3af105bccd
Replaces the client-side PIN login with real authentication against Azure Entra ID via PocketBase's built-in OAuth2 (OIDC) flow. Every Azure user is auto-provisioned as a team_member on first login. - pb_migrations: team_members becomes a PocketBase auth collection (OIDC provider configured from env); all collections require @request.auth.id - pb_hooks: provisioning of role (ENTRA_ADMIN_EMAILS allow-list) and enrollment_status, with admin-role re-sync on every login - frontend: "Sign in with Microsoft" login, pb.authStore-based session, TeamManager manages roster/roles (no PIN/manual create) - infra: Entra env wiring + pb_hooks mount for dev (Labs) and prod - src/lib/azureAuth.js + tests for the canonical role/allow-list logic - docs/auth-spec.md Knowledge base, generated tests and micro-learnings are left untouched. Existing PIN users are dropped (no migration required, per sign-off). Closes #16 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
39 lines
1.2 KiB
YAML
39 lines
1.2 KiB
YAML
version: "3"
|
|
|
|
networks:
|
|
learning-platform:
|
|
external: true
|
|
|
|
volumes:
|
|
pb_data:
|
|
|
|
services:
|
|
learning-platform:
|
|
image: git.labs.respellion.tech/respellion/learning-platform/learning-platform:latest
|
|
container_name: learning-platform
|
|
restart: unless-stopped
|
|
environment:
|
|
- ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
|
|
networks:
|
|
- learning-platform
|
|
|
|
pocketbase-learning:
|
|
image: ghcr.io/muchobien/pocketbase:latest
|
|
container_name: pocketbase-learning
|
|
restart: unless-stopped
|
|
working_dir: /pb
|
|
command: ["serve", "--http=0.0.0.0:8090", "--dir=/pb/pb_data", "--migrationsDir=/pb/pb_migrations", "--hooksDir=/pb/pb_hooks"]
|
|
environment:
|
|
# Azure Entra ID (OIDC) — consumed by pb_migrations/1781000000 and
|
|
# pb_hooks/team_members.pb.js. Rendered into .env by the deploy playbook.
|
|
- ENTRA_TENANT_ID=${ENTRA_TENANT_ID}
|
|
- ENTRA_CLIENT_ID=${ENTRA_CLIENT_ID}
|
|
- ENTRA_CLIENT_SECRET=${ENTRA_CLIENT_SECRET}
|
|
- ENTRA_ADMIN_EMAILS=${ENTRA_ADMIN_EMAILS}
|
|
volumes:
|
|
- pb_data:/pb/pb_data
|
|
- ./pb_migrations:/pb/pb_migrations
|
|
- ./pb_hooks:/pb/pb_hooks
|
|
networks:
|
|
- learning-platform
|