shadowdaoandClaude Opus 4.7
077d0a0825
End-to-end Phase 1 of shared-memory: a logged-in Authentik user can sign into the Web UI (/me debug page), and an MCP client with an Authentik- issued bearer token can call memory.write / memory.list / memory.get / memory.delete plus project.identify against /api/mcp. Stack: - Next.js 15 (App Router) + React 19 + TypeScript, pnpm workspaces - Drizzle ORM + Postgres 16 + pgvector + pg_trgm - Auth.js v5 with Authentik provider (Web UI) - jose + Authentik JWKS for MCP bearer-token validation - JSON-RPC 2.0 dispatcher implementing the MCP wire protocol over plain HTTP POST (hand-rolled to fit Next.js App Router; switches to SSE in a later phase if server-initiated events are needed) - bge-small embeddings sidecar deferred to Phase 2; the schema already reserves the vector(384) column + IVFFlat index, FTS via a STORED tsvector column, and the visibility enum (private/shared/team) so cross-user memory sharing can be added without a future migration Deployment supports two modes (set in .env, never committed): - Behind an external reverse proxy (HAProxy / nginx / Cloudflare Tunnel / Traefik) — DEFAULT; the app exposes APP_PORT on the host with X-Forwarded-* trusted, no in-container TLS - Built-in TLS via Caddy — opt-in with `docker compose --profile tls up` Discovery endpoint at /.well-known/oauth-protected-resource (RFC 9728) points MCP clients at the Authentik authorization server after a 401. README walks through both Authentik providers (Web UI + MCP resource server), the audience scope mapping, redirect URIs, and includes a worked HAProxy config snippet. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
83 lines
2.5 KiB
TypeScript
83 lines
2.5 KiB
TypeScript
import NextAuth from "next-auth";
|
|
import Authentik from "next-auth/providers/authentik";
|
|
import { env } from "@/lib/env";
|
|
import { db } from "@/lib/db/client";
|
|
import { users } from "@/lib/db/schema";
|
|
|
|
/**
|
|
* NextAuth (Auth.js v5) configuration.
|
|
*
|
|
* Authentik is the OIDC issuer. We store the user's OIDC `sub` + `iss` on
|
|
* first sign-in, upserting a row in `users`. The internal user UUID lives on
|
|
* the JWT/session so downstream code never has to re-resolve it.
|
|
*/
|
|
export const { auth, handlers, signIn, signOut } = NextAuth({
|
|
providers: [
|
|
Authentik({
|
|
clientId: env().OIDC_CLIENT_ID_WEB,
|
|
clientSecret: env().OIDC_CLIENT_SECRET_WEB,
|
|
issuer: env().OIDC_ISSUER,
|
|
}),
|
|
],
|
|
secret: env().NEXTAUTH_SECRET,
|
|
session: { strategy: "jwt" },
|
|
// Sign-in page is the default Auth.js form; can be customized later.
|
|
pages: { signIn: "/api/auth/signin" },
|
|
callbacks: {
|
|
async jwt({ token, account, profile }) {
|
|
// On first call after sign-in, `account` + `profile` are populated.
|
|
if (account && profile) {
|
|
const sub = profile.sub;
|
|
const iss = (profile.iss as string | undefined) ?? env().OIDC_ISSUER;
|
|
if (!sub) throw new Error("OIDC profile missing `sub` claim");
|
|
|
|
const row = await db
|
|
.insert(users)
|
|
.values({
|
|
oidcSub: sub,
|
|
oidcIss: iss,
|
|
email: profile.email ?? null,
|
|
name: profile.name ?? null,
|
|
picture: (profile.picture as string | undefined) ?? null,
|
|
})
|
|
.onConflictDoUpdate({
|
|
target: [users.oidcIss, users.oidcSub],
|
|
set: {
|
|
email: profile.email ?? null,
|
|
name: profile.name ?? null,
|
|
picture: (profile.picture as string | undefined) ?? null,
|
|
lastSeenAt: new Date(),
|
|
},
|
|
})
|
|
.returning({ id: users.id });
|
|
|
|
token.userId = row[0]?.id;
|
|
token.sub = sub;
|
|
token.iss = iss;
|
|
}
|
|
return token;
|
|
},
|
|
async session({ session, token }) {
|
|
if (token.userId && typeof token.userId === "string") {
|
|
session.user = { ...session.user, id: token.userId };
|
|
}
|
|
return session;
|
|
},
|
|
},
|
|
});
|
|
|
|
// ---------- module augmentation: typed session.user.id ----------
|
|
|
|
declare module "next-auth" {
|
|
interface Session {
|
|
user: {
|
|
id: string;
|
|
name?: string | null;
|
|
email?: string | null;
|
|
image?: string | null;
|
|
};
|
|
}
|
|
}
|
|
|
|
export type { Session } from "next-auth";
|