refactor(frontend): restrict insecure HTTP issuer to dev / explicit opt-in

frontend/.env.example

@@ -16,5 +16,8 @@ SESSION_SECRET=change-me-to-a-long-random-string
 # SESSION_REFRESH_THRESHOLD_SECONDS=30
 # AUTH_FLOW_TTL_SECONDS=600
 
+# Dev already allows a plain-HTTP issuer. Set this only to allow it in a production build (never with a public issuer).
+# AUTH_ALLOW_INSECURE_HTTP=true
+
 # Backend API base URL (used from later parts)
 API_BASE_URL=http://localhost:5111

frontend/src/lib/server/auth.ts

@@ -1,5 +1,6 @@
 import * as client from 'openid-client';
 import { EncryptJWT, jwtDecrypt } from 'jose';
+import { dev } from '$app/environment';
 import { authConfig } from '$lib/server/config';
 import type { SessionUser } from '$lib/types';
 
@@ -16,13 +17,12 @@ export interface Session extends SessionUser {
 	expiresAt: number;
 }
 
-let configPromise: Promise<client.Configuration> | null = null;
+let configPromise: Promise<client.Configuration>;
-
 export function getOidcConfig(): Promise<client.Configuration> {
 	configPromise ??= (async () => {
 		const issuer = new URL(authConfig.issuer);
-		const options =
+		const insecureAllowed = (dev || authConfig.allowInsecureHttp) && issuer.protocol === 'http:';
-			issuer.protocol === 'http:' ? { execute: [client.allowInsecureRequests] } : undefined;
+		const options = insecureAllowed ? { execute: [client.allowInsecureRequests] } : undefined;
 
 		const secret = authConfig.clientSecret;
 		return secret
@@ -32,8 +32,7 @@ export function getOidcConfig(): Promise<client.Configuration> {
 	return configPromise;
 }
 
-let keyPromise: Promise<Uint8Array> | null = null;
+let keyPromise: Promise<Uint8Array>;
-
 function sessionKey(): Promise<Uint8Array> {
 	keyPromise ??= crypto.subtle
 		.digest('SHA-256', new TextEncoder().encode(authConfig.sessionSecret))

frontend/src/lib/server/config.ts

@@ -40,5 +40,8 @@ export const authConfig = {
 	},
 	get flowTtlSeconds() {
 		return positiveInt(env.AUTH_FLOW_TTL_SECONDS, 600);
+	},
+	get allowInsecureHttp() {
+		return env.AUTH_ALLOW_INSECURE_HTTP === 'true';
 	}
 };