Cannot configure OIDC - /api/auth/settings requires authentication (circular dependency)

[SamTanna]

Issue Summary
The frontend cannot load OIDC provider configuration because the /api/auth/settings endpoint requires authentication, creating a circular dependency where users need to authenticate to see the authentication options.

Environment
Version: codewithcj/sparkyfitness:latest (v0.15.7.3)
Server: codewithcj/sparkyfitness_server:latest
Deployment: Docker Compose
Reverse Proxy: Traefik with Cloudflare
IdP: Authentik

Steps to Reproduce
Configure OIDC provider in oidc_providers table with encrypted client secret
Set is_oidc_active = true in global_settings table
Navigate to login page at https://fit.my-fam.org
Open browser DevTools → Network tab

Expected Behavior
OIDC login button should appear: "Sign in with Authentik"
Frontend should load OIDC providers from a public endpoint

Actual Behavior
Warning message: "Could not load login settings from server. Defaulting to email login."
Only email/password login form displayed
Network tab shows: GET /api/auth/settings → 401 Unauthorized

Technical Analysis
Working endpoint (public):
curl https://fit.my-fam.org/openid/providers
Returns: [{"id":1,"display_name":"Authentik","logo_url":null}]
Broken endpoint (protected):
curl https://fit.my-fam.org/api/auth/settings
Returns: {"error":"Authentication: No token or active session provided."}

**Server logs:**

[WARN] Authentication: No token or active session provided.
[DEBUG] Skipping authentication for public route: /openid/api/me
The authentication middleware correctly skips /openid/api/me but not /api/auth/settings.

Root Cause
The frontend attempts to fetch OIDC configuration from /api/auth/settings, but this endpoint is protected by authentication middleware. The /openid/providers endpoint exists and works correctly (returns OIDC providers without authentication), but the frontend doesn't use it.

Proposed Solutions
Option 1: Add /api/auth/settings to authentication middleware's public routes whitelist
Option 2: Update frontend to use /openid/providers instead of /api/auth/settings
Option 3: Create a new public endpoint like /api/public/auth/settings specifically for unauthenticated configuration retrieval

Additional Context
Database configuration is correct (verified via direct database queries)
All migrations applied successfully
The /openid/providers endpoint proves the OIDC configuration is stored and retrievable
This appears to be a regression from recent OIDC refactoring mentioned in v0.15.7.2 release notes

Impact
OIDC-only deployments are currently impossible. Users requiring SSO integration cannot use SparkyFitness without also enabling email/password authentication as a workaround.

[CodeWithCJ]

I couldn't replicate on my end. when you disable login/password and use OIDC only, it directly takes to authentication page of ODIC provider. It shows SparkyFitness's login screen for a fraction of second and redirects immediately.

[SamTanna]

Thank you for the quick response! Here are detailed reproduction steps and environment details:

(Please note that I'm using Claude AI assistance)

Environment

Reverse Proxy: Traefik (edge SSL termination)
IdP: Authentik (self-hosted)
Deployment: Docker Compose with external network
Access: Via Cloudflare proxy (orange-cloud)

Database Configuration
global_settings table:
id | enable_email_password_login | is_oidc_active
----+-----------------------------+----------------
1 | t | t

oidc_providers table:

id | display_name | issuer_url | client_id | is_active | auto_register
----+--------------+-------------------------------------------+------------+-----------+---------------
1 | Authentik | https://auth.example.com/application/o/ | | t | t
Reproduction Steps

Deploy fresh instance with OIDC enabled and email/password enabled (as shown above)
Navigate to the app URL
Observe frontend behavior:

Warning displayed: "Could not load login settings from server. Defaulting to email login."
Only email/password form shown
No OIDC button appears

Check browser DevTools Network tab:

GET /api/auth/settings returns 401 Unauthorized
Response: {"error":"Authentication: No token or active session provided."}

Verify public endpoint works:

curl https://app.example.com/openid/providers
Returns: [{"id":1,"display_name":"Authentik","logo_url":null}]

Check server logs:

[WARN] Authentication: No token or active session provided.

Possible Difference: Reverse Proxy Setup
Question: Are you testing with:

Direct access (localhost:3010)?
Reverse proxy with authentication passthrough?

My setup:

Traefik routes /api to sparkyfitness-server:3010
Traefik routes / to sparkyfitness-web:80
Headers forwarded: X-Forwarded-*, X-Real-IP

Test Request
Can you test this specific scenario from outside the container (simulating browser request through reverse proxy):
curl -H "Origin: https://app.example.com/" https://app.example.com/api/auth/settings
Expected (your working setup): JSON with auth settings
Actual (my setup): {"error":"Authentication: No token or active session provided."}
Environment Variables (Sanitized)
Server environment (relevant subset):

SPARKY_FITNESS_FRONTEND_URL: https://app.example.com/
SPARKY_FITNESS_SERVER_URL: https://app.example.com/
OIDC_ENABLED: "true"
OIDC_ISSUER: https://auth.example.com/application/o/
OIDC_CLIENT_ID: [redacted]
OIDC_CLIENT_SECRET: [encrypted in database]

Question for Developer
When you disable email/password login (enable_email_password_login = false), does the frontend still attempt to call /api/auth/settings first, or does it skip straight to OIDC redirect?
Theory: The authentication middleware might be checking session/token presence differently when behind a reverse proxy vs direct access. The /openid/providers endpoint works (returns 200), but /api/auth/settings returns 401.
Additional Tests I Can Run
Let me know if you'd like me to:

Capture full request/response headers
Test with enable_email_password_login = false
Test direct container access (bypassing Traefik)
Provide complete docker-compose.yml (sanitized)
Check for any CORS-related issues

Again, thanks - excited to get this app working!

