Publish curated Unraid-AppOps-Gateway source from 451646fee806a47e3256731766980a05a262dcdd

backend/app/services/setup_service.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import json
 from typing import Any
 
 from sqlmodel import Session, select
@@ -11,6 +12,7 @@ from ..core.redaction import redact_message
 from ..core.time import utc_now
 from ..core.network_security import validate_connector_url
 from ..db.models import AppContainerMapping, AppSetting, AuditEvent, Connector, DiscoveryRun, Secret
+from ..schemas.forge_oidc import FORGE_OIDC_BINDING_SECRET_REF, ForgeOidcBindingV1
 from .audit_logger import log_event
 from .secret_store import empty_secret_status, get_secret, has_secret, secret_status, secret_storage_status, set_secret
 from . import safety_center_service
@@ -219,6 +221,61 @@ def _apply_connector_config_to_runtime(session: Session, connector_id: str) -> N
             settings.apis[secret_env] = stored_secret
         elif secret_row and secret_row.value_json.get('value'):
             settings.apis[secret_env] = secret_row.value_json.get('value')
+    if connector_id == 'authentik':
+        _apply_forge_oidc_binding_to_runtime(session)
+
+
+def _unique_json_object(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
+    result: dict[str, Any] = {}
+    for key, value in pairs:
+        if key in result:
+            raise ValueError('duplicate_json_key')
+        result[key] = value
+    return result
+
+
+def _apply_forge_oidc_binding_to_runtime(session: Session) -> bool:
+    """Load protected Forge resource IDs atomically and fail closed on bad state.
+
+    This fixed secret reference is intentionally absent from connector setup
+    fields and response schemas. Generic Authentik settings can only update the
+    Authentik URL/TLS/token inputs, never these remote resource bindings.
+    """
+    internal_keys = (
+        'AUTHENTIK_FORGE_OIDC_PROVIDER_ID',
+        'AUTHENTIK_FORGE_OIDC_OPENID_CLAIM_MAPPING',
+        'AUTHENTIK_FORGE_OIDC_EMAIL_CLAIM_MAPPING',
+        'AUTHENTIK_FORGE_OIDC_PROFILE_CLAIM_MAPPING',
+    )
+    settings.apis.update({key: None for key in internal_keys})
+    settings.apis['AUTHENTIK_FORGE_OIDC_BINDING_VALID'] = False
+    try:
+        raw = get_secret(session, FORGE_OIDC_BINDING_SECRET_REF, touch=False)
+        if not isinstance(raw, str) or not raw:
+            return False
+        payload = json.loads(raw, object_pairs_hook=_unique_json_object)
+        if (
+            not isinstance(payload, dict)
+            or set(payload) != {'version', 'providerId', 'scopeMappingIds'}
+            or not isinstance(payload.get('scopeMappingIds'), dict)
+            or set(payload['scopeMappingIds']) != {'openid', 'email', 'profile'}
+        ):
+            return False
+        binding = ForgeOidcBindingV1.model_validate(payload)
+    except Exception:  # noqa: BLE001 - binding failures never expose encrypted-store contents.
+        return False
+
+    # Only publish values after the whole versioned record and distinct UUIDs
+    # have passed validation. Keep the stored JSON out of runtime settings.
+    values = {
+        'AUTHENTIK_FORGE_OIDC_PROVIDER_ID': binding.provider_id,
+        'AUTHENTIK_FORGE_OIDC_OPENID_CLAIM_MAPPING': str(binding.scope_mapping_ids.openid),
+        'AUTHENTIK_FORGE_OIDC_EMAIL_CLAIM_MAPPING': str(binding.scope_mapping_ids.email),
+        'AUTHENTIK_FORGE_OIDC_PROFILE_CLAIM_MAPPING': str(binding.scope_mapping_ids.profile),
+    }
+    settings.apis.update(values)
+    settings.apis['AUTHENTIK_FORGE_OIDC_BINDING_VALID'] = True
+    return True
 
 
 def apply_stored_connector_settings(session: Session, connector_ids: set[str] | None = None) -> None: