(WIP) authssobackend: support subroots

Author: joonas-fi

go.mod

@@ -14,7 +14,7 @@ require (
 	github.com/function61/certbus v0.0.0-20260822115830-9d8c749d7a41
 	github.com/function61/eventhorizon v0.2.1-0.20260822112641-bdf8d2936b7f
 	github.com/function61/gokit v0.0.0-20260822195148-784934b22880
-	github.com/function61/id v0.0.0-20260818190447-5b4cdbaa3020
+	github.com/function61/id v0.0.0-20260824122525-b9d5a88d2b97
 	github.com/peterbourgon/diskv v2.0.1+incompatible
 	github.com/prometheus/client_golang v1.24.1
 	github.com/scylladb/termtables v1.0.0

go.sum

@@ -66,6 +66,10 @@ github.com/function61/gokit v0.0.0-20260822195148-784934b22880 h1:grjWMxamUkVZtZ
 github.com/function61/gokit v0.0.0-20260822195148-784934b22880/go.mod h1:ewGYmDoaszHKjwN9S2AM30oQwe4mhvuRUA4uvzzkmRw=
 github.com/function61/id v0.0.0-20260818190447-5b4cdbaa3020 h1:oZSeyh0lCNx99cvXDIqbE2GzPLb37rX2Mnsn9ubgBVU=
 github.com/function61/id v0.0.0-20260818190447-5b4cdbaa3020/go.mod h1:6U3gEM2iYBUvTftYOxtggLsbxZGiF4zfRzT9Zls5VWg=
+github.com/function61/id v0.0.0-20260824112419-7d0822757eac h1:0vVsBv3cTzI2fwt1akR0uQ2zKnWzE6l/rzuQLZeBXkw=
+github.com/function61/id v0.0.0-20260824112419-7d0822757eac/go.mod h1:6U3gEM2iYBUvTftYOxtggLsbxZGiF4zfRzT9Zls5VWg=
+github.com/function61/id v0.0.0-20260824122525-b9d5a88d2b97 h1:rqbuwL1fwWD7z72srDizU2EE9PHrx0n599nEwmvaz7g=
+github.com/function61/id v0.0.0-20260824122525-b9d5a88d2b97/go.mod h1:6U3gEM2iYBUvTftYOxtggLsbxZGiF4zfRzT9Zls5VWg=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=

pkg/erbackend/authssobackend/sso.go

@@ -26,13 +26,21 @@ func New(
 		return nil, errors.New("empty audience")
 	}
 
-	authGateway := idpClient.CreateAuthGateway(router, opts.Audience)
+	if opts.Audience == "t-1/loppi.org-assets" && opts.Subroot == "" { // FIXME: temporary hack. identifying app "loppi.org-assets"
+		opts.Subroot = "/assets"
+	}
+
+	authGateway := idpClient.CreateAuthGateway(router, opts.Audience, opts.Subroot)
 
 	backendAuthorizer := authGateway.Protect(
 		idclient.UserListAuthorizer(opts.AllowedUserIds...),
 		authorizedBackend)
 
 	// catch-all route; ServeMux selects the more specific auth gateway endpoints first.
+	// we now have something like this:
+	// - /_auth/redirect => take auth token from SSH, put it to cookie and redirect to "next" (where we tried to go before requiring login)
+	// - /_auth/logout => delete auth cookie and go to logged out page
+	// - (catch-all) => if user logged in passthrough to authorized handler. if not redirect to SSO otherwise
 	router.Handle("/", backendAuthorizer)
 
 	return router, nil

pkg/erconfig/appconfig.go

@@ -169,6 +169,7 @@ type BackendOptsAuthSso struct {
 	IDServerURL       string   `json:"id_server_url,omitempty"`
 	AllowedUserIds    []string `json:"allowed_user_ids"`
 	Audience          string   `json:"audience"`
+	Subroot           string   `json:"subroot,omitempty"`  // (optional) if app mounted under e.g. `/myapp`, scopes the auth cookie and auth gateway under the subroot
 	AuthorizedBackend *Backend `json:"authorized_backend"` // ptr for validation
 }