[CodeWithCJ]

Traefik routes /api to sparkyfitness-server:3010

Something seems off with your current configuration. You actually don’t need to set up anything in Traefik beyond the front-end routing. All other routes—such as /api and other internal endpoints—are automatically handled by the internal Nginx within SparkyFitness.

Please refer to the Wiki for a sample configuration using Nginx Proxy Manager (this serves the same purpose as your Traefik). Don’t confuse this with the internal Nginx bundled inside SparkyFitness.

Here’s how the app is designed to behave:

• Login/password authentication is enabled by default, but you can disable it if you’ve configured OIDC.
• If OIDC encounters any issue, the system will automatically fall back to login/password.
• Login/password can also be explicitly enabled through an environment variable, regardless of front-end settings.
• If both login/password are disabled and no env variable forces them on, and OIDC is properly configured, the app will directly redirect users to your OIDC provider’s authentication page.

Warning displayed: "Could not load login settings from server. Defaulting to email login."

find out if your OIDC is properly configured. If this is from the server log, it means OIDC is not working properly.

[SamTanna]

Success! SparkyFitness is running with Authentik SSO 🎉

Hi @CodeWithCJ - I wanted to follow up and let you know we successfully got SparkyFitness running with Authentik OIDC! The app looks fantastic and works beautifully. Thank you so much for creating and sharing this - it's exactly what our family needed for tracking fitness together.

What We Learned During Implementation

After troubleshooting and getting your help, we discovered the architecture expects the frontend to handle the OIDC callback, not the backend directly. The flow works like this:

1. Authentik redirects to /oidc-callback (frontend route)
2. Frontend receives code and state
3. Frontend POSTs to /api/openid/callback (backend endpoint)
4. Backend exchanges code for tokens and establishes session

Key Configuration Points:

• Redirect URI in OIDC provider: https://fit.my-url.tld/oidc-callback (frontend, not /api/...)
• Backend callback is POST-only at /openid/callback
• Client secret must be encrypted using AES-256-GCM with:
  • 12-byte IV (not 16!)
  • Base64 encoding (not hex)
  • Stored in oidc_providers table with encrypted_client_secret, client_secret_iv, client_secret_tag

Network Setup:

• We deployed behind Traefik reverse proxy
• Only the frontend (sparkyfitness-web) is published via Traefik
• Internal nginx (in the web container) routes /api/* requests to sparkyfitness-server:3010
• Both containers must be on the same Docker network for internal communication
• Required environment variables: NODE_ENV=production, TRUST_PROXY=true

Database Setup:

• OIDC providers are stored in the oidc_providers table (not configured via env vars)
• Global settings in global_settings table control whether OIDC is active
• Setting enable_email_password_login=false hides the email/password form (SSO-only mode)

One Small Enhancement: Logout Handler

The logout currently works well for clearing the local session, but doesn't fully log out of the SSO provider. When a user clicks logout, they're automatically logged back in because the Authentik session is still active.

Current behavior:

javascript

// /routes/authRoutes.js
router.post('/logout', (req, res, next) => {
  req.session.destroy((err) => {
    // Clears local session
    res.clearCookie('sparky.sid');
    res.status(200).json({ message: 'Logout successful.' });
  });
});

Suggested enhancement: The logout should redirect to the OIDC provider's end_session_endpoint (discovered from .well-known/openid-configuration) to fully clear the SSO session:

javascript

router.post('/logout', async (req, res, next) => {
  const providerId = req.session?.providerId;
  
  req.session.destroy((err) => {
    if (err) return next(err);
    
    res.clearCookie('sparky.sid');
    
    // If OIDC user, return end_session_endpoint for frontend to redirect
    if (providerId) {
      const provider = await getOidcProviderById(providerId);
      const endSessionUrl = `${provider.issuer_url}end-session/?post_logout_redirect_uri=${process.env.SPARKY_FITNESS_FRONTEND_URL}/`;
      return res.status(200).json({ 
        message: 'Logout successful.',
        redirectUrl: endSessionUrl 
      });
    }
    
    res.status(200).json({ message: 'Logout successful.' });
  });
});

Workaround for now: Users can visit the Authentik end-session URL directly:

https://auth.my-url.tld/application/o/sparkyfitness/end-session/?post_logout_redirect_uri=https://fit.my-url.tld/

This successfully clears the SSO session and allows logging in as a different user.

Final Notes

SparkyFitness is now running smoothly at https://fit.my-url.tld as part of our family's self-hosted ecosystem. The AI nutrition coach and meal planning features are exactly what we were looking for. Thanks again for building and sharing this amazing app!

If you'd like any additional details about our setup or have questions about the OIDC implementation, feel free to ask!

[CodeWithCJ]

Thanks. suggested changes are implemented

[ovizii]

Where did you find this variable, it's not mentioned in the docs anywhere: TRUST_PROXY=true

[ovizii]

Thanks. suggested changes are implemented

If this has been implemented, what "Logout Callback URL" do I set in my IDP?