mirror of
https://github.com/dograh-hq/dograh.git
synced 2026-07-13 11:22:14 +02:00
e7494e9c21
* feat(auth): gate OSS signup behind ENABLE_SIGNUP flag
## Problem
The `POST /api/v1/auth/signup` endpoint is unconditionally exposed on
every OSS install. Operators running an invite-only deployment (private
customer instances, staging environments, internal-only tenants) have
no way to disable public account creation without patching the codebase.
The UI also shows the "Sign up" link on `/auth/login` regardless of
whether signup is available, so a locked-down deployment leaves broken
navigation on the login page.
## Fix
Introduce a single `ENABLE_SIGNUP` env var (default `true` — no behavior
change for existing installs) that controls signup end-to-end:
- **Backend** — `api/constants.ENABLE_SIGNUP` is read at module load.
The signup handler returns 403 when it's false. Also exposed on
`GET /api/v1/health` as `signup_enabled: bool` so the UI can mirror
the operator's choice at runtime instead of at bundle-build time.
- **UI** — `getSignupEnabled()` in `lib/auth/config.ts` proxies the
health field, `/api/config/auth` surfaces it to the browser, the
login page conditionally renders the "Sign up" link via a one-shot
`fetch("/api/config/auth")` in `useEffect`, and the middleware
redirects `/auth/signup` → `/auth/login` when disabled (fires before
Next.js can serve the statically-prerendered signup page).
- **Helm** — `config.enableSignup` (default `true`) is rendered into
the ConfigMap as `ENABLE_SIGNUP` so operators can flip it via
`--set config.enableSignup=false` at install/upgrade time.
Fallbacks default to `signupEnabled: true` in every layer so a fresh
install "just works" and matches the backend default.
* address review: rollout on ConfigMap change, cache TTL, no signup-link flash
Four review points on #514:
**P1 — ConfigMap Change Skips Rollout** (`configmap.yaml`). `helm upgrade
--set config.enableSignup=false` updated the ConfigMap but did NOT roll
the api pods, so running processes kept the ENABLE_SIGNUP env from
startup and continued serving the old signup behavior — including
divergence between replicas mid-upgrade.
Fix: add the standard `checksum/config` pod-template annotation on the
four backend Deployments that `envFrom` the ConfigMap (`web`,
`arq-worker`, `ari-manager`, `campaign-orchestrator`). Verified with
`helm template`: all four Deployments share the same checksum on any
given render, and flipping `config.enableSignup` changes the checksum
uniformly so kubectl sees a pod-template diff and rolls all four.
**P1 — Signup Flag Stays Cached (server)** (`ui/src/lib/auth/config.ts`).
Module-scoped cache had no TTL. `revalidate: 300` was passed on the
underlying `fetch()` but the in-memory short-circuit above ran first, so
the value never refreshed until the UI pod restarted.
Fix: add `AUTH_CONFIG_TTL_MS = 5 * 60 * 1000` (matching the fetch
revalidate hint) so the module cache and the Next fetch cache stay in
sync. Backend flag flips propagate within 5 minutes without a pod
restart.
**P1 — Middleware Redirect Uses Stale State** (`ui/src/middleware.ts`).
Same shape as above — a separate module cache with no expiry could keep
redirecting `/auth/signup → /auth/login` after signup was re-enabled, or
keep serving the statically-prerendered signup page after lockdown.
Fix: same `SERVER_CONFIG_TTL_MS = 5 * 60 * 1000` TTL on the middleware
cache.
**P2 — Signup link flash on login page** (`ui/src/app/auth/login/page.tsx`).
Initial `signupEnabled` state was `null`, so `{signupEnabled && ...}`
hid the link on first paint and it popped in after the fetch resolved
— a CLS on every login-page load on stock installs where signup is
enabled.
Fix: initialise the state to `true` (matches the backend default). The
fetch still overrides to `false` when the operator has actually
disabled signup, so the lockdown UI behavior is unchanged; only the
happy-path flash is gone.
