mirror of
https://github.com/DRYTRIX/TimeTracker.git
synced 2026-01-05 11:09:55 -06:00
5c11010095
- Add AUTH_METHOD switch (local | oidc | both); default remains local - Update login UI to conditionally show SSO button and/or local form - Add Authlib and initialize OAuth client (discovery-based) in app factory - Implement OIDC Authorization Code flow with PKCE: - GET /login/oidc → starts auth flow, preserves `next` - GET /auth/oidc/callback → exchanges code, parses ID token, fetches userinfo - Maps claims to username/full_name/email; admin mapping via group/email - Logs user in and redirects to intended page - Add optional OIDC end-session on logout (falls back gracefully if unsupported) - Extend User model with `email`, `oidc_issuer`, `oidc_sub` and unique constraint - Add Alembic migration 015 (adds columns, index, unique constraint) - Update env.example with OIDC variables and AUTH_METHOD - Add docs/OIDC_SETUP.md with provider-agnostic setup guide and examples - fix: remove invalid walrus usage in OIDC client registration Migration: - Run database migrations (e.g., `flask db upgrade`) to apply revision 015 Config: - AUTH_METHOD=local|oidc|both - OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, OIDC_REDIRECT_URI - OIDC_SCOPES (default: "openid profile email") - OIDC_USERNAME_CLAIM, OIDC_FULL_NAME_CLAIM, OIDC_EMAIL_CLAIM, OIDC_GROUPS_CLAIM - OIDC_ADMIN_GROUP (optional), OIDC_ADMIN_EMAILS (optional) - OIDC_POST_LOGOUT_REDIRECT_URI (optional) Routes: - /login (respects AUTH_METHOD), /login/oidc, /auth/oidc/callback, /logout Docs: - See docs/OIDC_SETUP.md for full setup, provider notes, and troubleshooting
62 lines
1.4 KiB
Plaintext
62 lines
1.4 KiB
Plaintext
# Flask settings
|
|
SECRET_KEY=your-secret-key-here
|
|
FLASK_ENV=production
|
|
FLASK_DEBUG=false
|
|
|
|
# Database settings
|
|
DATABASE_URL=postgresql+psycopg2://timetracker:timetracker@db:5432/timetracker
|
|
POSTGRES_DB=timetracker
|
|
POSTGRES_USER=timetracker
|
|
POSTGRES_PASSWORD=timetracker
|
|
POSTGRES_HOST=db
|
|
|
|
# Session settings
|
|
SESSION_COOKIE_SECURE=false
|
|
SESSION_COOKIE_HTTPONLY=true
|
|
PERMANENT_SESSION_LIFETIME=86400
|
|
|
|
# Application settings
|
|
TZ=Europe/Rome
|
|
CURRENCY=EUR
|
|
ROUNDING_MINUTES=1
|
|
SINGLE_ACTIVE_TIMER=true
|
|
IDLE_TIMEOUT_MINUTES=30
|
|
|
|
# User management
|
|
ALLOW_SELF_REGISTER=true
|
|
ADMIN_USERNAMES=admin
|
|
|
|
# Authentication
|
|
# Options: local | oidc | both
|
|
AUTH_METHOD=local
|
|
|
|
# OIDC (used when AUTH_METHOD=oidc or both)
|
|
# OIDC_ISSUER=https://login.microsoftonline.com/<tenant>/v2.0
|
|
# OIDC_CLIENT_ID=
|
|
# OIDC_CLIENT_SECRET=
|
|
# OIDC_REDIRECT_URI=https://yourapp.example.com/auth/oidc/callback
|
|
# OIDC_SCOPES=openid profile email
|
|
# OIDC_USERNAME_CLAIM=preferred_username
|
|
# OIDC_FULL_NAME_CLAIM=name
|
|
# OIDC_EMAIL_CLAIM=email
|
|
# OIDC_GROUPS_CLAIM=groups
|
|
# OIDC_ADMIN_GROUP=
|
|
# OIDC_ADMIN_EMAILS=
|
|
# OIDC_POST_LOGOUT_REDIRECT_URI=https://yourapp.example.com/
|
|
|
|
# Backup settings
|
|
BACKUP_RETENTION_DAYS=30
|
|
BACKUP_TIME=02:00
|
|
|
|
# File upload settings
|
|
MAX_CONTENT_LENGTH=16777216
|
|
UPLOAD_FOLDER=/data/uploads
|
|
|
|
# CSRF protection
|
|
WTF_CSRF_ENABLED=false
|
|
WTF_CSRF_TIME_LIMIT=3600
|
|
|
|
# Logging
|
|
LOG_LEVEL=INFO
|
|
LOG_FILE=/data/logs/timetracker.log
|