Ability to add the redirection URI within a config instead of manually in admin mode

[louistransfer]

Hello everyone,

I am currently testing fief which is pretty awesome !

I just have a question about the admin mode : when raising the fief server in local, I always have to go to the admin platform to put the redirection uri.
It works well for a single-user workflow, but I would like to use the platform with someone else, and the process is quite painful for multi-users.
Do you know how to automatically add the redirect url to the config without having to write it in admin ?

Thanks in advance !

[fief-bailiff[bot]]

Hail, @louistransfer 👋 Welcome to Fief's kingdom!

Our team will get back to you very soon to help.

In the meantime, take a minute to star our repository ⭐️

Want to support us?

Subscribe to one of our paid plan to help us continue our work and receive exclusive information and benefits! Starts at $5/month 🪙

Farewell!

[frankie567]

Hey!

Are we talking about the Redirect URI of the OAuth Client? If yes, then I'm not sure why you need to add one URL per user 🤔 In a classic setup, your application only has one redirect URI, like /auth-callback.

[MathieuGrosso]

I believe Louis was referring to the inclusion of a redirect URL that would be automatically utilized upon initiating the fief worker/server.

We are currently in the process of integrating this into our environment configuration and find ourselves seeking clarity on several concepts.

Our objective is to set up a Docker Compose environment that enables us to interact with the local fief server seamlessly, without the necessity of manual adjustments through the interface.

This would involve, for instance, the automatic generation of a bearer token for testing endpoints, as well as embedding the redirect URL within the environment variables. This way, we can eliminate the repetitive task of manually entering it into the admin panel at localhost:8000 every time we launch the Docker Compose.

[MathieuGrosso]

Maybe we are missing some things on how to generate a token without having to connect in admin and on the redirect URL. If yes let us know !
Thanks :)

For the rest it is very cool and we are currently moving from keycloak to fief :)

[frankie567]

Ok, now I get it :) You want a working dev environment ready-to-use with your apps :) Currently, here are the environment variable settings you can leverage to boostrap your Fief server:

• FIEF_MAIN_USER_EMAIL/FIEF_MAIN_USER_PASSWORD: this will create an admin user with the given email and password
• FIEF_MAIN_ADMIN_API_KEY: this will create an admin API key with the given token

Thanks to the Admin API key, you could create a script that would create Clients and other objects. You can read more about the Admin API here: https://docs.fief.dev/api/ Basically, you can do something like this:

curl -X 'POST' \
  'https://example.fief.dev/admin/api/clients/' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer ADMIN_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "My Dev Client",
  "first_party": true,
  "client_type": "public",
  "redirect_uris": [
    "http://localhost:8080/auth-callback"
  ],
  "tenant_id": "TENANT_ID"
}'

---

But it's true that it may be a bit involved. I have an idea that could help this use-case: why not using a YML file to bootstrap all the objects in your Fief server. Something like this:

clients:
    client_1:
        name: My client
        redirect_uris:
            - http://localhost:8080/auth-callback

This could be passed at the container startup so it creates the given structure. Can't give you an ETA on this, but quite seduced by the idea. What do you think?

---

the automatic generation of a bearer token for testing endpoints,

Unless you're conducting complete integration tests, I would suggest you to mock/override the authorization mechanism inside your unit tests. This way, you don't even need a Fief server running to run your application tests.

---

For the rest it is very cool and we are currently moving from keycloak to fief :)

That's really cool to hear! Thanks 🙏

[MathieuGrosso]

Hello !

First, thanks for the quick answer :). Thats really cool ! For now, we will use the admin API key !

This could be passed at the container startup so it creates the given structure. Can't give you an ETA on this, but quite seduced by the idea. What do you think?

Yes thats exactly what i was thinking, like having the ability to direclty pass redirect_uris, a bit like you do when passing API_KEY. Let us know if you ever implement it :)

Unless you're conducting complete integration tests, I would suggest you to mock/override the authorization mechanism inside your unit tests. This way, you don't even need a Fief server running to run your application tests.

