feat(oidc): derive issuer host from bunyip apex (bunyip-as-OP cutover) #49

Merged

YousifShkara merged 1 commit from feat/bunyip-op-cutover into main

2026-06-02 23:57:43 +02:00

YousifShkara commented

2026-06-02 23:57:40 +02:00

Owner

Flip the host-derivation rule in OidcConfig::resolve from "the mokosh-server host" to "bunyip-api on the apex's api. subdomain":

msp. -> issuer https://api. (was: https://api.msp.)
-> hub https:// (unchanged: bunyip-web apex)

This is the SPA-side companion to the bunyip oauth_clients seed migration and the mokosh-server RS verifier on the same branch. Once all three land:

Browser PKCE goes to https://api.a8n.systems/oauth2/* (bunyip-api).
Bearer at+jwt is forwarded to https://api.msp.a8n.systems/api/v1/* (mokosh-server, now an RS), which validates against bunyip's JWKS.

Operators that pin issuer via window.MOKOSH_CONFIG.oidc_issuer or the MOKOSH_OIDC_ISSUER build arg keep their overrides verbatim - this only changes the derivation fallback. The MOKOSH_OIDC_CLIENT_ID env on the docker side must also be updated to the new public PKCE UUID (b0000000-0000-4000-8000-000000000002 in bunyip-api's seed) before the SPA can complete the flow against bunyip-api; that is a docker-repo change tracked on the same branch.

Flip the host-derivation rule in OidcConfig::resolve from "the mokosh-server host" to "bunyip-api on the apex's api. subdomain": msp.<tld> -> issuer https://api.<tld> (was: https://api.msp.<tld>) -> hub https://<tld> (unchanged: bunyip-web apex) This is the SPA-side companion to the bunyip oauth_clients seed migration and the mokosh-server RS verifier on the same branch. Once all three land: - Browser PKCE goes to https://api.a8n.systems/oauth2/* (bunyip-api). - Bearer at+jwt is forwarded to https://api.msp.a8n.systems/api/v1/* (mokosh-server, now an RS), which validates against bunyip's JWKS. Operators that pin issuer via window.__MOKOSH_CONFIG__.oidc_issuer or the MOKOSH_OIDC_ISSUER build arg keep their overrides verbatim - this only changes the derivation fallback. The MOKOSH_OIDC_CLIENT_ID env on the docker side must also be updated to the new public PKCE UUID (b0000000-0000-4000-8000-000000000002 in bunyip-api's seed) before the SPA can complete the flow against bunyip-api; that is a docker-repo change tracked on the same branch.

YousifShkara self-assigned this

2026-06-02 23:57:40 +02:00

YousifShkara added 1 commit

2026-06-02 23:57:40 +02:00

feat(oidc): derive issuer host from bunyip apex (bunyip-as-OP cutover)

Create release / Create release from merged PR (pull_request) Has been skipped

Details

Check / clippy + fmt + tests (pull_request) Successful in 44s

Details

5918051d73

Flip the host-derivation rule in OidcConfig::resolve from "the mokosh-server host" to "bunyip-api on the apex's api. subdomain":

  msp.<tld>  ->  issuer https://api.<tld>   (was: https://api.msp.<tld>)
             ->  hub    https://<tld>       (unchanged: bunyip-web apex)

This is the SPA-side companion to the bunyip oauth_clients seed migration and the mokosh-server RS verifier on the same branch. Once all three land:

  - Browser PKCE goes to https://api.a8n.systems/oauth2/* (bunyip-api).
  - Bearer at+jwt is forwarded to https://api.msp.a8n.systems/api/v1/* (mokosh-server, now an RS), which validates against bunyip's JWKS.

Operators that pin issuer via window.__MOKOSH_CONFIG__.oidc_issuer or the MOKOSH_OIDC_ISSUER build arg keep their overrides verbatim - this only changes the derivation fallback. The MOKOSH_OIDC_CLIENT_ID env on the docker side must also be updated to the new public PKCE UUID (b0000000-0000-4000-8000-000000000002 in bunyip-api's seed) before the SPA can complete the flow against bunyip-api; that is a docker-repo change tracked on the same branch.