fix!: do not allow insecure oauth requests by default (#27844)

* fix!: do not allow insecure oauth requests by default

* fix: format

* fix: make open-api

* fix: tests

* nit: casing

* chore: migration to allow insecure if current oauth uses http

server/src/config.ts

@@ -111,6 +111,7 @@ export type SystemConfig = {
     profileSigningAlgorithm: string;
     tokenEndpointAuthMethod: OAuthTokenEndpointAuthMethod;
     timeout: number;
+    allowInsecureRequests: boolean;
     storageLabelClaim: string;
     storageQuotaClaim: string;
     roleClaim: string;
@@ -305,6 +306,7 @@ export const defaults = Object.freeze<SystemConfig>({
     roleClaim: 'immich_role',
     tokenEndpointAuthMethod: OAuthTokenEndpointAuthMethod.ClientSecretPost,
     timeout: 30_000,
+    allowInsecureRequests: false,
   },
   passwordLogin: {
     enabled: true,

server/src/dtos/system-config.dto.ts

@@ -179,6 +179,7 @@ const SystemConfigOAuthSchema = z
     clientSecret: z.string().describe('Client secret'),
     tokenEndpointAuthMethod: OAuthTokenEndpointAuthMethodSchema,
     timeout: z.int().min(1).describe('Timeout'),
+    allowInsecureRequests: configBool.describe('Allow insecure requests'),
     defaultStorageQuota: z.number().min(0).nullable().describe('Default storage quota'),
     enabled: configBool.describe('Enabled'),
     issuerUrl: z

server/src/repositories/oauth.repository.ts

@@ -1,6 +1,6 @@
 import { Injectable, InternalServerErrorException } from '@nestjs/common';
 import {
-  allowInsecureRequests,
+  allowInsecureRequests as allowInsecureRequestsExecute,
   authorizationCodeGrant,
   buildAuthorizationUrl,
   calculatePKCECodeChallenge,
@@ -28,6 +28,7 @@ export type OAuthConfig = {
   signingAlgorithm: string;
   tokenEndpointAuthMethod: OAuthTokenEndpointAuthMethod;
   timeout: number;
+  allowInsecureRequests: boolean;
 };
 export type OAuthProfile = UserInfoResponse;
 
@@ -133,6 +134,7 @@ export class OAuthRepository {
     signingAlgorithm,
     tokenEndpointAuthMethod,
     timeout,
+    allowInsecureRequests,
   }: OAuthConfig) {
     try {
       return await discovery(
@@ -146,7 +148,7 @@ export class OAuthRepository {
         },
         this.getTokenAuthMethod(tokenEndpointAuthMethod, clientSecret),
         {
-          execute: [allowInsecureRequests],
+          execute: allowInsecureRequests ? [allowInsecureRequestsExecute] : [],
           timeout,
         },
       );

server/src/schema/migrations/1776332807985-SetOAuthAllowInsecureRequests.ts

@@ -0,0 +1,22 @@
+import { Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await sql`
+    UPDATE system_metadata
+    SET value = jsonb_set(
+      value,
+      '{oauth,allowInsecureRequests}',
+      'true'::jsonb
+    )
+    WHERE key = 'system-config'
+    AND value->'oauth'->>'issuerUrl' LIKE 'http://%'
+  `.execute(db);
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await sql`
+    UPDATE system_metadata
+    SET value = value #- '{oauth,allowInsecureRequests}'
+    WHERE key = 'system-config'
+  `.execute(db);
+}

server/src/services/system-config.service.spec.ts

@@ -145,6 +145,7 @@ const updatedConfig = Object.freeze<SystemConfig>({
     profileSigningAlgorithm: 'none',
     tokenEndpointAuthMethod: OAuthTokenEndpointAuthMethod.ClientSecretPost,
     timeout: 30_000,
+    allowInsecureRequests: false,
     storageLabelClaim: 'preferred_username',
     storageQuotaClaim: 'immich_quota',
     roleClaim: 'immich_role',