fix: Add support for OIDC configuration thru Helm (#550)

Closes #548

Dockerfile.base

@@ -1,27 +1,22 @@
-FROM node:lts-alpine
+FROM node:18-alpine
 
-ARG ALPINE_VERSION=3.16
-ARG VIPS_VERSION=8.13.3
+ARG VIPS_VERSION=8.14.5
 
 RUN apk -U upgrade \
   && apk add \
-  bash giflib glib lcms2 libexif \
-  libgsf libjpeg-turbo libpng librsvg libwebp \
-  orc pango tiff \
-  --repository https://alpine.global.ssl.fastly.net/alpine/v${ALPINE_VERSION}/community/ \
-  --repository https://alpine.global.ssl.fastly.net/alpine/v${ALPINE_VERSION}/main/ \
+  bash pkgconf \
+  libjpeg-turbo libexif librsvg cgif tiff libspng libimagequant \
   --no-cache \
   && apk add \
-  build-base giflib-dev glib-dev lcms2-dev libexif-dev \
-  libgsf-dev libjpeg-turbo-dev libpng-dev librsvg-dev libwebp-dev \
-  orc-dev pango-dev tiff-dev \
+  build-base gobject-introspection-dev meson \
+  libjpeg-turbo-dev libexif-dev librsvg-dev cgif-dev tiff-dev libspng-dev libimagequant-dev \
   --virtual vips-dependencies \
-  --repository https://alpine.global.ssl.fastly.net/alpine/v${ALPINE_VERSION}/community/ \
-  --repository https://alpine.global.ssl.fastly.net/alpine/v${ALPINE_VERSION}/main/ \
   --no-cache \
-  && wget -O- https://github.com/libvips/libvips/releases/download/v${VIPS_VERSION}/vips-${VIPS_VERSION}.tar.gz | tar xzC /tmp \
+  && wget -O- https://github.com/libvips/libvips/releases/download/v${VIPS_VERSION}/vips-${VIPS_VERSION}.tar.xz | tar xJC /tmp \
   && cd /tmp/vips-${VIPS_VERSION} \
-  && ./configure \
-  && make \
-  && make install-strip \
+  && meson setup build-dir \
+  && cd build-dir \
+  && ninja \
+  && ninja test \
+  && ninja install \
   && rm -rf /tmp/vips-${VIPS_VERSION}

charts/planka/Chart.yaml

@@ -15,13 +15,13 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.9
+version: 0.1.11
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "1.14.3"
+appVersion: "1.15.0"
 
 dependencies:
   - alias: postgresql

charts/planka/templates/deployment.yaml

@@ -35,7 +35,7 @@ spec:
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           ports:
             - name: http
-              containerPort: {{ .Values.service.port }}
+              containerPort: {{ .Values.service.containerPort | default 1337 }}
               protocol: TCP
           livenessProbe:
             httpGet:
@@ -87,6 +87,33 @@ spec:
             - name: {{ $k | quote }}
               value: {{ $v | quote }}
           {{- end }}
+          {{- if .Values.oidc.enabled }}
+          {{- $secretName := default (printf "%s-oidc" (include "planka.fullname" .)) .Values.oidc.existingSecret }}
+            - name: OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  key:  clientId
+                  name: {{ $secretName }}
+            - name: OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  key:  clientSecret
+                  name: {{ $secretName }}
+            - name: OIDC_ISSUER
+              value: {{ required "issuerUrl is required when configuring OIDC" .Values.oidc.issuerUrl | quote }}
+            - name: OIDC_SCOPES
+              value: {{ join " " .Values.oidc.scopes | default "openid profile email" | quote }}
+          {{- if .Values.oidc.admin.roles }}
+            - name: OIDC_ADMIN_ROLES
+              value: {{ join "," .Values.oidc.admin.roles | quote }}
+          {{- end }}
+            - name: OIDC_ROLES_ATTRIBUTE
+              value: {{ .Values.oidc.admin.rolesAttribute | default "groups" | quote }}
+          {{- if .Values.oidc.admin.ignoreRoles }}
+            - name: OIDC_IGNORE_ROLES
+              value: {{ .Values.oidc.admin.ignoreRoles | quote }}
+          {{- end }}
+          {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

