From 3187d408c5a3f0de239fcb84fc4e1fe2c9b8e8c9 Mon Sep 17 00:00:00 2001 From: Moritz Date: Mon, 2 Mar 2026 15:05:50 +0100 Subject: [PATCH] OIDC: use Application config :oidc from runtime.exs for client secret in prod --- lib/mv/config.ex | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-) diff --git a/lib/mv/config.ex b/lib/mv/config.ex index ec69b18..8b8c088 100644 --- a/lib/mv/config.ex +++ b/lib/mv/config.ex @@ -360,13 +360,29 @@ defmodule Mv.Config do end @doc """ - Returns the OIDC client secret. ENV first, then Settings. + Returns the OIDC client secret. + In production, uses the value from config :mv, :oidc (set by runtime.exs from OIDC_CLIENT_SECRET or OIDC_CLIENT_SECRET_FILE). + Otherwise ENV OIDC_CLIENT_SECRET, then Settings. """ @spec oidc_client_secret() :: String.t() | nil def oidc_client_secret do - env_or_setting("OIDC_CLIENT_SECRET", :oidc_client_secret) + case Application.get_env(:mv, :oidc) do + oidc when is_list(oidc) -> oidc_client_secret_from_config(Keyword.get(oidc, :client_secret)) + _ -> env_or_setting("OIDC_CLIENT_SECRET", :oidc_client_secret) + end end + defp oidc_client_secret_from_config(nil), + do: env_or_setting("OIDC_CLIENT_SECRET", :oidc_client_secret) + + defp oidc_client_secret_from_config(secret) when is_binary(secret) do + s = String.trim(secret) + if s != "", do: s, else: env_or_setting("OIDC_CLIENT_SECRET", :oidc_client_secret) + end + + defp oidc_client_secret_from_config(_), + do: env_or_setting("OIDC_CLIENT_SECRET", :oidc_client_secret) + @doc """ Returns the OIDC admin group name (for role sync). ENV first, then Settings. """ @@ -426,7 +442,10 @@ defmodule Mv.Config do def oidc_client_id_env_set?, do: env_set?("OIDC_CLIENT_ID") def oidc_base_url_env_set?, do: env_set?("OIDC_BASE_URL") def oidc_redirect_uri_env_set?, do: env_set?("OIDC_REDIRECT_URI") - def oidc_client_secret_env_set?, do: env_set?("OIDC_CLIENT_SECRET") + + def oidc_client_secret_env_set?, + do: env_set?("OIDC_CLIENT_SECRET") or env_set?("OIDC_CLIENT_SECRET_FILE") + def oidc_admin_group_name_env_set?, do: env_set?("OIDC_ADMIN_GROUP_NAME") def oidc_groups_claim_env_set?, do: env_set?("OIDC_GROUPS_CLAIM") def oidc_only_env_set?, do: env_set?("OIDC_ONLY") -- 2.47.2