120 lines
4.4 KiB
Bash
Executable File
120 lines
4.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -eo pipefail
|
|
[[ $DOKKU_TRACE ]] && set -x
|
|
source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
|
|
|
|
fn-ga-report-app() {
|
|
declare APP="$1"
|
|
local pattern found
|
|
dokku_log_info2 "$APP google-auth information"
|
|
if fn-google-auth-app-enabled "$APP"; then
|
|
dokku_log_verbose "Enabled: true"
|
|
found=false
|
|
while IFS= read -r pattern; do
|
|
[[ -z "$pattern" ]] && continue
|
|
if [[ "$found" == "false" ]]; then
|
|
dokku_log_verbose "Excluded: $pattern"
|
|
found=true
|
|
else
|
|
dokku_log_verbose " $pattern"
|
|
fi
|
|
done < <(fn-ga-excludes "$APP")
|
|
[[ "$found" == "false" ]] && dokku_log_verbose "Excluded: (none)"
|
|
else
|
|
dokku_log_verbose "Enabled: false"
|
|
fi
|
|
|
|
# Access lists are worth showing either way: they are often set before an app
|
|
# is enabled, and they persist across disable/enable.
|
|
local allow_entries=()
|
|
while IFS= read -r pattern; do
|
|
[[ -n "$pattern" ]] && allow_entries+=("$pattern (domain)")
|
|
done < <(fn-ga-list-get "$APP" allowed-domains)
|
|
while IFS= read -r pattern; do
|
|
[[ -n "$pattern" ]] && allow_entries+=("$pattern")
|
|
done < <(fn-ga-list-get "$APP" allowed-emails)
|
|
if [[ ${#allow_entries[@]} -eq 0 ]]; then
|
|
dokku_log_verbose "Allowed: (inherits the global allow list)"
|
|
else
|
|
dokku_log_verbose "Allowed: ${allow_entries[0]} (replaces the global allow list)"
|
|
local i
|
|
for ((i = 1; i < ${#allow_entries[@]}; i++)); do
|
|
dokku_log_verbose " ${allow_entries[i]}"
|
|
done
|
|
fi
|
|
|
|
found=false
|
|
while IFS= read -r pattern; do
|
|
[[ -z "$pattern" ]] && continue
|
|
if [[ "$found" == "false" ]]; then
|
|
dokku_log_verbose "Denied: $pattern"
|
|
found=true
|
|
else
|
|
dokku_log_verbose " $pattern"
|
|
fi
|
|
done < <(fn-ga-list-get "$APP" denied-emails)
|
|
[[ "$found" == "false" ]] && dokku_log_verbose "Denied: (none beyond the global deny list)"
|
|
|
|
if fn-google-auth-app-enabled "$APP"; then
|
|
if [[ -f "$(fn-ga-conf-path "$APP")" ]]; then
|
|
dokku_log_verbose "Nginx: $(fn-ga-conf-path "$APP")"
|
|
else
|
|
dokku_log_verbose "Nginx: (config pending; will be written on next deploy)"
|
|
fi
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
cmd-google-auth-report() {
|
|
declare desc="show global and per-app google-auth status"
|
|
local cmd="google-auth:report"
|
|
[[ "$1" == "$cmd" ]] && shift 1
|
|
declare APP="${1:-}"
|
|
|
|
if [[ -n "$APP" ]]; then
|
|
verify_app_name "$APP"
|
|
fn-ga-report-app "$APP"
|
|
return 0
|
|
fi
|
|
|
|
dokku_log_info2 "google-auth global information"
|
|
if fn-ga-configured; then
|
|
dokku_log_verbose "Configured: true"
|
|
else
|
|
dokku_log_verbose "Configured: false (run dokku google-auth:configure)"
|
|
fi
|
|
local client_id
|
|
client_id="$(fn-ga-global-get client-id)"
|
|
dokku_log_verbose "Client id: ${client_id:-(unset)}"
|
|
dokku_log_verbose "Client secret: $([[ -n "$(fn-ga-global-get client-secret)" ]] && echo '(set)' || echo '(unset)')"
|
|
dokku_log_verbose "Auth host: $(fn-ga-global-get auth-host '(unset)')"
|
|
dokku_log_verbose "Callback URL: https://$(fn-ga-global-get auth-host '<auth-host>')${GOOGLE_AUTH_ROUTE_PREFIX}/callback"
|
|
dokku_log_verbose "Allowed domains: $(fn-ga-global-get-list allowed-domains | paste -sd' ' -) (global default)"
|
|
dokku_log_verbose "Allowed emails: $(fn-ga-global-get-list allowed-emails | paste -sd' ' -)"
|
|
dokku_log_verbose "Denied emails: $(fn-ga-global-get-list denied-emails | paste -sd' ' -) (applies to every app)"
|
|
dokku_log_verbose "Session TTL: $(fn-ga-global-get session-ttl 24h)"
|
|
dokku_log_verbose "Service port: 127.0.0.1:$(fn-ga-global-get port "$GOOGLE_AUTH_DEFAULT_PORT")"
|
|
if ! fn-ga-service-running; then
|
|
dokku_log_verbose "Service: not running"
|
|
elif fn-ga-service-reads-app-lists; then
|
|
dokku_log_verbose "Service: running"
|
|
else
|
|
# Worth calling out: every per-app list below is being ignored, and the
|
|
# apps that have one are falling back to the broader global list.
|
|
dokku_log_verbose "Service: running, but IGNORING all per-app lists"
|
|
if ! fn-ga-image-current; then
|
|
dokku_log_verbose " (the service image is older than the plugin; fix with: dokku google-auth:restart)"
|
|
else
|
|
dokku_log_verbose " (started without the per-app config; fix with: dokku google-auth:restart)"
|
|
fi
|
|
fi
|
|
|
|
local app
|
|
while IFS= read -r app; do
|
|
[[ -z "$app" ]] && continue
|
|
fn-ga-report-app "$app"
|
|
done < <(fn-ga-enabled-apps)
|
|
}
|
|
|
|
cmd-google-auth-report "$@"
|