charts/planka/templates/secret-oidc.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.oidc.enabled }}
+{{- if eq (and (not (empty .Values.oidc.clientId)) (not (empty .Values.oidc.clientSecret))) (not (empty .Values.oidc.existingSecret)) -}}
+  {{- fail "Either specify inline `clientId` and `clientSecret` or refer to them via `existingSecret`" -}}
+{{- end }}
+{{- if (and (and (not (empty .Values.oidc.clientId)) (not (empty .Values.oidc.clientSecret))) (empty .Values.oidc.existingSecret)) -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "planka.fullname" . }}-oidc
+  labels:
+    {{- include "planka.labels" . | nindent 4 }}
+type: Opaque
+data:
+  clientId: {{ .Values.oidc.clientId | b64enc | quote }}
+  clientSecret: {{ .Values.oidc.clientSecret | b64enc | quote }}
+{{- end }}
+{{- end }}

charts/planka/values.yaml

@@ -46,6 +46,10 @@ securityContext: {}
 service:
   type: ClusterIP
   port: 1337
+  ## @param service.containerPort Planka HTTP container port
+  ## If empty will default to 1337
+  ##
+  containerPort: 1337
 
 ingress:
   enabled: false
@@ -109,3 +113,68 @@ persistence:
   
   accessMode: ReadWriteOnce
   size: 10Gi
+
+## OpenID Identity Management configuration
+##
+## Example:
+## ---------------
+## oidc:
+##   enabled: true
+##   clientId: sxxaAIAxVXlCxTmc1YLHBbQr8NL8MqLI2DUbt42d
+##   clientSecret: om4RTMRVHRszU7bqxB7RZNkHIzA8e4sGYWxeCwIMYQXPwEBWe4SY5a0wwCe9ltB3zrq5f0dnFnp34cEHD7QSMHsKvV9AiV5Z7eqDraMnv0I8IFivmuV5wovAECAYreSI
+##   issuerUrl: https://auth.local/application/o/planka/
+##   admin:
+##     roles:
+##       - planka-admin
+##
+## ---------------
+## NOTE: A minimal configuration requires setting `clientId`, `clientSecret` and `issuerUrl`. (plus `admin.roles` for administrators)
+## ref: https://docs.planka.cloud/docs/Configuration/OIDC
+##
+oidc:
+  ## @param oidc.enabled Enable single sign-on (SSO) with OpenID Connect (OIDC)
+  ##
+  enabled: false
+
+  ## OIDC credentials
+  ## @param oidc.clientId A string unique to the provider that identifies your app.
+  ## @param oidc.clientSecret A secret string that the provider uses to confirm ownership of a client ID.
+  ##
+  ## NOTE: Either specify inline `clientId` and `clientSecret` or refer to them via `existingSecret`
+  ##
+  clientId: ""
+  clientSecret: ""
+
+  ## @param oidc.existingSecret Name of an existing secret containing OIDC credentials
+  ## NOTE: Must contain key `clientId` and `clientSecret`
+  ## NOTE: When it's set, the `clientId` and `clientSecret` parameters are ignored
+  ##
+  existingSecret: ""
+
+  ## @param oidc.issuerUrl The OpenID connect metadata document endpoint
+  ##
+  issuerUrl: ""
+
+  ## @param oidc.scopes A list of scopes required for OIDC client.
+  ## If empty will default to `openid`, `profile` and `email`
+  ## NOTE: Planka needs the email and name claims
+  ##
+  scopes: []
+
+  ## Admin permissions configuration
+  admin:
+    ## @param oidc.admin.ignoreRoles If set to true, the admin roles will be ignored.
+    ## It is useful if you want to use OIDC for authentication but not for authorization.
+    ## If empty will default to `false`
+    ##
+    ignoreRoles: false
+
+    ## @param oidc.admin.rolesAttribute The name of a custom group claim that you have configured in your OIDC provider
+    ## If empty will default to `groups`
+    ##
+    rolesAttribute: groups
+
+    ## @param oidc.admin.roles The names of the admin groups
+    ##
+    roles: []
+      # - planka-admin

