psa-systems/mokosh-apps
Watch
9
0
Fork
You've already forked mokosh-apps
 0
Code Issues Pull requests 1 Projects Releases 14 Packages Wiki Activity Actions

feat(oidc): runtime MOKOSH_OIDC_SCOPES override for SPA scope query (BUNYIP-142) #337

Merged
YousifShkara merged 1 commit from feat/BUNYIP-142-runtime-oidc-scopes into main 2026-06-25 08:14:32 +02:00
Conversation 0 Commits 1 Files changed 2 +15
YousifShkara commented 2026-06-25 08:04:26 +02:00
Owner
Copy link

Plumbs the requested OIDC scope string through the same runtime-config
seam the SPA already uses for issuer / client_id / hub_base_url, so a
deployment can opt in to bunyip's profile claim emission (and the
JIT path BUNYIP-141 ships) without rebuilding the wasm bundle.

Changes:

  • oci-build/entrypoint.sh: emit oidc_scopes to
    window.__MOKOSH_CONFIG__ when MOKOSH_OIDC_SCOPES is set; same
    shape as the other emit_field calls (escaped, only emitted when
    non-empty so dev / unconfigured deployments stay on the compile-time
    default).
  • src/modules/oidc/config.rs: OidcConfig::resolve pulls
    oidc_scopes from runtime_config and Box::leaks it over the
    compile-time default. Absent the override the
    option_env!("MOKOSH_OIDC_SCOPES") fallback chain is unchanged.

After this lands operators set
MOKOSH_OIDC_SCOPES: openid email offline_access profile on the
mokosh-www service in their compose-variables.yml (c-01 + nc-01 PR in
the docker repo) and the next /oauth2/authorize round-trip requests
profile, which BUNYIP-140's consent screen surfaces, BUNYIP-141's
JIT path consumes, and BUNYIP-139's user fields populate.

#BUNYIP-142

Plumbs the requested OIDC scope string through the same runtime-config seam the SPA already uses for issuer / client_id / hub_base_url, so a deployment can opt in to bunyip's `profile` claim emission (and the JIT path BUNYIP-141 ships) without rebuilding the wasm bundle. Changes: - oci-build/entrypoint.sh: emit `oidc_scopes` to `window.__MOKOSH_CONFIG__` when `MOKOSH_OIDC_SCOPES` is set; same shape as the other emit_field calls (escaped, only emitted when non-empty so dev / unconfigured deployments stay on the compile-time default). - src/modules/oidc/config.rs: `OidcConfig::resolve` pulls `oidc_scopes` from runtime_config and Box::leaks it over the compile-time default. Absent the override the option_env!("MOKOSH_OIDC_SCOPES") fallback chain is unchanged. After this lands operators set `MOKOSH_OIDC_SCOPES: openid email offline_access profile` on the mokosh-www service in their compose-variables.yml (c-01 + nc-01 PR in the docker repo) and the next /oauth2/authorize round-trip requests `profile`, which BUNYIP-140's consent screen surfaces, BUNYIP-141's JIT path consumes, and BUNYIP-139's user fields populate. #BUNYIP-142
feat(oidc): runtime MOKOSH_OIDC_SCOPES override for SPA scope query (BUNYIP-142)
All checks were successful
Check / fmt + clippy + tests (pull_request) Successful in 9m31s
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
612fc2512f 
Plumbs the requested OIDC scope string through the same runtime-config
seam the SPA already uses for issuer / client_id / hub_base_url, so a
deployment can opt in to bunyip's `profile` claim emission (and the
JIT path BUNYIP-141 ships) without rebuilding the wasm bundle.

Changes:
- oci-build/entrypoint.sh: emit `oidc_scopes` to
  `window.__MOKOSH_CONFIG__` when `MOKOSH_OIDC_SCOPES` is set; same
  shape as the other emit_field calls (escaped, only emitted when
  non-empty so dev / unconfigured deployments stay on the compile-time
  default).
- src/modules/oidc/config.rs: `OidcConfig::resolve` pulls
  `oidc_scopes` from runtime_config and Box::leaks it over the
  compile-time default. Absent the override the
  option_env!("MOKOSH_OIDC_SCOPES") fallback chain is unchanged.

After this lands operators set
`MOKOSH_OIDC_SCOPES: openid email offline_access profile` on the
mokosh-www service in their compose-variables.yml (c-01 + nc-01 PR in
the docker repo) and the next /oauth2/authorize round-trip requests
`profile`, which BUNYIP-140's consent screen surfaces, BUNYIP-141's
JIT path consumes, and BUNYIP-139's user fields populate.

#BUNYIP-142
YousifShkara deleted branch feat/BUNYIP-142-runtime-oidc-scopes 2026-06-25 08:14:32 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
YousifShkara
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/mokosh-apps!337
No description provided.