Skip to content

docs(plans): move step 8 (issuer) to the BFF/OWASP plan #19

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
crazyracer98 merged 1 commit into from
Oct 30, 2026
Merged

docs(plans): move step 8 (issuer) to the BFF/OWASP plan #19

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 16 additions & 18 deletions docs/plans/2026-09-adopt-template-base-v1.2.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,13 @@ In progress — steps 2–6 done on `chore/adopt-template-base-v1.2`
(local v1.0.0 → v1.2.3 apply, checks and an arm64 `make build sbom
release-assets` + image smoke test pass). Remaining: devcontainer
rebuild, the post-merge repo settings and sync bootstrap (step 7), then
the upstream fixes (step 1) and the sign-in check (step 8).
the upstream fixes (step 1).

Update 2026-10-30: the sign-in/issuer check (former step 8) moved to
the template-base plan
[`2026-10-bff-wellknown-analytics-owasp.md`](https://github.com/craftainer/template-base/blob/main/docs/plans/2026-10-bff-wellknown-analytics-owasp.md),
item BK1 (that file lives in the template-base workspace until it is
committed there).

## Goal

Expand Down Expand Up @@ -54,8 +60,8 @@ on template sync. `template-fastapi` went through the same steps in

## Approach

In-repo steps 2–7 come first; step 1's upstream fixes and step 8 follow
once this repo is on v1.2.3.
In-repo steps 2–7 come first; step 1's upstream fixes follow once this
repo is on v1.2.3.

### 1. Upstream fixes (after this repo's own migration)

Expand All @@ -79,7 +85,8 @@ In `template-base`:
step 5.

Nothing in `template-fastapi` has to change for the base migration
itself. See step 8 for one auth issue that needs verifying there.
itself. The one auth issue found during review (token issuer) moved to
the template-base plan (see Status).

### 2. Move customizations into the hooks (this repo, before syncing)

Expand Down Expand Up @@ -203,23 +210,14 @@ After merging:
`template_repo=craftainer/template-base`. That opens the bootstrap
PR, and later syncs are incremental.

### 8. Frontend sign-in against template-fastapi (verify, likely a fastapi fix)

Unrelated to the base migration, but found during this review and not
yet verified end-to-end. The browser gets tokens through the forwarded
`localhost:8080`, so their `iss` is
`http://localhost:8080/realms/template-fastapi`. The backend validates
`issuer=OIDC_ISSUER_URL=http://keycloak:8080/...` (`src/app/oidc.py`),
and Keycloak sets no `KC_HOSTNAME`. So every API call from this app
probably gets a 401. If sign-in → `/api/...` confirms it, fix it in
template-fastapi: pin Keycloak's frontend hostname
(`KC_HOSTNAME=http://localhost:8080` + `KC_HOSTNAME_BACKCHANNEL_DYNAMIC=true`)
and have `oidc.py` take the expected issuer separately from the
in-network discovery URL.

## Decisions

- Release arches: `amd64` and `arm64`, both native runners.
- GHCR auth: a PAT in `OCI_REGISTRY_PASSWORD`; no upstream change to
`release.yml` needed.
- `src/` is `ignore` tier for downstream instances (step 4).
- 2026-10-30: step 8 (frontend sign-in against template-fastapi, the
`iss`/`KC_HOSTNAME` issue) moved to the template-base plan
[`2026-10-bff-wellknown-analytics-owasp.md`](https://github.com/craftainer/template-base/blob/main/docs/plans/2026-10-bff-wellknown-analytics-owasp.md),
item BK1 (user decision of 2026-10-29). That file lives in the
template-base workspace until committed.