* simplify signup flag: drop TTL caches and middleware redirect
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* resolve signup flag server-side to avoid signup link flicker
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: prabhat pankaj <prabhatiitbhu@gmail.com>
Co-authored-by: Abhishek Kumar <abhishek@a6k.me>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
62 lines
2.6 KiB
Text
62 lines
2.6 KiB
Text
# Environment Configuration
|
|
ENVIRONMENT="local"
|
|
LOG_LEVEL="DEBUG"
|
|
|
|
# Set to "false" to disable public signup (invite-only installs)
|
|
ENABLE_SIGNUP="true"
|
|
|
|
# Change these values if you deploy the backend and frontend
|
|
# on any hosting provider with some DNS. Please ensure to
|
|
# provide the URL with scheme like http or https
|
|
BACKEND_API_ENDPOINT="http://localhost:8000"
|
|
UI_APP_URL="http://localhost:3000"
|
|
|
|
# Database Configuration
|
|
DATABASE_URL="postgresql+asyncpg://postgres:postgres@localhost:5432/postgres"
|
|
REDIS_URL="redis://:redissecret@localhost:6379"
|
|
|
|
# Internal devops secret for deployment scripts and lifecycle hooks.
|
|
# scripts/rolling_update.sh sends this to protected operational endpoints via
|
|
# X-Dograh-Devops-Secret. Use a unique random value in production.
|
|
DOGRAH_DEVOPS_SECRET="change-me-dograh-devops-secret"
|
|
|
|
# AWS S3 Configuration
|
|
ENABLE_AWS_S3="false"
|
|
# AWS_ACCESS_KEY_ID=""
|
|
# AWS_SECRET_ACCESS_KEY=""
|
|
# S3_BUCKET=""
|
|
# S3_REGION=""
|
|
# --- S3-compatible servers (MinIO, rustfs, Ceph, ...) ---
|
|
# Use the S3 backend (ENABLE_AWS_S3=true) against a non-AWS, S3-compatible
|
|
# server by overriding the endpoint and signing. Unlike the MinIO backend, the
|
|
# S3 backend emits real presigned URLs, so the bucket can stay private.
|
|
# S3_ENDPOINT_URL="" # e.g. https://s3.example.com (blank = AWS default)
|
|
# S3_SIGNATURE_VERSION="" # blank = botocore default; set "s3v4" if the server requires SigV4
|
|
# S3_ADDRESSING_STYLE="" # blank = auto; set "path" if the server / TLS cert requires path-style
|
|
|
|
# MinIO Configuration if using containerised MinIO instead of
|
|
# AWS S3
|
|
MINIO_ENDPOINT=localhost:9000
|
|
# Full URL (with scheme) that browsers use to reach MinIO. Required.
|
|
# Remote deployments behind HTTPS: set to e.g. https://your-server.example.com
|
|
MINIO_PUBLIC_ENDPOINT=http://localhost:9000
|
|
MINIO_ACCESS_KEY=minioadmin
|
|
MINIO_SECRET_KEY=minioadmin
|
|
MINIO_BUCKET=voice-audio
|
|
MINIO_SECURE=false
|
|
|
|
# Tracing and Analytics using Langfuse
|
|
# Credentials can be set here or per-organization via the UI at /settings.
|
|
# Tracing is automatically active when credentials are available.
|
|
# LANGFUSE_SECRET_KEY="sk-lf-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
|
|
# LANGFUSE_PUBLIC_KEY="pk-lf-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
|
|
# LANGFUSE_HOST="https://cloud.langfuse.com"
|
|
|
|
# TURN Server Configuration (for WebRTC NAT traversal)
|
|
# Required for reliable WebRTC connections behind firewalls/NAT
|
|
# Uses time-limited credentials (TURN REST API) for security
|
|
TURN_HOST=localhost
|
|
TURN_SECRET=dograh-turn-secret-change-in-production
|
|
# TURN_PORT=3478 # Default: 3478
|
|
# TURN_TLS_PORT=5349 # Default: 5349
|
|
# TURN_CREDENTIAL_TTL=86400 # Default: 24 hours in seconds
|