I will definitely do this yes, do you have an example somewhere on how to mock the autorization mechanism of fief ? After this yes we could something a bit like this to override the user :

def get_context_value(request_or_ws: Request | WebSocket, _data) -> dict:
    return {"request": request_or_ws, "access_token_info": request_or_ws.scope.get("access_token_info")}


graphql_app = GraphQL(
    schema,
    debug=True,
    context_value=get_context_value,
    websocket_handler=GraphQLTransportWSHandler(),
)


# Handle GET requests to serve GraphQL explorer
# Handle OPTIONS requests for CORS
@app.get("/graphql/")
@app.options("/graphql/")
async def handle_graphql_explorer(
    request: Request,
    access_token_info: Optional[FiefAccessTokenInfo] = Depends(
        auth.authenticated(optional=True, scope=["openid", "required_scope"])
    ),
):
    return await graphql_app.handle_request(request)


# Handle POST requests to execute GraphQL queries
@app.post("/graphql/")
async def handle_graphql_query(
    request: Request,
    access_token_info: FiefAccessTokenInfo = Depends(auth.authenticated(scope=["openid", "required_scope"])),
):
    request.scope["access_token_info"] = access_token_info
    return await graphql_app.handle_request(request)


# Handle GraphQL subscriptions over websocket
@app.websocket("/graphql")
async def graphql_subscriptions(
    websocket: WebSocket,
    access_token_info: FiefAccessTokenInfo = Depends(auth.authenticated(scope=["openid", "required_scope"])),
):
    websocket.scope["access_token_info"] = access_token_info
    await graphql_app.handle_websocket(websocket)

and then to override:

` 
fief_auth_mock= ????

 app.dependency_overrides[access_token_info] = fief_auth_mock
`

[frankie567]

FiefAccessTokenInfo is just a dictionary, so it can be as simple as:

async def access_token_info_mock():
    return {
        "id": "aeeb8bfa-e8f4-4724-9427-c3d5af66190e",
        "scope": ["openid", "required_scope"],
        "acr": "1",
        "permissions": ["castles:read", "castles:create", "castles:update", "castles:delete"],
        "access_token": "ACCESS_TOKEN",
    }

The only downside is that you need to set the dependency in a variable: this is how FastAPI can actually identify it when overriding:

my_authenticated_dependency = auth.authenticated(scope=["openid", "required_scope"])


@app.websocket("/graphql")
async def graphql_subscriptions(
    websocket: WebSocket,
    access_token_info: FiefAccessTokenInfo = Depends(my_authenticated_dependency),
):
    websocket.scope["access_token_info"] = access_token_info
    await graphql_app.handle_websocket(websocket)

app.dependency_overrides[my_authenticated_dependency] = access_token_info_mock

[MathieuGrosso]

Ok thanks a lot for now i have done this which seems to work if it can help in the future:

