prosolis
1cf207d73f
Petal is now an OIDC client in its own right rather than trusting a header from the proxy. The Phase-0 Resolver seam was the only integration point: main.go picks the session store when Authentik is configured and the static local user otherwise, and no handler or query moved for either. internal/auth gains three pieces. session.go issues an opaque cookie token and stores only its SHA-256, so a database copy yields nothing usable; the 30-day expiry slides on every request, throttled to one write an hour, and logout deletes the row rather than just the cookie. oidc.go runs the authorization-code flow with state, nonce and PKCE, and discovers the provider lazily and on retry — an Authentik outage should block new logins without stopping Petal booting or invalidating live sessions. users.go provisions accounts from the token's claims and gates them on an allowlist that matches emails as well as subject ids, since a subject is an opaque uuid that doesn't exist until someone has already logged in once. Migration 0010 lands sessions, images and users.pair_lang together. The images table closes the capability-URL hole the Phase-0 audit flagged: a hash was previously enough to fetch anyone's picture. Rows are keyed (name, user_id) so one file can have several owners and deduplication survives; a stranger gets 404 rather than 403, the cache header drops to private, and files already on disk are claimed at startup or every image already pasted into a document would 404. On the frontend a single 401 interceptor feeds a warm bilingual sign-in overlay, drawn over a still-visible editor because nothing has been taken away. Behind it is the part that matters: a save that comes back 401 stashes its body to localStorage before anything else and stops the auto-save loop, and reopening that document after signing in merges the draft back and saves it. An expired session must not cost writing. Writing the round-trip test against a stub identity provider turned up a real bug: the one-shot state/nonce/PKCE cookies were cleared in a defer, which runs after the redirect has written the response header, so the clearing Set-Cookie was silently dropped and they lingered for their full ten minutes. Also swaps the emoji favicon for a drawn sakura, which renders as Petal's own rose palette everywhere instead of whatever each platform's font decides, and doubles as the app tile in Authentik. Migration 0010 verified against a VACUUM INTO copy of the live millenia database: counts intact, FTS still matching, the one existing image claimed. Claude-Session: https://claude.ai/code/session_016y6gyuHkQXPiEuW8RGQyua
104 lines
4.0 KiB
Go
104 lines
4.0 KiB
Go
package config
|
|
|
|
import (
|
|
"os"
|
|
"time"
|
|
)
|
|
|
|
// Config holds all runtime configuration, loaded from environment variables.
|
|
// See .env.example for the full list and defaults.
|
|
type Config struct {
|
|
Port string
|
|
BaseURL string
|
|
DatabasePath string
|
|
ImageDir string // on-disk store for editor image uploads
|
|
|
|
// LLM
|
|
LLMBackend string // "vllm" | "ollama"
|
|
LLMEndpoint string
|
|
LLMModel string // checkpoint model (small, fast)
|
|
LLMChatModel string // Ask Petal model; falls back to LLMModel if empty
|
|
LLMTimeout time.Duration
|
|
|
|
// TTS (read-aloud). Off unless TTSEndpoint is set — when empty, the /api/tts
|
|
// route isn't mounted and the frontend falls back to the browser's Web Speech
|
|
// API. Endpoint points at a local Piper HTTP server.
|
|
TTSEndpoint string // Piper instance serving the English voice
|
|
TTSEndpointZH string // Piper instance serving the Chinese voice; empty = zh falls back to Web Speech
|
|
TTSVoiceEN string // Piper voice id for English (e.g. en_US-amy-medium)
|
|
TTSVoiceZH string // Piper voice id for Chinese (e.g. zh_CN-huayan-medium)
|
|
// TTSPath is the path Piper serves synthesis on. Piper moved it from "/" to
|
|
// "/synthesize" in 1.6.0 with an unchanged request body, so this is a
|
|
// version knob, not a feature: millenia's older server keeps the default,
|
|
// the containerised sidecars set "/synthesize".
|
|
TTSPath string
|
|
TTSCacheDir string // on-disk store for synthesized clips (content-addressed)
|
|
TTSTimeout time.Duration
|
|
TTSFormat string // mp3 | opus | wav — mp3/opus transcode Piper's WAV via ffmpeg
|
|
|
|
// Auth. OIDC against Authentik. Login is enabled only when the issuer, the
|
|
// client id and the secret are all present; with any of them missing Petal
|
|
// falls back to the single hardcoded local user, which is what local
|
|
// development wants and what every deployment did before Phase 16.
|
|
AuthentikURL string // issuer URL of the Petal provider in Authentik
|
|
AuthentikClientID string
|
|
AuthentikClientSecret string
|
|
// AllowedSubs gates who may sign in, as a comma-separated list of OIDC
|
|
// subject ids and/or email addresses. Empty means everyone Authentik
|
|
// authenticates — right for a single-household instance, wrong the moment
|
|
// the IdP serves an audience wider than Petal's.
|
|
AllowedSubs string
|
|
}
|
|
|
|
// AuthEnabled reports whether real logins are configured. When false, Petal
|
|
// resolves every request to the local user.
|
|
func (c *Config) AuthEnabled() bool {
|
|
return c.AuthentikURL != "" && c.AuthentikClientID != "" && c.AuthentikClientSecret != ""
|
|
}
|
|
|
|
// Load reads configuration from the environment, applying sane local-dev defaults.
|
|
func Load() *Config {
|
|
return &Config{
|
|
Port: env("PORT", "8080"),
|
|
BaseURL: env("BASE_URL", "http://localhost:8080"),
|
|
DatabasePath: env("DATABASE_PATH", "./data/petal.db"),
|
|
ImageDir: env("IMAGE_DIR", "./data/images"),
|
|
|
|
LLMBackend: env("LLM_BACKEND", "vllm"),
|
|
LLMEndpoint: env("LLM_ENDPOINT", "http://localhost:8000"),
|
|
LLMModel: env("LLM_MODEL", ""),
|
|
LLMChatModel: env("LLM_CHAT_MODEL", ""),
|
|
LLMTimeout: envDuration("LLM_TIMEOUT", 30*time.Second),
|
|
|
|
TTSEndpoint: env("TTS_ENDPOINT", ""),
|
|
TTSEndpointZH: env("TTS_ENDPOINT_ZH", ""),
|
|
TTSVoiceEN: env("TTS_VOICE_EN", "en_US-amy-medium"),
|
|
TTSVoiceZH: env("TTS_VOICE_ZH", "zh_CN-huayan-medium"),
|
|
TTSPath: env("TTS_PATH", "/"),
|
|
TTSCacheDir: env("TTS_CACHE_DIR", "./data/tts"),
|
|
TTSTimeout: envDuration("TTS_TIMEOUT", 15*time.Second),
|
|
TTSFormat: env("TTS_AUDIO_FORMAT", "mp3"),
|
|
|
|
AuthentikURL: env("AUTHENTIK_URL", ""),
|
|
AuthentikClientID: env("AUTHENTIK_CLIENT_ID", ""),
|
|
AuthentikClientSecret: env("AUTHENTIK_CLIENT_SECRET", ""),
|
|
AllowedSubs: env("PETAL_ALLOWED_SUBS", ""),
|
|
}
|
|
}
|
|
|
|
func env(key, fallback string) string {
|
|
if v := os.Getenv(key); v != "" {
|
|
return v
|
|
}
|
|
return fallback
|
|
}
|
|
|
|
func envDuration(key string, fallback time.Duration) time.Duration {
|
|
if v := os.Getenv(key); v != "" {
|
|
if d, err := time.ParseDuration(v); err == nil {
|
|
return d
|
|
}
|
|
}
|
|
return fallback
|
|
}
|