Fix ZITADEL OIDC integration flow

Author: terion-name

ansible/roles/oauth2_proxy/templates/oauth2-proxy.cfg.j2

@@ -1,10 +1,6 @@
 provider = "oidc"
 provider_display_name = "Terrarium"
 http_address = "127.0.0.1:{{ terrarium_oauth2_proxy_port }}"
-{% if (terrarium_idp_provider_effective | default(terrarium_idp_provider | default('', true), true) | string | trim | lower) != 'logto' %}
-redirect_url = "/oauth2/callback"
-relative_redirect_url = true
-{% endif %}
 oidc_issuer_url = "{{ terrarium_oauth2_proxy_oidc_issuer }}"
 oidc_groups_claim = "{{ terrarium_oauth2_proxy_oidc_groups_claim }}"
 client_id = "{{ terrarium_oauth2_proxy_client_id }}"

scripts/terrarium-zitadel-sync.ts

@@ -633,7 +633,7 @@ export function buildLocalIdpOutputs(projectId: string, apps: Record<LocalOidcAp
   const output = {
     cockpit_client_id: { sensitive: true, type: "string", value: apps.cockpit.clientId },
     cockpit_client_secret: { sensitive: true, type: "string", value: apps.cockpit.clientSecret ?? "" },
-    issuer: { sensitive: false, type: "string", value: `https://${authDomain}/` },
+    issuer: { sensitive: false, type: "string", value: `https://${authDomain}` },
     lxd_client_id: { sensitive: true, type: "string", value: apps.lxd.clientId },
     project_id: { sensitive: false, type: "string", value: projectId },
     routes_client_id: { sensitive: true, type: "string", value: apps.routes.clientId },

tests/integration/resources.test.ts

@@ -154,11 +154,32 @@ describe("integration cleanup resource manifest", () => {
       "hetzner:volume:2",
       "hetzner:ssh-key:1",
       "external-oidc:zitadel:user:user-1",
-      "external-oidc:zitadel:app:app-1",
       "external-oidc:zitadel:project:project-1"
     ]);
   });
 
+  test("clears project-scoped ZITADEL resources after project deletion", () => {
+    let manifest = createEmptyResourceManifest("run-zitadel-cascade");
+    manifest = recordZitadelFixtureProject(manifest, {
+      slug: "run-zitadel-cascade",
+      projectId: "project-1",
+      projectName: "terrarium-run-zitadel-cascade",
+      adminGroup: "terrarium-admins",
+      routeGroups: ["agents"]
+    });
+    manifest = recordZitadelFixtureApp(manifest, {
+      slug: "run-zitadel-cascade",
+      projectId: "project-1",
+      appId: "app-1",
+      appName: "terrarium-run-zitadel-cascade-external"
+    });
+
+    manifest = removeZitadelFixtureProject(manifest, "run-zitadel-cascade");
+
+    expect(manifest.externalOidc.fixtures).toEqual([]);
+    expect(buildCleanupPlan(manifest)).toEqual([]);
+  });
+
   test("loads and plans legacy ZITADEL manifests without external OIDC records", () => {
     const directory = mkdtempSync(join(tmpdir(), "terrarium-resources-"));
     const path = join(directory, "resources.json");
@@ -206,7 +227,6 @@ describe("integration cleanup resource manifest", () => {
       expect(manifest.zitadel.fixtures[0].routeGroups).toEqual([]);
       expect(buildCleanupPlan(manifest).map(stepKey)).toEqual([
         "external-oidc:zitadel:user:legacy-user",
-        "external-oidc:zitadel:app:legacy-app",
         "external-oidc:zitadel:project:legacy-project"
       ]);
 

tests/integration/resources.ts

@@ -707,7 +707,19 @@ export function removeZitadelFixtureUser(manifest: CleanupResourceManifest, slug
 }
 
 export function removeZitadelFixtureProject(manifest: CleanupResourceManifest, slug: string): CleanupResourceManifest {
-  const withoutCurrent = removeExternalOidcFixtureProject(manifest, "zitadel", slug);
+  let withoutCurrent = removeExternalOidcFixtureProject(manifest, "zitadel", slug);
+  const currentFixture = withoutCurrent.externalOidc.fixtures.find(
+    (fixture) => fixture.idpProvider === "zitadel" && fixture.slug === slug
+  );
+  if (currentFixture) {
+    withoutCurrent = removeEmptyExternalOidcFixture(withoutCurrent, {
+      ...currentFixture,
+      applications: [],
+      roles: [],
+      apiResources: [],
+      routeGroups: []
+    });
+  }
   return pruneLegacyZitadelFixture(withoutCurrent, slug, (fixture) => {
     if (fixture.users.length > 0) {
       const {
@@ -762,6 +774,9 @@ export function buildCleanupPlan(manifest: CleanupResourceManifest): CleanupStep
     }
   }
   for (const fixture of [...externalOidcFixtures].reverse()) {
+    if (fixture.idpProvider === "zitadel" && fixture.projectId) {
+      continue;
+    }
     for (const application of [...fixture.applications].reverse()) {
       steps.push({
         provider: "external-oidc",

