Initial commit.

2026-07-15 07:49:11 -04:00
commit a3f0f8a1be
37 changed files with 2825 additions and 0 deletions
@@ -0,0 +1,113 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
+
+cmd-google-auth-configure() {
+  declare desc="configure the shared Google OAuth service"
+  local cmd="google-auth:configure"
+  [[ "$1" == "$cmd" ]] && shift 1
+
+  local domains=() emails=() domains_given=false emails_given=false
+  local old_port
+  old_port="$(fn-ga-global-get port "$GOOGLE_AUTH_DEFAULT_PORT")"
+
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --client-id)
+        [[ -n "${2:-}" ]] || dokku_log_fail "--client-id requires a value"
+        fn-ga-global-set client-id "$2"
+        shift 2
+        ;;
+      --client-secret)
+        [[ -n "${2:-}" ]] || dokku_log_fail "--client-secret requires a value"
+        fn-ga-global-set client-secret "$2"
+        shift 2
+        ;;
+      --auth-host)
+        [[ -n "${2:-}" ]] || dokku_log_fail "--auth-host requires a value"
+        local host="${2#https://}"
+        host="${host#http://}"
+        host="${host%/}"
+        fn-ga-global-set auth-host "${host,,}"
+        shift 2
+        ;;
+      --allow-domain)
+        [[ -n "${2:-}" ]] || dokku_log_fail "--allow-domain requires a value"
+        domains_given=true
+        domains+=("${2,,}")
+        shift 2
+        ;;
+      --allow-email)
+        [[ -n "${2:-}" ]] || dokku_log_fail "--allow-email requires a value"
+        emails_given=true
+        emails+=("${2,,}")
+        shift 2
+        ;;
+      --session-ttl)
+        [[ "${2:-}" =~ ^[0-9]+(h|m|s)$ ]] || dokku_log_fail "--session-ttl must look like 24h, 30m, or 3600s"
+        fn-ga-global-set session-ttl "$2"
+        shift 2
+        ;;
+      --cookie-name)
+        [[ -n "${2:-}" ]] || dokku_log_fail "--cookie-name requires a value"
+        fn-ga-global-set cookie-name "$2"
+        shift 2
+        ;;
+      --port)
+        [[ "${2:-}" =~ ^[0-9]+$ ]] || dokku_log_fail "--port must be a number"
+        fn-ga-global-set port "$2"
+        shift 2
+        ;;
+      --insecure-allow-http)
+        # For local/dev testing only; Google requires https redirect URIs.
+        fn-ga-global-set allow-insecure true
+        shift 1
+        ;;
+      --regenerate-cookie-secret)
+        fn-ga-global-set cookie-secret "$(head -c32 /dev/urandom | od -An -tx1 | tr -d ' \n')"
+        dokku_log_info1 "cookie secret regenerated; all existing sessions are now invalid"
+        shift 1
+        ;;
+      *)
+        dokku_log_fail "unknown flag: $1 (see: dokku google-auth:help)"
+        ;;
+    esac
+  done
+
+  # Replace the allow lists only when new values were passed.
+  [[ "$domains_given" == "true" ]] && fn-ga-global-set-list allowed-domains "${domains[@]}"
+  [[ "$emails_given" == "true" ]] && fn-ga-global-set-list allowed-emails "${emails[@]}"
+
+  # First run: generate the cookie secret automatically.
+  if [[ -z "$(fn-ga-global-get cookie-secret)" ]]; then
+    fn-ga-global-set cookie-secret "$(head -c32 /dev/urandom | od -An -tx1 | tr -d ' \n')"
+  fi
+
+  if ! fn-ga-configured; then
+    dokku_log_warn "configuration incomplete — required: --client-id, --client-secret, --auth-host, and at least one --allow-domain or --allow-email"
+    dokku_log_warn "settings so far are saved; run google-auth:configure again with the missing flags"
+    return 0
+  fi
+
+  fn-ga-service-start
+
+  local new_port
+  new_port="$(fn-ga-global-get port "$GOOGLE_AUTH_DEFAULT_PORT")"
+  if [[ "$new_port" != "$old_port" ]]; then
+    dokku_log_info1 "service port changed; regenerating nginx config for enabled apps"
+    fn-ga-apply-all
+  fi
+
+  local auth_host
+  auth_host="$(fn-ga-global-get auth-host)"
+  dokku_log_info2 "google-auth configured"
+  dokku_log_verbose "Register this redirect URI in the Google Cloud Console for your OAuth client:"
+  dokku_log_verbose ""
+  dokku_log_verbose "    https://${auth_host}${GOOGLE_AUTH_ROUTE_PREFIX}/callback"
+  dokku_log_verbose ""
+  dokku_log_verbose "Then protect apps with: dokku google-auth:enable <app>"
+  fn-ga-warn-if-auth-host-unrouted
+}
+
+cmd-google-auth-configure "$@"