instead of here. The set is the one the | ||
| server's own asset handler accepts, so the chart now rejects at | ||
| render time exactly what the server would 404 at request time. */}} | ||
| {{- if not (regexMatch "^[a-zA-Z0-9][a-zA-Z0-9._/-]*$" $path) }} | ||
| {{- fail (printf "authup: server.theme.files key %q must start with a letter or digit and contain only letters, digits, \".\", \"_\", \"-\" and \"/\"." $path) }} | ||
| {{- end }} | ||
| {{- end }} | ||
| {{- end }} | ||
| {{- if and .Values.server.theme.existingConfigMapItems (not .Values.server.theme.existingConfigMap) }} | ||
| {{- fail "authup: server.theme.existingConfigMapItems requires server.theme.existingConfigMap." }} | ||
| {{- end }} | ||
| {{- end -}} | ||
| {{- define "authup.server.provisioningConfigMapName" -}} | ||
| {{- if .Values.server.provisioning.existingConfigMap -}} | ||
| {{- include "authup.tplvalues.render" (dict "value" .Values.server.provisioning.existingConfigMap "context" $) -}} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| {{- if and .Values.server.enabled .Values.server.theme.enabled .Values.server.theme.files (not .Values.server.theme.existingConfigMap) }} | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
| metadata: | ||
| name: {{ printf "%s-theme" (include "authup.server.fullname" .) }} | ||
| namespace: {{ include "authup.namespace" . | quote }} | ||
| labels: {{- include "authup.labels" (dict "context" $ "component" "server") | nindent 4 }} | ||
| annotations: {{- include "authup.annotations" (dict "context" $) | nindent 4 }} | ||
| data: | ||
| {{- /* A ConfigMap key cannot contain "/", but the theme layout has | ||
| subdirectories. Keys are flattened here and projected back to their | ||
| real path by the volume's items list, so the operator writes | ||
| "assets/theme.css" and never sees the encoding. */}} | ||
| {{- range $path, $content := .Values.server.theme.files }} | ||
| {{ include "authup.server.themeConfigMapKey" $path }}: |- | ||
| {{- include "authup.tplvalues.render" (dict "value" $content "context" $) | nindent 4 }} | ||
| {{- end }} | ||
| {{- end }} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.