@blakearoberts/visage 0.0.5-rc.26 → 0.0.5-rc.28

package/README.md

@@ -105,11 +105,44 @@ visage({
 });
 ```
 
-OAuth2 Proxy exposes the canonical authenticated principal as `$auth_user`,
-which Visage forwards to the Vite app as `X-Auth-Request-User`. Additional
-identity values such as `$auth_email`, `$auth_groups`, and
-`$auth_preferred_username` are optional and depend on the requested scopes and
-identity provider claims.
+OAuth2 Proxy returns the canonical authenticated principal in
+`X-Auth-Request-User`. Visage captures it as `$auth_user` and forwards it to the
+Vite app. When `oauth2.scopes` includes `email`, Visage also captures
+`X-Auth-Request-Email` as `$auth_email` and forwards it to the Vite app. Without
+the `email` scope, `$auth_email` is empty and NGINX omits the header.
+
+OAuth2 Proxy can also return `X-Auth-Request-Groups` and
+`X-Auth-Request-Preferred-Username`, but Visage does not capture or forward them
+automatically. Capture and forward optional identity values on each location
+that needs them:
+
+```ts
+visage({
+  upstreams: {
+    api: {
+      locations: {
+        '/api/': {
+          directives: {
+            auth_request_set: [
+              '$auth_groups $upstream_http_x_auth_request_groups',
+              '$auth_preferred_username $upstream_http_x_auth_request_preferred_username',
+            ],
+          },
+          headers: {
+            'X-Auth-Request-Groups': '$auth_groups',
+            'X-Auth-Request-Preferred-Username': '$auth_preferred_username',
+          },
+        },
+      },
+    },
+  },
+});
+```
+
+Requested scopes and identity provider claims determine whether OAuth2 Proxy can
+populate these values. Visage clears incoming `X-Auth-Request-*` identity
+headers before proxying to prevent callers from spoofing them; explicit location
+headers such as those above override the corresponding clears.
 
 Authenticated locations also get CSRF checks by default. The policy allows
 same-origin requests and top-level `GET` document navigations, blocks other

package/dist/index.js

@@ -934,10 +934,7 @@ http {
             auth_request_set  $auth_user $upstream_http_x_auth_request_user;
             <%_ /* Explicit clear when oauth2-proxy sets sub as email header value. */ %>
             auth_request_set  $auth_email <%~ it.email ? '$upstream_http_x_auth_request_email' : '""' %>;
-            auth_request_set  $auth_groups $upstream_http_x_auth_request_groups;
-            auth_request_set  $auth_preferred_username $upstream_http_x_auth_request_preferred_username;
-
-            # Propagate refreshed session cookie.
+            <%_ /* Propagate refreshed session cookie. */ %>
             auth_request_set  $auth_cookie $upstream_http_set_cookie;
             add_header        Set-Cookie $auth_cookie;
             error_page        401 = $auth_error_page;

package/dist/render/nginx.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nginx.d.ts","sourceRoot":"","sources":["../../src/render/nginx.ts"],"names":[],"mappings":"AAKA,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AA4KnE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAQ3D"}
+{"version":3,"file":"nginx.d.ts","sourceRoot":"","sources":["../../src/render/nginx.ts"],"names":[],"mappings":"AAKA,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAyKnE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAQ3D"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blakearoberts/visage",
-  "version": "0.0.5-rc.26",
+  "version": "0.0.5-rc.28",
   "description": "Vite plugin for local development with HMR and OIDC session cookie lifecycle semantics.",
   "type": "module",
   "author": "Blake Roberts",