forked from developer italia

2026-06-17 17:46:59 +02:00
commit 69e71ec601
43 changed files with 6026 additions and 0 deletions
@@ -0,0 +1,106 @@
+# Visione Local CIE Stack
+
+This folder is a ready-to-run local stack for CIE auth integration with Visione.
+
+Included services:
+- `federation-authority`
+- `provider`
+- `relying-party`
+
+They run through one compose file and use the modified relying party bridge for Visione.
+
+## Prerequisites
+- Visione backend running on `http://127.0.0.1:5555`
+- Docker with Compose
+
+## Visione config
+Set in `config.json`:
+
+```json
+"cie_auth": {
+  "service_base_url": "http://127.0.0.1:8001",
+  "start_path": "/visione/start",
+  "shared_secret": "change-me-for-local-dev",
+  "state_ttl_minutes": 10,
+  "default_frontend_redirect_uri": "http://localhost:3000/auth/cie/callback"
+}
+```
+
+Keep same secret also in:
+- `relying_party/relying_party/settingslocal.py`
+  `VISIONE_SHARED_SECRET`
+
+## Start stack
+From repo root:
+
+```bash
+docker compose up -d
+docker compose -f infra/cie-auth/docker-compose.yml up --build -d
+```
+
+This starts:
+- MySQL + Mailpit from root compose
+- authority on `127.0.0.1:8000`
+- provider on `127.0.0.1:8002`
+- relying party on `127.0.0.1:8001`
+
+## Start Visione
+From repo root:
+
+```bash
+cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug
+cmake --build build
+./build/visione-backend
+```
+
+## Smoke test
+Start login:
+
+```bash
+curl -sS -X POST http://127.0.0.1:5555/api/v1/auth/cie/start \
+  -H 'Content-Type: application/json' \
+  -d '{"frontend_redirect_uri":"http://localhost:3000/auth/cie/callback"}'
+```
+
+Expected JSON:
+- `authorization_url`
+- `state`
+
+Then:
+1. open `authorization_url` in browser
+2. complete demo CIE login
+3. browser lands on `http://localhost:3000/auth/cie/callback?state=...`
+
+Poll result:
+
+```bash
+curl -sS http://127.0.0.1:5555/api/v1/auth/cie/session/<state>
+```
+
+Expected success:
+- `status = "authenticated"`
+- `auth.token` present
+
+## Frontend flow
+1. call `POST /api/v1/auth/cie/start`
+2. redirect browser to `authorization_url`
+3. callback page reads `state`
+4. poll `GET /api/v1/auth/cie/session/{state}`
+5. when authenticated, save `auth.token`
+6. call `GET /api/v1/me`
+
+## Reset local auth DBs
+If you want a clean auth stack:
+
+```bash
+rm -f infra/cie-auth/federation_authority/db.sqlite3
+rm -f infra/cie-auth/provider/db.sqlite3
+rm -f infra/cie-auth/relying_party/db.sqlite3
+docker compose -f infra/cie-auth/docker-compose.yml down
+docker compose -f infra/cie-auth/docker-compose.yml up --build -d
+```
+
+## Logs
+```bash
+docker compose -f infra/cie-auth/docker-compose.yml logs -f
+```