Migrations/bookorbit
1
0
Fork 0
mirror of https://github.com/bookorbit/bookorbit.git synced 2026-11-03 00:11:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): explain untrusted OIDC certificate failures

Browse Source 
Classify private trust-chain failures with a stable error code and direct administrators to a mounted CA bundle without weakening TLS verification.

Fixes #1346
This commit is contained in:
neon
2026-09-10 11:47:56 +00:00
parent e514be151a
commit 33c7260f18
9 changed files with 118 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/src/features/settings/OidcSettings.vue
+1
View File
@@ -19,6 +19,7 @@ const { t } = useI18n()
const OIDC_TEST_ERROR_MESSAGE_KEYS: Record<string, string> = {
[OidcErrorCode.PRIVATE_ISSUER_ADDRESS]: 'settings.oidc.test.privateIssuerAddress',
[OidcErrorCode.TLS_CERTIFICATE_UNTRUSTED]: 'settings.oidc.test.tlsCertificateUntrusted',
}
interface ProviderSummary {
client/src/features/settings/__tests__/OidcSettings.spec.ts
+17
View File
@@ -65,6 +65,23 @@ describe('OidcSettings', () => {
expect(wrapper.text()).not.toContain('Server copy must not be rendered')
})
it('localizes an untrusted TLS certificate error without rendering server copy', async () => {
apiMock.mockImplementation(async (input: RequestInfo | URL) => {
if (String(input) === '/api/v1/app-settings/oidc/providers') return response(true, [])
return response(false, {
errorCode: OidcErrorCode.TLS_CERTIFICATE_UNTRUSTED,
message: 'Server copy must not be rendered',
})
})
const wrapper = await mountCreateForm()
await testConnection(wrapper)
expect(wrapper.text()).toContain('private certificate authority')
expect(wrapper.text()).toContain('NODE_EXTRA_CA_CERTS')
expect(wrapper.text()).not.toContain('Server copy must not be rendered')
})
it('uses localized generic copy for an unknown server error code', async () => {
apiMock.mockImplementation(async (input: RequestInfo | URL) => {
if (String(input) === '/api/v1/app-settings/oidc/providers') return response(true, [])
client/src/locales/en.json
+1
View File
@@ -734,6 +734,7 @@
"connected": "Connected - {issuer}",
"connectionFailed": "Connection failed",
"privateIssuerAddress": "The issuer URL resolves to a private or local network address, so the server refused to connect. Set OIDC_ALLOW_LOCAL_ISSUERS=true on the BookOrbit server to allow it.",
"tlsCertificateUntrusted": "BookOrbit could not verify the OIDC provider's TLS certificate. If the provider uses a private certificate authority, mount its PEM CA bundle, set NODE_EXTRA_CA_CERTS to the bundle's in-container path, and restart BookOrbit.",
"hide": "Hide",
"details": "Details",
"supported": "supported",