tests/oauth2-proxy-template.test.ts

@@ -10,25 +10,16 @@ const OAUTH2_PROXY_MIRROR_IMAGE =
 const OAUTH2_PROXY_FALLBACK_IMAGE =
   "quay.io/oauth2-proxy/oauth2-proxy:v7.15.2@sha256:aa0bd8dd5ab0c78e4c91c92755ad573a5f92241f88138b4141b8ec803463b4fd";
 
-const LOGTO_REDIRECT_CONDITION =
-  "{% if (terrarium_idp_provider_effective | default(terrarium_idp_provider | default('', true), true) | string | trim | lower) != 'logto' %}";
-const RELATIVE_REDIRECT_BLOCK = 'redirect_url = "/oauth2/callback"\nrelative_redirect_url = true\n';
-const CONDITIONAL_RELATIVE_REDIRECT_BLOCK = `${LOGTO_REDIRECT_CONDITION}\n${RELATIVE_REDIRECT_BLOCK}{% endif %}\n`;
-
 function oauth2ProxyTemplate() {
   return readFileSync(join(import.meta.dir, "../ansible/roles/oauth2_proxy/templates/oauth2-proxy.cfg.j2"), "utf8");
 }
 
-function renderOauth2ProxyTemplate(provider: string) {
-  const replacement = provider.trim().toLowerCase() === "logto" ? "" : RELATIVE_REDIRECT_BLOCK;
-  return oauth2ProxyTemplate().replace(CONDITIONAL_RELATIVE_REDIRECT_BLOCK, replacement);
-}
-
 describe("management oauth2-proxy template", () => {
   test("uses host-only cookies for management hosts", () => {
     const template = oauth2ProxyTemplate();
 
-    expect(template).toContain(CONDITIONAL_RELATIVE_REDIRECT_BLOCK);
+    expect(template).not.toContain('redirect_url = "/oauth2/callback"');
+    expect(template).not.toContain("relative_redirect_url = true");
     expect(template).toContain('cookie_name = "__Host-terrarium_admin_oauth2_proxy"');
     expect(template).toContain('cookie_path = "/"');
     expect(template).toContain('whitelist_domains = [ "{{ terrarium_manage_domain }}", "{{ terrarium_proxy_domain }}" ]');
@@ -40,15 +31,12 @@ describe("management oauth2-proxy template", () => {
     expect(template).not.toContain("terrarium_oauth2_proxy_cookie_domain");
   });
 
-  test("omits relative redirect settings for Logto while preserving other providers", () => {
-    const logtoConfig = renderOauth2ProxyTemplate("logto");
-    const zitadelConfig = renderOauth2ProxyTemplate("zitadel");
-    const genericConfig = renderOauth2ProxyTemplate("generic");
+  test("lets oauth2-proxy derive an absolute callback URL from reverse-proxy headers", () => {
+    const template = oauth2ProxyTemplate();
 
-    expect(logtoConfig).not.toContain('redirect_url = "/oauth2/callback"');
-    expect(logtoConfig).not.toContain("relative_redirect_url = true");
-    expect(zitadelConfig).toContain(RELATIVE_REDIRECT_BLOCK);
-    expect(genericConfig).toContain(RELATIVE_REDIRECT_BLOCK);
+    expect(template).not.toContain('redirect_url = "/oauth2/callback"');
+    expect(template).not.toContain("relative_redirect_url = true");
+    expect(template).toContain("reverse_proxy = true");
   });
 
   test("uses provider-aware OIDC claim and scope variables", () => {

tests/terrarium-zitadel-sync.test.ts

@@ -41,7 +41,7 @@ describe("terrarium local ZITADEL sync", () => {
     expect(output).toMatchObject({
       cockpit_client_id: { sensitive: true, type: "string", value: "cockpit-client" },
       cockpit_client_secret: { sensitive: true, type: "string", value: "cockpit-secret" },
-      issuer: { sensitive: false, type: "string", value: "https://auth.example.test/" },
+      issuer: { sensitive: false, type: "string", value: "https://auth.example.test" },
       lxd_client_id: { sensitive: true, type: "string", value: "lxd-client" },
       project_id: { sensitive: false, type: "string", value: "project-1" },
       routes_client_id: { sensitive: true, type: "string", value: "routes-client" },