client/.env

@@ -1 +1 @@
-REACT_APP_VERSION=1.14.3
+REACT_APP_VERSION=1.15.0

client/package.json

@@ -55,60 +55,60 @@
   "dependencies": {
     "@juggle/resize-observer": "^3.4.0",
     "classnames": "^2.3.2",
-    "date-fns": "^2.29.3",
+    "date-fns": "^2.30.0",
     "dequal": "^2.0.3",
     "easymde": "^2.18.0",
     "history": "^5.3.0",
-    "i18next": "^22.0.6",
-    "i18next-browser-languagedetector": "^7.0.1",
+    "i18next": "^23.7.6",
+    "i18next-browser-languagedetector": "^7.2.0",
     "initials": "^3.1.2",
-    "js-cookie": "^3.0.1",
-    "jwt-decode": "^3.1.2",
+    "js-cookie": "^3.0.5",
+    "jwt-decode": "^4.0.0",
     "lodash": "^4.17.21",
-    "nanoid": "^5.0.2",
-    "node-sass": "^8.0.0",
-    "photoswipe": "^5.3.3",
+    "nanoid": "^5.0.3",
+    "node-sass": "^9.0.0",
+    "photoswipe": "^5.4.2",
     "prop-types": "^15.8.1",
     "react": "^18.2.0",
     "react-app-rewired": "^2.2.1",
     "react-beautiful-dnd": "^13.1.1",
-    "react-datepicker": "^4.8.0",
+    "react-datepicker": "^4.21.0",
     "react-dom": "^18.2.0",
     "react-dropzone": "^14.2.3",
-    "react-i18next": "^12.0.0",
+    "react-i18next": "^13.5.0",
     "react-input-mask": "^2.0.4",
-    "react-markdown": "^8.0.3",
-    "react-photoswipe-gallery": "^2.2.2",
-    "react-redux": "^8.0.5",
-    "react-router-dom": "^6.4.3",
+    "react-markdown": "^8.0.7",
+    "react-photoswipe-gallery": "^2.2.7",
+    "react-redux": "^8.1.3",
+    "react-router-dom": "^6.19.0",
     "react-scripts": "5.0.1",
     "react-simplemde-editor": "^5.2.0",
-    "react-textarea-autosize": "^8.4.0",
-    "redux": "^4.2.0",
+    "react-textarea-autosize": "^8.5.3",
+    "redux": "^4.2.1",
     "redux-logger": "^3.0.6",
     "redux-orm": "^0.16.2",
-    "redux-saga": "^1.2.1",
-    "remark-breaks": "^3.0.2",
-    "remark-gfm": "^3.0.1",
-    "reselect": "^4.1.7",
+    "redux-saga": "^1.2.3",
+    "remark-breaks": "^4.0.0",
+    "remark-gfm": "^4.0.0",
+    "reselect": "^4.1.8",
     "sails.io.js": "^1.2.1",
-    "semantic-ui-react": "^2.1.3",
+    "semantic-ui-react": "^2.1.4",
     "socket.io-client": "^2.5.0",
-    "validator": "^13.7.0",
-    "whatwg-fetch": "^3.6.2",
+    "validator": "^13.11.0",
+    "whatwg-fetch": "^3.6.19",
     "zxcvbn": "^4.4.2"
   },
   "devDependencies": {
-    "@testing-library/jest-dom": "^5.16.5",
-    "@testing-library/react": "^13.4.0",
-    "@testing-library/user-event": "^13.5.0",
+    "@testing-library/jest-dom": "^6.1.4",
+    "@testing-library/react": "^14.1.0",
+    "@testing-library/user-event": "^14.5.1",
     "babel-preset-airbnb": "^5.0.0",
-    "chai": "^4.3.7",
-    "eslint": "^8.28.0",
+    "chai": "^4.3.10",
+    "eslint": "^8.53.0",
     "eslint-config-airbnb": "^19.0.4",
-    "eslint-plugin-import": "^2.26.0",
-    "eslint-plugin-jsx-a11y": "^6.6.1",
-    "eslint-plugin-react": "^7.31.11",
+    "eslint-plugin-import": "^2.29.0",
+    "eslint-plugin-jsx-a11y": "^6.8.0",
+    "eslint-plugin-react": "^7.33.2",
     "eslint-plugin-react-hooks": "^4.6.0",
     "react-test-renderer": "^18.2.0"
   }

