From 66ed4fe0552018b6129932f87f8c7b1e06bd9ed6 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 5 Aug 2025 00:00:32 +0200
Subject: [PATCH] fix oauth2-proxy

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Signed-off-by: kklinch0 <kklinch0@gmail.com>
---
 packages/system/dashboard-config/rbac.yaml    | 25 +++++++++++++
 .../openapi-ui/patches/oauth2_proxy.diff      | 35 +++++++++++++++++++
 .../templates/incloud-web-gatekeeper.yaml     |  1 +
 .../dashboard/templates/incloud-web-web.yaml  |  2 +-
 .../dashboard/templates/keycloakclient.yaml   |  1 -
 packages/system/dashboard/values.yaml         |  2 +-
 6 files changed, 63 insertions(+), 3 deletions(-)
 create mode 100644 packages/system/dashboard-config/rbac.yaml
 create mode 100644 packages/system/dashboard/images/openapi-ui/patches/oauth2_proxy.diff

diff --git a/packages/system/dashboard-config/rbac.yaml b/packages/system/dashboard-config/rbac.yaml
new file mode 100644
index 00000000..ede1548e
--- /dev/null
+++ b/packages/system/dashboard-config/rbac.yaml
@@ -0,0 +1,25 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: front-readonly
+rules:
+- apiGroups:
+  - front.in-cloud.io
+  resources: ['*']
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: front-readonly-authenticated
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: front-readonly
+subjects:
+- kind: Group
+  name: system:authenticated
+  apiGroup: rbac.authorization.k8s.io
diff --git a/packages/system/dashboard/images/openapi-ui/patches/oauth2_proxy.diff b/packages/system/dashboard/images/openapi-ui/patches/oauth2_proxy.diff
new file mode 100644
index 00000000..e3d2fb75
--- /dev/null
+++ b/packages/system/dashboard/images/openapi-ui/patches/oauth2_proxy.diff
@@ -0,0 +1,35 @@
+diff --git a/src/api/auth.ts b/src/api/auth.ts
+index 6ee752d..14f07cf 100644
+--- a/src/api/auth.ts
++++ b/src/api/auth.ts
+@@ -6,7 +6,7 @@ export const login = async (): Promise<TAuthResponse | undefined> => {
+   let response: AxiosResponse<TAuthResponse> | undefined
+ 
+   try {
+-    response = await axios.get<TAuthResponse>('/oauth/token', { withCredentials: true })
++    response = await axios.get<TAuthResponse>('/oauth2/userinfo', { withCredentials: true })
+   } catch (error) {
+     handleError(error)
+   }
+@@ -18,7 +18,7 @@ export const logout = async (): Promise<TAuthResponse | undefined> => {
+   let response: AxiosResponse<TAuthResponse> | undefined
+ 
+   try {
+-    response = await axios.get<TAuthResponse>('/oauth/logout', { withCredentials: true })
++    response = await axios.get<TAuthResponse>('/oauth2/sign_out', { withCredentials: true })
+   } catch (error) {
+     handleError(error)
+   } finally {
+diff --git a/src/api/handleResponse.ts b/src/api/handleResponse.ts
+index e538965..c420908 100644
+--- a/src/api/handleResponse.ts
++++ b/src/api/handleResponse.ts
+@@ -5,7 +5,7 @@ export const handleError = (error: any) => {
+   if (isAxiosError(error)) {
+     if (error.status === 401) {
+       try {
+-        axios.get('/oauth/logout', {
++        axios.get('/oauth2/sign_out', {
+           method: 'GET',
+           withCredentials: true,
+         })
diff --git a/packages/system/dashboard/templates/incloud-web-gatekeeper.yaml b/packages/system/dashboard/templates/incloud-web-gatekeeper.yaml
index 7b30e02e..9f4fb5d0 100644
--- a/packages/system/dashboard/templates/incloud-web-gatekeeper.yaml
+++ b/packages/system/dashboard/templates/incloud-web-gatekeeper.yaml
@@ -61,6 +61,7 @@ spec:
             - --pass-access-token=true
             - --pass-authorization-header=true
             - --cookie-refresh=1h
+            - --cookie-name=kc-access
             - --cookie-secure=true
             - --cookie-secret=$(OAUTH2_PROXY_COOKIE_SECRET)
           env:
diff --git a/packages/system/dashboard/templates/incloud-web-web.yaml b/packages/system/dashboard/templates/incloud-web-web.yaml
index 945fbaf4..38e095c0 100644
--- a/packages/system/dashboard/templates/incloud-web-web.yaml
+++ b/packages/system/dashboard/templates/incloud-web-web.yaml
@@ -123,7 +123,7 @@ spec:
             - name: MARKETPLACE_VERSION
               value: v1alpha1
             - name: NAVIGATE_FROM_CLUSTERLIST
-              value: /openapi-ui/~recordValue~/api-table/apps.cozystack.io/v1alpha1/tenantnamespaces
+              value: /openapi-ui/~recordValue~/api-table/core.cozystack.io/v1alpha1/tenantnamespaces
             - name: PROJECTS_API_GROUP
               value: in-cloud.io
             - name: PROJECTS_RESOURCE_NAME
diff --git a/packages/system/dashboard/templates/keycloakclient.yaml b/packages/system/dashboard/templates/keycloakclient.yaml
index 25f47330..3ff5c609 100644
--- a/packages/system/dashboard/templates/keycloakclient.yaml
+++ b/packages/system/dashboard/templates/keycloakclient.yaml
@@ -70,7 +70,6 @@ spec:
     - groups
     - kubernetes-client
   redirectUris:
-    - "https://dashboard.{{ $host }}/oauth/callback/*"
     - "https://dashboard.{{ $host }}/oauth2/callback/*"
     {{- range $i, $v := $extraRedirectUris }}
     - "{{ $v }}"
diff --git a/packages/system/dashboard/values.yaml b/packages/system/dashboard/values.yaml
index 30683335..96949a2c 100644
--- a/packages/system/dashboard/values.yaml
+++ b/packages/system/dashboard/values.yaml
@@ -1,4 +1,4 @@
 openapiUI:
-  image: "ghcr.io/cozystack/cozystack/openapi-ui:latest@sha256:cd1b51e2a6fbccb14b158f00c5237b15272ef3d46db148152c546be1d6f0cdf0"
+  image: "ghcr.io/cozystack/cozystack/openapi-ui:latest@sha256:33628338ef5183f8f75657c305dcd5df2103b944fe6a421f8cbd037f3fc3e8b7"
 openapiUIK8sBff:
   image: "ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:latest@sha256:e5178151aa8f4d168d9aee5581e896cb6086f254816280e1e979b970c0bf658c"