fix(authn): route Authentik native paths under app host — restore OIDC (prod outage) - #256
Merged
Conversation
…C (prod outage) #247's reverse-proxy stripped /api/auth/idp and relied on X-Forwarded-Prefix, but Authentik IGNORES it — so discovery advertised app.fuzefront.com/application/o/authorize/ (no prefix), an unrouted path → the browser authorize redirect 404'd → prod login broke. Fix: route Authentik's native root paths (/application,/if,/source,/flows,/ws,/-, /outpost.goauthentik.io,/static/dist,/static/authentik) straight to authentik-server under app.fuzefront.com (no strip); issuer -> https://app.fuzefront.com/application/o/fuzefront/. Boundary intact: browser stays on app.fuzefront.com, never sees the IdP host. Chart-only — deploys via Argo, no image build. helm template renders clean. Co-Authored-By: Claude claude-opus-4-8 <noreply@anthropic.com> Claude-Session-Id: cf830721-b1ef-4fe0-a024-035ad280dcf7
izzywdev
added a commit
that referenced
this pull request
Jul 15, 2026
* fix(authn): route Authentik native paths under app host — restore OIDC (prod outage) #247's reverse-proxy stripped /api/auth/idp and relied on X-Forwarded-Prefix, but Authentik IGNORES it — so discovery advertised app.fuzefront.com/application/o/authorize/ (no prefix), an unrouted path → the browser authorize redirect 404'd → prod login broke. Fix: route Authentik's native root paths (/application,/if,/source,/flows,/ws,/-, /outpost.goauthentik.io,/static/dist,/static/authentik) straight to authentik-server under app.fuzefront.com (no strip); issuer -> https://app.fuzefront.com/application/o/fuzefront/. Boundary intact: browser stays on app.fuzefront.com, never sees the IdP host. Chart-only — deploys via Argo, no image build. helm template renders clean. Co-Authored-By: Claude claude-opus-4-8 <noreply@anthropic.com> Claude-Session-Id: cf830721-b1ef-4fe0-a024-035ad280dcf7 * ci(release): add workflow_dispatch — enable manual image builds Auto-merged PRs push to master under GITHUB_TOKEN, which GitHub does not let trigger push-workflows — so release.yml never ran after #247/#253/#256 and the security-service/frontend images never built. workflow_dispatch gives a reliable manual build+GitOps-bump path (durable fix: switch auto-merge to a PAT — needs a RELEASE_PAT secret, tracked separately). Co-Authored-By: Claude claude-opus-4-8 <noreply@anthropic.com> Claude-Session-Id: cf830721-b1ef-4fe0-a024-035ad280dcf7 --------- Co-authored-by: fuzeone-bot[bot] <fuzeone-bot[bot]@users.noreply.github.com> Co-authored-by: Claude claude-opus-4-8 <noreply@anthropic.com>
izzywdev
pushed a commit
that referenced
this pull request
Jul 15, 2026
…, empty IdP prefix (Gap C) - AUTHENTIK_ADMIN_TOKEN (from sealed bootstrap token) for M2M provisioning - AUTHENTIK_ENROLLMENT_FLOW_SLUG pinned (server-brokered signup) - SECURITY_IDP_PROXY_PREFIX='' pinned (native-path routing per #256) Co-Authored-By: Claude claude-opus-4-8 <noreply@anthropic.com> Claude-Session-Id: cf830721-b1ef-4fe0-a024-035ad280dcf7
izzywdev
added a commit
that referenced
this pull request
Jul 15, 2026
* wip: start authn backend reconcile [skip ci] Co-Authored-By: Claude claude-opus-4-8 <noreply@anthropic.com> Claude-Session-Id: cf830721-b1ef-4fe0-a024-035ad280dcf7 * feat(authn): reconcile signup->Authentik enrollment + brokerCodes (salvaged WIP) Salvaged from the killed Phase-1 agent (npm install hung before it could push): - signup() rewritten to server-brokered Authentik enrollment (Gap A) - brokerCodes.ts persistent broker-code store; social exchange via takeBrokerCode (Gap B) - config.ts / routes social-callback reconcile; signup tests. WIP — Gap C (helm env) + build/test verification still pending. Co-Authored-By: Claude claude-opus-4-8 <noreply@anthropic.com> Claude-Session-Id: cf830721-b1ef-4fe0-a024-035ad280dcf7 * feat(authn): wire security-service env — admin token, enrollment slug, empty IdP prefix (Gap C) - AUTHENTIK_ADMIN_TOKEN (from sealed bootstrap token) for M2M provisioning - AUTHENTIK_ENROLLMENT_FLOW_SLUG pinned (server-brokered signup) - SECURITY_IDP_PROXY_PREFIX='' pinned (native-path routing per #256) Co-Authored-By: Claude claude-opus-4-8 <noreply@anthropic.com> Claude-Session-Id: cf830721-b1ef-4fe0-a024-035ad280dcf7 --------- Co-authored-by: fuzeone-bot[bot] <fuzeone-bot[bot]@users.noreply.github.com> Co-authored-by: Claude claude-opus-4-8 <noreply@anthropic.com>
izzywdev
added a commit
that referenced
this pull request
Jul 15, 2026
…-server (#261) The security-service (and the login-page SPA) call Authentik's flow-executor at /api/v3/flows/executor/... to drive password + enrollment. #256 routed Authentik's browser paths but missed /api/v3, so those calls hit FuzeFront's /api and failed -> AuthentikUnavailableError -> PROVIDER_UNAVAILABLE (signup + login 401). Route /api/v3 to authentik-server. Chart-only; no collision with /api/v1/*. Claude-Session-Id: cf830721-b1ef-4fe0-a024-035ad280dcf7 Co-authored-by: fuzeone-bot[bot] <fuzeone-bot[bot]@users.noreply.github.com> Co-authored-by: Claude claude-opus-4-8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prod incident fix (chart-only, deploys via Argo)
Root cause: #247's reverse-proxy stripped
/api/auth/idpand relied onX-Forwarded-Prefix, but Authentik ignores it. Live-probe proof: OIDC discovery advertisedauthorization_endpoint: https://app.fuzefront.com/application/o/authorize/— right host (noauth.fuzefront.comleak, boundary intact) but no/api/auth/idpprefix, so the path 404'd → browser authorize redirect failed → prod login broke.Fix: route Authentik's native root paths (
/application,/if,/source,/flows,/ws,/-,/outpost.goauthentik.io,/static/dist,/static/authentik) straight toauthentik-serverunderapp.fuzefront.com(no strip); issuer →https://app.fuzefront.com/application/o/fuzefront/.helm templaterenders clean; no collision with app/api,/apps,/socket.io,/routes.Verify post-merge (Argo auto-syncs):
curl -s https://app.fuzefront.com/application/o/fuzefront/.well-known/openid-configuration→authorization_endpointshould be a routablehttps://app.fuzefront.com/application/o/authorize/.Follow-up (not this PR): Google Cloud Console must have
https://app.fuzefront.com/source/oauth/callback/google/as an authorized redirect URI for Google social login;release.ymlstill isn't building images (blocks deploying the new #253 backend / #250 frontend).🤖 Generated with Claude Code