Corentin JOGUET
445dda260a
Service account pattern resolves 401 PERMISSION_DENIED on Baserow metadata endpoints (/api/database/views/table/:id/, /api/database/tables/:id/) which reject DB tokens. A dedicated Baserow user account logs in via token-auth, JWT cached in memory with mutex-protected refresh before expiry. Fallback graceful: if BASEROW_USER_EMAIL/PASSWORD absent, CRUD rows still work, metadata endpoints return 500 BASEROW_USER_AUTH_NOT_CONFIGURED. 417 tests pass (was 392, +25). 0 TS errors. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
75 lines
3.5 KiB
Text
75 lines
3.5 KiB
Text
# Bridge service — variables d'environnement
|
|
# Copier vers .env et remplir avec valeurs reelles.
|
|
|
|
# Server
|
|
NODE_ENV=development
|
|
PORT=4000
|
|
LOG_LEVEL=debug
|
|
|
|
# Baserow API — DB token (CRUD rows)
|
|
BASEROW_API_URL=http://baserow:80/api
|
|
BASEROW_API_TOKEN=
|
|
|
|
# Baserow service account — user JWT (endpoints metadata : views, tables detail)
|
|
# Le DB token (BASEROW_API_TOKEN) renvoie 401 PERMISSION_DENIED sur les endpoints
|
|
# comme GET /api/database/views/table/:id/. Un compte Baserow dedie resout ce probleme.
|
|
#
|
|
# Creer le compte dans l'interface Baserow : /admin/users/ > Add user.
|
|
# Privileges requis : acces en lecture a la database concernee (pas besoin d'admin).
|
|
# Exemple : email=bridge-svc@interne.local, mot de passe fort genere.
|
|
# Si absent, les routes /api/v1/views/* renvoient 500 BASEROW_USER_AUTH_NOT_CONFIGURED.
|
|
#
|
|
# BASEROW_USER_EMAIL=bridge-svc@interne.local
|
|
# BASEROW_USER_PASSWORD=generated-strong-password-here
|
|
# BASEROW_JWT_REFRESH_MARGIN=60 # secondes avant expiry ou le bridge refresh (defaut 60)
|
|
|
|
# Docmost API (optionnel — pas utilise par le bridge generique R1)
|
|
# DOCMOST_API_URL=http://docmost:3000/api
|
|
# DOCMOST_API_TOKEN=
|
|
|
|
# Redis (cache + idempotence webhooks + rate limit)
|
|
REDIS_URL=redis://docmost-redis:6379
|
|
|
|
# Webhooks Baserow signature secret (HMAC-SHA256, header X-Baserow-Signature)
|
|
BASEROW_WEBHOOK_SECRET=
|
|
|
|
# Webhooks Docmost signature secret (HMAC-SHA256, header X-Docmost-Signature)
|
|
# Stub Bloc 7b — handlers metier viennent en Bloc 8 (Tiptap node-views)
|
|
# DOCMOST_WEBHOOK_SECRET=
|
|
|
|
# Auth tokens bridge — JSON serialise (Phase 2 simple)
|
|
# Format: [{"token":"brg_xxx","name":"label","scopes":["read:tables",...]}]
|
|
# Scopes generiques R1 : read:tables, write:tables, admin:*
|
|
BRIDGE_API_TOKENS=
|
|
|
|
# Authentik OIDC (optional — laisse vide pour mode local-only avec service tokens)
|
|
# Active uniquement si AUTHENTIK_ISSUER + AUTHENTIK_JWKS_URI + AUTHENTIK_AUDIENCE sont set.
|
|
# AUTHENTIK_ISSUER=https://auth.acadenice.com/application/o/formation-hub/
|
|
# AUTHENTIK_JWKS_URI=https://auth.acadenice.com/application/o/formation-hub/jwks/
|
|
# AUTHENTIK_AUDIENCE=formation-hub-bridge
|
|
# Mapping group Authentik -> scopes bridge (optionnel).
|
|
# AUTH_GROUPS_SCOPES_MAP={"acadenice-admins":["admin:*"],"acadenice-formateurs":["read:tables","write:tables"]}
|
|
#
|
|
# R1 generique : le bridge lit aussi le claim JWT `acadenice_permissions[]`
|
|
# qui alimente directement les scopes (alimente cote DocAdenice par le RBAC R2).
|
|
|
|
# JWT HMAC DocAdenice (Docmost fork) — mode local sans Authentik (R2.3b)
|
|
# Le bridge accepte les JWT HS256/384/512 signes par DocAdenice avec son APP_SECRET
|
|
# (le meme secret que `docmost.appSecret`). Permet au frontend Docmost d'appeler
|
|
# le bridge directement avec son cookie/Bearer Docmost natif, sans IdP OIDC.
|
|
# Laisse vide en prod si Authentik OIDC est branche — l'utilisateur passe par OIDC.
|
|
# Le secret doit faire >= 32 chars (matche les contraintes Docmost).
|
|
# DOCMOST_APP_SECRET=must-be-32-chars-or-more-and-match-docmost-app-secret
|
|
# DOCMOST_JWT_ISSUER=Docmost
|
|
# DOCMOST_JWT_AUDIENCE=
|
|
|
|
# Rate limiting (Bloc 5) — sliding window Redis sur /api/v1/*
|
|
# (hors /api/health, /api/ready, /api/webhooks/* qui ont leur propre defense).
|
|
# Global s'applique sur tous les verbes ; Mutation s'ajoute sur POST/PATCH/PUT/DELETE
|
|
# avec un compteur Redis distinct (suffixe `:mut`) volontairement plus strict.
|
|
# Cle derivee de l'identite : tokenId (service token) > email OIDC > sub OIDC > IP > anonymous.
|
|
# Defauts conservateurs ci-dessous, override si besoin.
|
|
# RATE_LIMIT_GLOBAL_MAX=100
|
|
# RATE_LIMIT_GLOBAL_WINDOW=60
|
|
# RATE_LIMIT_MUTATION_MAX=30
|
|
# RATE_LIMIT_MUTATION_WINDOW=60
|