From 5e07fc3e83f136bdcb0a75a663fe9eec293f39e4 Mon Sep 17 00:00:00 2001
From: David Juarez <d.juarez@dkfz-heidelberg.de>
Date: Wed, 29 Jul 2026 13:21:37 +0200
Subject: [PATCH] chore: oauth2 in lens

---
 cce/modules/lens-compose.yml | 52 +++++++++++++++++++++++++++++++++---
 cce/modules/lens-setup.sh    |  3 ++-
 cce/vars                     |  4 ++-
 3 files changed, 54 insertions(+), 5 deletions(-)

diff --git a/cce/modules/lens-compose.yml b/cce/modules/lens-compose.yml
index 59d707c..55a7549 100644
--- a/cce/modules/lens-compose.yml
+++ b/cce/modules/lens-compose.yml
@@ -2,14 +2,61 @@ version: "3.7"
 services:
   lens:
     container_name: lens_federated-search
-    image: samply/cce-explorer:main
+    #image: samply/cce-explorer:main
+    image: ghcr.io/samply/cce-explorer:feature-project-manager
     environment:
       PUBLIC_SPOT_URL: https://${HOST}/prod
+      PUBLIC_ENVIRONMENT: "test"
+      PUBLIC_OAUTH2_AUTH_URL: ${OAUTH2_AUTH_URL}
     labels:
       - "traefik.http.services.lens.loadbalancer.server.port=3000"
       - "traefik.enable=true"
       - "traefik.http.routers.lens.rule=Host(`${HOST}`)"
       - "traefik.http.routers.lens.tls=true"
+      - "traefik.http.routers.lens.middlewares=lens-oauth"
+
+  lens-oauth2-proxy:
+    container_name: lens_oauth2-proxy
+    image: docker.verbis.dkfz.de/cache/oauth2-proxy/oauth2-proxy:latest
+    environment:
+      http_proxy: http://forward_proxy:3128
+      https_proxy: http://forward_proxy:3128
+      OAUTH2_PROXY_PROVIDER: oidc
+      OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
+      # Use the same issuer as Project Manager so Lens can forward the token to its API.
+      OAUTH2_PROXY_OIDC_ISSUER_URL: ${PM_OIDC_URL}
+      OAUTH2_PROXY_CLIENT_ID: ${PM_OIDC_PRIVATE_CLIENT_ID}
+      OAUTH2_PROXY_CLIENT_SECRET: ${PM_OIDC_PRIVATE_SECRET}
+      OAUTH2_PROXY_COOKIE_SECRET: ${LENS_AUTH_COOKIE_SECRET}
+      OAUTH2_PROXY_COOKIE_NAME: _BRIDGEHEAD_oauth2_lens
+      OAUTH2_PROXY_COOKIE_REFRESH: 4m
+      OAUTH2_PROXY_COOKIE_EXPIRE: 24h
+      OAUTH2_PROXY_COOKIE_SECURE: "true"
+      OAUTH2_PROXY_COOKIE_SAMESITE: lax
+      OAUTH2_PROXY_HTTP_ADDRESS: :4180
+      OAUTH2_PROXY_REVERSE_PROXY: "true"
+      OAUTH2_PROXY_REDIRECT_URL: https://${HOST}/oauth2/callback
+      OAUTH2_PROXY_WHITELIST_DOMAINS: ${HOST}
+      OAUTH2_PROXY_UPSTREAMS: static://202
+      OAUTH2_PROXY_EMAIL_DOMAINS: "*"
+      OAUTH2_PROXY_SCOPE: openid profile email
+      OAUTH2_PROXY_SET_AUTHORIZATION_HEADER: "true"
+      OAUTH2_PROXY_SET_XAUTHREQUEST: "true"
+      OAUTH2_PROXY_ALLOWED_GROUPS: ${OIDC_LENS_GROUP}
+      OAUTH2_PROXY_OIDC_GROUPS_CLAIM: ${OIDC_GROUP_CLAIM}
+      OAUTH2_PROXY_PROXY_PREFIX: /oauth2
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.lens-oauth2-proxy.loadbalancer.server.port=4180"
+      - "traefik.http.routers.lens-oauth2.rule=Host(`${HOST}`) && PathPrefix(`/oauth2/`)"
+      - "traefik.http.routers.lens-oauth2.tls=true"
+      - "traefik.http.routers.lens-oauth2.priority=100"
+      - "traefik.http.routers.lens-oauth2.service=lens-oauth2-proxy"
+      - "traefik.http.middlewares.lens-oauth.forwardauth.address=http://lens-oauth2-proxy:4180"
+      - "traefik.http.middlewares.lens-oauth.forwardauth.authResponseHeaders=Authorization,X-Auth-Request-User,X-Auth-Request-Email,X-Auth-Request-Groups"
+    depends_on:
+      forward_proxy:
+        condition: service_healthy
 
   spot:
     image: samply/rustyspot:latest
@@ -38,9 +85,8 @@ services:
       - "traefik.http.routers.spot.rule=Host(`${HOST}`) && PathPrefix(`/prod`)"
       - "traefik.http.middlewares.stripprefix_spot.stripprefix.prefixes=/prod"
       - "traefik.http.routers.spot.tls=true"
-      - "traefik.http.routers.spot.middlewares=corsheaders2,stripprefix_spot,auth"
+      - "traefik.http.routers.spot.middlewares=corsheaders2,lens-oauth,stripprefix_spot"
 
   beam-proxy:
     environment:
       APP_spot_KEY: ${FOCUS_BEAM_SECRET_SHORT}
-      
\ No newline at end of file
diff --git a/cce/modules/lens-setup.sh b/cce/modules/lens-setup.sh
index c19dc4b..8843789 100644
--- a/cce/modules/lens-setup.sh
+++ b/cce/modules/lens-setup.sh
@@ -1,5 +1,6 @@
 #!/bin/bash
 
 if [ -n "$ENABLE_LENS" ];then
+  LENS_AUTH_COOKIE_SECRET="$(echo "This is a salt string to generate one consistent cookie secret for the Lens oauth2 proxy." | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | tr -d '\n' | head -c 32)"
   OVERRIDE+=" -f ./$PROJECT/modules/lens-compose.yml"
-fi
\ No newline at end of file
+fi
diff --git a/cce/vars b/cce/vars
index 57ff2d7..e504a54 100644
--- a/cce/vars
+++ b/cce/vars
@@ -14,9 +14,11 @@ OIDC_PUBLIC_CLIENT_ID=${SITE_ID}-public
 OIDC_URL="https://sso.verbis.dkfz.de/application/o/${OIDC_PUBLIC_CLIENT_ID}/"
 OIDC_PRIVATE_URL="https://sso.verbis.dkfz.de/application/o/${OIDC_PRIVATE_CLIENT_ID}/"
 OIDC_GROUP_CLAIM="groups"
+OIDC_LENS_GROUP="coop-cce"
+OAUTH2_AUTH_URL="/oauth2/auth"
 
 for module in $PROJECT/modules/*.sh
 do
     log DEBUG "sourcing $module"
     source $module
-done
\ No newline at end of file
+done