fix(auth): OIDC issuer typos

common.yml

@@ -27,7 +27,7 @@ services:
       # Should just be an external script someone can run on their instance?
       arangodb__ensureDefaults: 'true'
       DOMAIN: ${DOMAIN:-localhost}
-      AUTH_ISSUER: ${AUTH_ISSUER}
+      OIDC_ISSUER: ~
       NODE_TLS_REJECT_UNAUTHORIZED: ~
       PINO_TRANSPORT: ~
       PROFILE_AQL: ~

oada/services/http-handler/src/server.ts

@@ -309,8 +309,9 @@ async function discoverConfiguration(issuer: string | URL) {
       return metadata;
     }
   } catch (error: unknown) {
-    fastify.log.error({ issuer }, 'Failed OIDC discovery for issuer');
-    throw error;
+    throw new Error(`Failed OIDC discovery for issuer '${issuer}'`, {
+      cause: error,
+    });
   }
 }
 

oada/services/well-known/src/index.ts

@@ -51,9 +51,10 @@ export async function discoverConfiguration(issuer: string | URL) {
       const { metadata } = await Issuer.discover(`https://${issuer}`);
       return metadata;
     }
-  } catch {
-    fastify.log.error({ issuer }, 'Failed OIDC discovery for issuer');
-    return {};
+  } catch (error: unknown) {
+    throw new Error(`Failed OIDC discovery for issuer '${issuer}'`, {
+      cause: error,
+    });
   }
 }
 

release/.env

@@ -4,4 +4,4 @@ DEBUG=*
 PINO_LEVEL=info
 PINO_TRANSPORT=
 NODE_TLS_REJECT_UNAUTHORIZED=
-AUTH_ISSUER=${DOMAIN}
+OIDC_ISSUER=${DOMAIN}

release/docker-compose.override.yml

@@ -28,6 +28,7 @@ x-release:
     DEBUG_SHOW_HIDDEN: ~
     PINO_TRANSPORT: ~
     DOMAIN: ~
+    OIDC_ISSUER: ${OIDC_ISSUER-http://auth/oadaauth}
     NODE_TLS_REJECT_UNAUTHORIZED: ~
     # Allow changing arangodb URL (e.g., to use external arango)
     ARANGODB_URL: ${ARANGODB_URL-http://arangodb:8529}