client/src/components/CardModal/CardModal.jsx

@@ -217,6 +217,7 @@ const CardModal = React.memo(
                         onUserSelect={onUserAdd}
                         onUserDeselect={onUserRemove}
                       >
+                        {/* eslint-disable-next-line jsx-a11y/control-has-associated-label */}
                         <button
                           type="button"
                           className={classNames(styles.attachment, styles.dueDate)}
@@ -266,6 +267,7 @@ const CardModal = React.memo(
                         onMove={onLabelMove}
                         onDelete={onLabelDelete}
                       >
+                        {/* eslint-disable-next-line jsx-a11y/control-has-associated-label */}
                         <button
                           type="button"
                           className={classNames(styles.attachment, styles.dueDate)}
@@ -314,10 +316,11 @@ const CardModal = React.memo(
                       )}
                     </span>
                     {canEdit && (
+                      // eslint-disable-next-line jsx-a11y/control-has-associated-label
                       <button
-                        onClick={handleToggleStopwatchClick}
                         type="button"
                         className={classNames(styles.attachment, styles.dueDate)}
+                        onClick={handleToggleStopwatchClick}
                       >
                         <Icon
                           name={stopwatch.startedAt ? 'pause' : 'play'}

client/src/locales/ja/core.js

@@ -8,7 +8,7 @@ export default {
     time: 'HH:mm',
     dateTime: '$t(format:date) $t(format:time)',
     longDate: 'MMMMd日',
-    longDateTime: "MMMMd'日 ' HH:MM",
+    longDateTime: "MMMMd'日 ' HH:mm",
   },
 
   translation: {

client/src/utils/access-token-storage.js

@@ -1,5 +1,5 @@
 import Cookies from 'js-cookie';
-import jwtDecode from 'jwt-decode';
+import { jwtDecode } from 'jwt-decode';
 
 import Config from '../constants/Config';
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "planka",
-  "version": "1.14.3",
+  "version": "1.15.0",
   "private": true,
   "homepage": "https://plankanban.github.io/planka",
   "repository": {
@@ -56,14 +56,14 @@
     }
   },
   "dependencies": {
-    "concurrently": "^7.6.0",
-    "husky": "^8.0.2",
-    "lint-staged": "^13.0.3"
+    "concurrently": "^8.2.2",
+    "husky": "^8.0.3",
+    "lint-staged": "^15.1.0"
   },
   "devDependencies": {
-    "eslint": "^8.28.0",
-    "eslint-config-prettier": "^8.5.0",
-    "eslint-plugin-prettier": "^4.2.1",
-    "prettier": "^2.7.1"
+    "eslint": "^8.53.0",
+    "eslint-config-prettier": "^9.0.0",
+    "eslint-plugin-prettier": "^5.0.1",
+    "prettier": "^3.1.0"
   }
 }

server/package.json

@@ -27,38 +27,38 @@
     }
   },
   "dependencies": {
-    "bcrypt": "^5.1.0",
-    "dotenv": "^16.0.3",
-    "dotenv-cli": "^6.0.0",
+    "bcrypt": "^5.1.1",
+    "dotenv": "^16.3.1",
+    "dotenv-cli": "^7.3.0",
     "filenamify": "^4.3.0",
-    "jsonwebtoken": "^9.0.0",
-    "knex": "^2.3.0",
+    "jsonwebtoken": "^9.0.2",
+    "knex": "^3.0.1",
     "lodash": "^4.17.21",
     "moment": "^2.29.4",
     "move-file": "^2.1.0",
-    "openid-client": "^5.4.3",
-    "rimraf": "^3.0.2",
+    "openid-client": "^5.6.1",
+    "rimraf": "^5.0.5",
     "sails": "^1.5.7",
     "sails-hook-orm": "^4.0.2",
-    "sails-hook-sockets": "^2.0.3",
+    "sails-hook-sockets": "^2.0.4",
     "sails-postgresql-redacted": "^1.0.2-9",
-    "sharp": "^0.31.2",
+    "sharp": "^0.32.6",
     "stream-to-array": "^2.3.0",
-    "uuid": "^9.0.0",
-    "validator": "^13.7.0",
-    "winston": "^3.8.2",
+    "uuid": "^9.0.1",
+    "validator": "^13.11.0",
+    "winston": "^3.11.0",
     "zxcvbn": "^4.4.2"
   },
   "devDependencies": {
-    "chai": "^4.3.7",
-    "eslint": "^8.28.0",
+    "chai": "^4.3.10",
+    "eslint": "^8.53.0",
     "eslint-config-airbnb-base": "^15.0.0",
-    "eslint-plugin-import": "^2.26.0",
-    "mocha": "^10.1.0",
-    "nodemon": "^2.0.20",
-    "supertest": "^6.3.1"
+    "eslint-plugin-import": "^2.29.0",
+    "mocha": "^10.2.0",
+    "nodemon": "^3.0.1",
+    "supertest": "^6.3.3"
   },
   "engines": {
-    "node": "^12.10"
+    "node": ">=18"
   }
 }