@pytest.fixture(scope="session")
def mock_fief():
    with mock.patch("arolya_async.api.resolvers.auth.client.validate_access_token") as fake_fief_client:
        fake_fief_client.return_value = FiefAccessTokenInfo(
            id=uuid.uuid4(),
            scope=["openid", "offline_access"],
            acr="1",
            access_token="eyJhbGciOiJSUzI1NiIsImtpZCI6IkwwUGluQ04tYUJYclNKUkFGVkszQ2NZMW1maG9yQVhJMjRQRml0MDVfZ0EifQ.eyJhY3IiOiIwIiwiYXVkIjpbIllaRFhzYjlEZVd2TFI4UmhYWUJwNGhFdkUwemM2c0FaeUJOMVZvcW9KSzQiXSwiYXV0aF90aW1lIjoxNzA4ODc3MDAxLCJhenAiOiJZWkRYc2I5RGVXdkxSOFJoWFlCcDRoRXZFMHpjNnNBWnlCTjFWb3FvSks0IiwiZXhwIjoxNzA4OTYzNDAxLCJpYXQiOjE3MDg4NzcwMDEsImlzcyI6Imh0dHBzOi8vZmllZi5haS1pZGEuY29tIiwicGVybWlzc2lvbnMiOltdLCJzY29wZSI6Im9wZW5pZCIsInN1YiI6IjFkMjUzYWVjLWU4ZjQtNGM0YS04MDk0LWM4YTU1YjVjNjViZSJ9.naadYsRjzIUByMrzR2R3XxhbO2sKPF6965YYg0ltXHhNi3SxzROzvrizGKN70JqArNqJrvrnUNS6f5mxmP2K-lI33S58gXoaUHT4JFdE5CAJqA2piAvvp2owcqBQc5ifEqQbEGp4NhPz-G1NVp5gLlfljJ7Oz47S0FN4yB9dHuFdDqoj92viKDGKdq-RFDaV7IMT89S19JxgzV0SjTgbG0XoGMOEUihFKTRK3k578whdf4Wkuiq0dcVUiMdmyg8bgjYc--b2HASY62GHAGkcdgCkdsX1JmqDiOszaSoGrCJKIIS99oU6oeeDCkmfr4GnaNGB4GqowI0nkUfV6jgCzTGz8O_5lppc9-1FFfvLh3q9_FDc7mwk78eVnY0Bkrh7IyCuGAFsu1bcFo9A2H_bIcN68C6wRNR_F0bHY3Bl0Ba8nIe_bww9HGvXTHlIsisUS0hCCvUB_Ktw6C3M_2AruXKwBHtVDL5TWX5-1ky81g1z_iIUyXb74xE-a4l42j9w9JtBvN2hFMKWwKJ6GLW5NhnmNvIsrhlKzPGQSsktWC-WxJw8sn7ahJpCCKjL5LNkGbpcQFoyuHpmWJor4W8S5aWJhiHG8VzgL9NYElNdQZQ6J_3hnXnksPdFqUwPycBlYlrPMx6tq2WkW48GnDLqSFF0O_iXvOM04DKeFJopThI",
        )

        yield fake_fief_client


@pytest.fixture(scope="session")
def mock_fief_user():
    with mock.patch("arolya_async.api.resolvers.auth.client.userinfo") as fake_user_client:
        fake_user_client.return_value = FiefUserInfo(
            sub=uuid.uuid4(),
            email="[email protected]",
            tenant_id="hfhfioezhiofhezohfoeizhfoiezhofehofhezo",
            field={"store_id": "feb86ad7-ba95-482b-be5f-8673f4bfafcb"},
        )

        yield fake_user_client

and main.py:

graphql_app = GraphQL(
    schema,
    debug=True,
    context_value=get_context_value,
    websocket_handler=GraphQLTransportWSHandler(),
)


# Handle GET requests to serve GraphQL explorer
# Handle OPTIONS requests for CORS
@app.get("/graphql/")
@app.options("/graphql/")
async def handle_graphql_explorer(
    request: Request,
    access_token_info: Optional[FiefAccessTokenInfo] = Depends(
        auth.authenticated(optional=True, scope=["openid", "offline_access"]),
    ),
):
    return await graphql_app.handle_request(request)


# Handle POST requests to execute GraphQL queries
@app.post("/graphql/")
async def handle_graphql_query(
    request: Request,
    access_token_info: FiefAccessTokenInfo = Depends(auth.authenticated(scope=["openid", "offline_access"])),
    user_info: FiefUserInfo = Depends(auth.current_user(scope=["openid", "offline_access"])),
):
    request.scope["access_token_info"] = access_token_info
    request.scope["user_info"] = user_info

    return await graphql_app.handle_request(request)


# Handle GraphQL subscriptions over websocket
@app.websocket("/graphql")
async def graphql_subscriptions(
    websocket: WebSocket,
    access_token_info: FiefAccessTokenInfo = Depends(auth.authenticated(scope=["openid", "offline_access"])),
):
    websocket.scope["access_token_info"] = access_token_info

    await graphql_app.handle_websocket(websocket)

only issue is that we dont see the graphql schema in the playground with this (even with optional as you stated) but this is minor issue for now and we need to dig in

i have seen this discussion where you mentionned it: #114

For now we will not securised the playground ! But if you know what could cause that let us know :)