Update README env

Author: chrissearle

README.md

@@ -18,25 +18,15 @@ You will require env variables:
     SP_PASSWORD=<password>
     BRING_API_KEY=<key>
     BRING_API_USER=<e-mail>
-    SLACK_CLIENT=<client ID>
-    SLACK_SECRET=<client secret>
-    SLACK_BOT_TOKEN=<app bot token>
-    SLACK_CHANNEL=<channel ID>
-    SLACK_CHANNEL_NAME=<channel name>
-    SLACK_CALLBACK=<callback URL>
-    JWT_SECRET=<jwt secret - defaults to "secret" - should be set to something else via env for deployments>
+    OIDC_WELL_KNOWN_URL=<OIDC discovery endpoint URL, e.g. https://auth.example.com/realms/myrealm/.well-known/openid-configuration>
+    OIDC_EXPECTED_AZP=<expected client ID - defaults to "cupcake-client">
     JWT_ENABLED=true/false
-    JWT_REDIRECT=URL for redirect on successful login - optional - defaults to "/"
 
-Note - if using slack authorization locally (JWT_ENABLED=true) you will have to expose your
-localhost [frosting](./frontend) instance via something like [ngrok](https://ngrok.com/) (free
-version is more than good enough) and add your exposed callback URL to the slack app's accepted list of callback URLs.
+Note - the frontend OIDC authority and client ID are currently hardcoded in
+`frontend/app/composables/useAuth.ts`. If you need to use a different OIDC provider locally,
+update `AUTHORITY` and `CLIENT_ID` in that file.
 
-You must then access the site via the exposed URL.
-
-Slack does **not** support localhost or http protocol.
-
-If you are not running with auth then localhost is fine.
+If you are not running with auth (`JWT_ENABLED=false`) then localhost is fine.
 
 ## Local running with docker compose
 
@@ -50,8 +40,7 @@ This file MUST NOT be committed to git (it is in .gitignore).
 
 Assuming we will build a docker container - add to [backend action](./.github/workflows/backend.yaml) when decided.
 
-Currently it is setup for the frontend to proxy the backend - anything on `/api/*`, as well as `/login` and
-`/slackCallback`
+Currently it is setup for the frontend to proxy the backend - anything on `/api/*`
 
 For example - let's say we setup:
 
@@ -68,7 +57,6 @@ If deploying with docker - you can place both on the same docker network and use
 
 ### JWT
 
-    JWT_SECRET - set some random long string here
     JWT_ENABLED - true
 
 ### Sleepingpill
@@ -85,71 +73,17 @@ We use the same user and password for dev and deploy here but it must be set in
     BRING_API_USER
     BRING_API_KEY
 
-### Slack
-
-This provides login and access checking.
-
-We can use the same slack client for dev and deploy but we have to set the correct callback URL both in the environment
-AND in the slack app config on https://api.slack.com
-
-    SLACK_CLIENT 
-    SLACK_SECRET
-    SLACK_BOT_TOKEN
-    SLACK_CALLBACK - must be https - using the example above it would be https://cupcake.javazone.no/slackCallback
-
-## Slack authorization
-
-This application requires a slack app that provides two functions:
-
-* OIDC login
-* A bot that can check channel membership
-
-This is currently provided via the [javaBinAccess](https://api.slack.com/apps/A0817M6EQF3/general) app.
-
-App manifest:
-
-```json
-{
-  "display_information": {
-    "name": "javaBinAccess",
-    "description": "Access bot for javaBin",
-    "background_color": "#2121cf"
-  },
-  "features": {
-    "bot_user": {
-      "display_name": "javaBinAccess",
-      "always_online": true
-    }
-  },
-  "oauth_config": {
-    "redirect_urls": [
-      "<list of allowed callback URLs>"
-    ],
-    "scopes": {
-      "user": [
-        "email",
-        "openid",
-        "profile"
-      ],
-      "bot": [
-        "channels:read",
-        "groups:read",
-        "users:read"
-      ]
-    }
-  },
-  "settings": {
-    "org_deploy_enabled": false,
-    "socket_mode_enabled": false,
-    "token_rotation_enabled": false
-  }
-}
-```
-
-To find the environment settings required:
-
-- Client ID and Client Secret from the slack app > Settings > Basic Information
-- Bot User OAuth Token token from the slack app > Features > OAuth & Permissions
-- Channel ID - right click channel - channel details - ID is at the end of the dialog
-- Channel Name - just the channel name with leading #
+### OIDC
+
+This provides authentication and access checking. Users must have the `pkom` role assigned
+in the OIDC provider under the client specified by `OIDC_EXPECTED_AZP`.
+
+    OIDC_WELL_KNOWN_URL - the OIDC discovery endpoint (e.g. https://auth.example.com/realms/myrealm/.well-known/openid-configuration)
+    OIDC_EXPECTED_AZP - the expected client ID (defaults to "cupcake-client")
+
+The backend fetches the JWKS from the discovery document and validates incoming tokens against it.
+
+Note - the frontend has the OIDC authority and client ID hardcoded in
+`frontend/app/composables/useAuth.ts` (`AUTHORITY` and `CLIENT_ID` constants). These must be
+kept in sync with the backend `OIDC_WELL_KNOWN_URL` and `OIDC_EXPECTED_AZP` settings.