# Visione CIE Auth Stack

This folder contains deployable CIE auth services for Visione:
- `federation-authority`
- `provider`
- `relying-party`

It is now structured to work with Docker Compose and Dokploy without host networking.

## Configuration
Copy [.env.example](/workspace/cie-auth/.env.example) to `.env` and set only what changes in real deploy:
- public domains / internal URLs
- Django secret keys
- shared secret between relying party and Visione backend

Main variables:
- `CIE_AUTH_ALLOWED_HOSTS`
- `DJANGO_TRUST_ANCHOR`
- `DJANGO_PROVIDER_ISSUER`
- `DJANGO_RP_BACKEND_EXCHANGE_URL`
- `DJANGO_RP_SHARED_SECRET`
- `FEDERATION_AUTHORITY_SECRET_KEY`
- `PROVIDER_SECRET_KEY`
- `RELYING_PARTY_SECRET_KEY`

## Deploy with Dokploy
Use [docker-compose.yml](/workspace/cie-auth/docker-compose.yml) as compose source.
Expose:
- `federation-authority` on port `8000`
- `provider` on port `8002`
- `relying-party` on port `8001`

Each service persists its own SQLite DB in a named volume.

## Local start

```bash
docker compose up --build -d
```

## Visione backend
Visione backend must expose exchange endpoint configured in `DJANGO_RP_BACKEND_EXCHANGE_URL`.
Shared secret must match backend `cie_auth.shared_secret`.

## Bootstrap behavior
On first boot, each Django service:
1. runs migrations
2. loads `dumps/example.json` only if DB is empty

Disable fixture import per service with:
- `FEDERATION_AUTHORITY_LOAD_FIXTURE_ON_EMPTY_DB=false`
- `PROVIDER_LOAD_FIXTURE_ON_EMPTY_DB=false`
- `RELYING_PARTY_LOAD_FIXTURE_ON_EMPTY_DB=false`

## Smoke test

```bash
curl -sS -X POST http://127.0.0.1:5555/api/v1/auth/cie/start \
  -H 'Content-Type: application/json' \
  -d '{"frontend_redirect_uri":"http://localhost:3000/auth/cie/callback"}'
```

Then complete login and poll:

```bash
curl -sS http://127.0.0.1:5555/api/v1/auth/cie/session/<state>
```

## Reset data

```bash
docker compose down -v
```

## Logs
```bash
docker compose logs -f
```