# Visione Local CIE Stack

This folder is a ready-to-run local stack for CIE auth integration with Visione.

Included services:
- `federation-authority`
- `provider`
- `relying-party`

They run through one compose file and use the modified relying party bridge for Visione.

## Prerequisites
- Visione backend running on `http://127.0.0.1:5555`
- Docker with Compose

## Visione config
Set in `config.json`:

```json
"cie_auth": {
  "service_base_url": "http://127.0.0.1:8001",
  "start_path": "/visione/start",
  "shared_secret": "change-me-for-local-dev",
  "state_ttl_minutes": 10,
  "default_frontend_redirect_uri": "http://localhost:3000/auth/cie/callback"
}
```

Keep same secret also in:
- `relying_party/relying_party/settingslocal.py`
  `VISIONE_SHARED_SECRET`

## Start stack
From repo root:

```bash
docker compose up -d
docker compose -f infra/cie-auth/docker-compose.yml up --build -d
```

This starts:
- MySQL + Mailpit from root compose
- authority on `127.0.0.1:8000`
- provider on `127.0.0.1:8002`
- relying party on `127.0.0.1:8001`

## Start Visione
From repo root:

```bash
cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug
cmake --build build
./build/visione-backend
```

## Smoke test
Start login:

```bash
curl -sS -X POST http://127.0.0.1:5555/api/v1/auth/cie/start \
  -H 'Content-Type: application/json' \
  -d '{"frontend_redirect_uri":"http://localhost:3000/auth/cie/callback"}'
```

Expected JSON:
- `authorization_url`
- `state`

Then:
1. open `authorization_url` in browser
2. complete demo CIE login
3. browser lands on `http://localhost:3000/auth/cie/callback?state=...`

Poll result:

```bash
curl -sS http://127.0.0.1:5555/api/v1/auth/cie/session/<state>
```

Expected success:
- `status = "authenticated"`
- `auth.token` present

## Frontend flow
1. call `POST /api/v1/auth/cie/start`
2. redirect browser to `authorization_url`
3. callback page reads `state`
4. poll `GET /api/v1/auth/cie/session/{state}`
5. when authenticated, save `auth.token`
6. call `GET /api/v1/me`

## Reset local auth DBs
If you want a clean auth stack:

```bash
rm -f infra/cie-auth/federation_authority/db.sqlite3
rm -f infra/cie-auth/provider/db.sqlite3
rm -f infra/cie-auth/relying_party/db.sqlite3
docker compose -f infra/cie-auth/docker-compose.yml down
docker compose -f infra/cie-auth/docker-compose.yml up --build -d
```

## Logs
```bash
docker compose -f infra/cie-auth/docker-compose.yml logs -f
```