Mirrors/mealie
1
0
Fork 0
mirror of https://github.com/mealie-recipes/mealie.git synced 2026-04-22 21:05:35 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix: Allow user-configurable OIDC timeout (#7496)

Browse Source
This commit is contained in:
Xavier L.
2026-04-20 23:22:36 -04:00
committed by GitHub
parent 83bc2f3889
commit c9a0cac055
3 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
docs/docs/documentation/getting-started/installation/backend-config.md
View File

@@ -114,6 +114,7 @@ For usage, see [Usage - OpenID Connect](../authentication/oidc-v2.md)
| OIDC_GROUPS_CLAIM | groups | Optional if not using `OIDC_USER_GROUP` or `OIDC_ADMIN_GROUP`. This is the claim Mealie will request from your IdP and will use to compare to `OIDC_USER_GROUP` or `OIDC_ADMIN_GROUP` to allow the user to log in to Mealie or is set as an admin. **Your IdP must be configured to grant this claim** | | OIDC_GROUPS_CLAIM | groups | Optional if not using `OIDC_USER_GROUP` or `OIDC_ADMIN_GROUP`. This is the claim Mealie will request from your IdP and will use to compare to `OIDC_USER_GROUP` or `OIDC_ADMIN_GROUP` to allow the user to log in to Mealie or is set as an admin. **Your IdP must be configured to grant this claim** |
| OIDC_SCOPES_OVERRIDE | None | Advanced configuration used to override the scopes requested from the IdP. **Most users won't need to change this**. At a minimum, 'openid profile email' are required. | | OIDC_SCOPES_OVERRIDE | None | Advanced configuration used to override the scopes requested from the IdP. **Most users won't need to change this**. At a minimum, 'openid profile email' are required. |
| OIDC_TLS_CACERTFILE | None | File path to Certificate Authority used to verify server certificate (e.g. `/path/to/ca.crt`) | | OIDC_TLS_CACERTFILE | None | File path to Certificate Authority used to verify server certificate (e.g. `/path/to/ca.crt`) |
| OIDC_CLIENT_TIMEOUT | default | Configures the timeout value of the httpx client used for OIDC communications. If set to the string `default`, does not configure the value (uses the library's default of 5.0s). If set to the string `None`, disables the timeout entirely. If set to a numeric value, uses that as the timeout. |
### OpenAI ### OpenAI

3
mealie/core/settings/settings.py
View File

@@ -3,7 +3,7 @@ import os
import secrets import secrets
from datetime import UTC, datetime from datetime import UTC, datetime
from pathlib import Path from pathlib import Path
from typing import Annotated, Any, NamedTuple from typing import Annotated, Any, Literal, NamedTuple
from dateutil.tz import tzlocal from dateutil.tz import tzlocal
from pydantic import PlainSerializer, field_validator from pydantic import PlainSerializer, field_validator
@@ -349,6 +349,7 @@ class AppSettings(AppLoggingSettings):
OIDC_GROUPS_CLAIM: str | None = "groups" OIDC_GROUPS_CLAIM: str | None = "groups"
OIDC_SCOPES_OVERRIDE: str | None = None OIDC_SCOPES_OVERRIDE: str | None = None
OIDC_TLS_CACERTFILE: str | None = None OIDC_TLS_CACERTFILE: str | None = None
OIDC_CLIENT_TIMEOUT: float | Literal["None", "default"] = "default"
@property @property
def OIDC_REQUIRES_GROUP_CLAIM(self) -> bool: def OIDC_REQUIRES_GROUP_CLAIM(self) -> bool:

6
mealie/routes/auth/auth.py
View File

@@ -1,4 +1,4 @@
from typing import Annotated from typing import Annotated, Any
from authlib.integrations.starlette_client import OAuth from authlib.integrations.starlette_client import OAuth
from fastapi import APIRouter, Depends, Header, Request, Response, status from fastapi import APIRouter, Depends, Header, Request, Response, status
@@ -36,7 +36,9 @@ if settings.OIDC_READY:
else: else:
groups_claim = settings.OIDC_GROUPS_CLAIM if settings.OIDC_REQUIRES_GROUP_CLAIM else "" groups_claim = settings.OIDC_GROUPS_CLAIM if settings.OIDC_REQUIRES_GROUP_CLAIM else ""
scope = f"openid email profile {groups_claim}" scope = f"openid email profile {groups_claim}"
client_args = {"scope": scope.rstrip()} client_args: dict[str, Any] = {"scope": scope.rstrip()}
if settings.OIDC_CLIENT_TIMEOUT != "default":
client_args["timeout"] = settings.OIDC_CLIENT_TIMEOUT if settings.OIDC_CLIENT_TIMEOUT != "None" else None
if settings.OIDC_TLS_CACERTFILE: if settings.OIDC_TLS_CACERTFILE:
client_args["verify"] = settings.OIDC_TLS_CACERTFILE client_args["verify"] = settings.OIDC_TLS_CACERTFILE