sync stable to dev

README.MD

@@ -15,7 +15,7 @@
   </a>
 </p>
 <p align="center">
-  <a href="https://github.com/ChrispyBacon-dev/DockFlare/releases/tag/v3.0.0"><img src="https://img.shields.io/badge/Release-v3.0.1-blue.svg?style=for-the-badge" alt="Release"></a>
+  <a href="https://github.com/ChrispyBacon-dev/DockFlare/releases/tag/v3.0.1"><img src="https://img.shields.io/badge/Release-v3.0.1-blue.svg?style=for-the-badge" alt="Release"></a>
   <a href="https://hub.docker.com/r/alplat/dockflare"><img src="https://img.shields.io/docker/pulls/alplat/dockflare?style=for-the-badge" alt="Docker Pulls"></a>
   <a href="https://www.python.org/"><img src="https://img.shields.io/badge/Made%20with-Python-1f425f.svg?style=for-the-badge" alt="Python"></a>
   <a href="https://github.com/ChrispyBacon-dev/DockFlare/blob/main/LICENSE.MD"><img src="https://img.shields.io/badge/License-GPL--3.0-blue.svg?style=for-the-badge" alt="License"></a>

docker-compose.yml

@@ -30,18 +30,32 @@ services:
     restart: "no"
 
   dockflare:
-    build: ./dockflare
-    #image: alplat/dockflare:stable
+    #build: ./dockflare
+    image: alplat/dockflare:stable
     container_name: dockflare
     restart: unless-stopped
     ports:
-      - "5001:5000"
-    labels: 
-      # -- Cloudflare Tunnel Configuration (via DockFlare) OPTIONAL -- 
-      - dockflare.enable=true
-      - dockflare.hostname=df.dataverse.icu
-      - dockflare.service=http://dockflare:5000
-      - dockflare.access.policy=bypass
+      - "5000:5000"
+    #labels:
+      # -- Cloudflare Tunnel Configuration (via DockFlare) OPTIONAL --
+      # Main DockFlare interface with access policy
+      #- dockflare.enable=true
+      #- dockflare.hostname=dockflare.example.com
+      #- dockflare.service=http://dockflare:5000
+      #- dockflare.access.group=team  # your custom access policy
+
+      # -- OAuth Callback Path (Bypass Access Policy) OPTIONAL --
+      # Required if using OAuth authentication with access policies on main interface
+      # - dockflare.0.hostname=dockflare.example.com
+      # - dockflare.0.path=/auth/google/callback
+      # - dockflare.0.service=http://dockflare:5000
+      # - dockflare.0.access.policy=bypass
+
+      # Add additional callback paths for other OAuth providers as needed
+      # - dockflare.1.hostname=dockflare.example.com
+      # - dockflare.1.path=/auth/github/callback
+      # - dockflare.1.service=http://dockflare:5000
+      # - dockflare.1.access.policy=bypass
     volumes:
       - dockflare_data:/app/data
     environment:

dockflare/app/templates/docs/OAuth-Provider-Setup.md

@@ -51,3 +51,51 @@ Here is a quick guide to configuring Google as an OAuth provider.
     *   **Client Secret:** `(Your Client Secret from Google)`
 
 Save the provider in DockFlare, and you will be able to log in with your Google account.
+
+---
+
+### Configuring DockFlare with OAuth and Access Policies
+
+When using OAuth authentication, you may want to protect your main DockFlare interface with access policies while ensuring OAuth callbacks work properly. This is especially important if you have IP restrictions or other access controls on your DockFlare instance.
+
+#### **Best Practice: Bypass Policy for OAuth Callbacks**
+
+Use indexed labels to create separate rules for your main interface and OAuth callback paths:
+
+```yaml
+services:
+  dockflare:
+    image: alplat/dockflare:stable
+    labels:
+      # Main DockFlare interface with access policy
+      - "dockflare.enable=true"
+      - "dockflare.hostname=dockflare.example.com"
+      - "dockflare.service=http://dockflare:5000"
+      - "dockflare.access.group=team"  # your custom access policy
+
+      # OAuth callback paths with bypass policy (required for OAuth to work)
+      - "dockflare.0.hostname=dockflare.example.com"
+      - "dockflare.0.path=/auth/google/callback"
+      - "dockflare.0.service=http://dockflare:5000"
+      - "dockflare.0.access.policy=bypass"
+
+      # Add additional callback paths for other providers if needed
+      - "dockflare.1.hostname=dockflare.example.com"
+      - "dockflare.1.path=/auth/github/callback"
+      - "dockflare.1.service=http://dockflare:5000"
+      - "dockflare.1.access.policy=bypass"
+```
+
+#### **Why This Configuration is Needed**
+
+- **Main Interface Protection**: Your DockFlare dashboard remains protected by your chosen access policy
+- **OAuth Functionality**: OAuth callbacks can reach DockFlare without authentication barriers
+- **Security**: Only specific callback paths are bypassed, not the entire application
+- **Flexibility**: Works with any combination of access policies (IP-based, authentication-based, etc.)
+
+#### **Important Notes**
+
+1. **Path Matching**: The callback path must exactly match what your OAuth provider expects
+2. **Multiple Providers**: Add a separate indexed rule for each OAuth provider you configure
+3. **No Wildcards**: Avoid using wildcard paths for security reasons - be specific with callback URLs
+4. **Testing**: After configuration, test both protected access (main interface) and OAuth login flows

dockflare/app/templates/settings.html

@@ -962,6 +962,11 @@ <h5 class="font-semibold">${escapeHtml(user.email)}</h5>
       enabled: formData.get('enabled') === 'on'
     };
 
+    const issuerUrl = formData.get('issuer_url');
+    if (issuerUrl) {
+      providerData.issuer_url = issuerUrl;
+    }
+
     try {
       const response = await fetch('/api/v2/auth/providers', {
         method: 'POST',

dockflare/app/web/api_v2_routes.py

@@ -2159,6 +2159,10 @@ def manage_auth_users():
         if not _save_encrypted_config(config_data, fernet):
             return jsonify({"error": "failed_to_save_config"}), 500
 
+        current_app.config['OAUTH_AUTHORIZED_USERS'] = [
+            user['email'] for user in config_data.get('authorized_users', [])
+        ]
+
         return jsonify({"status": "success", "message": "User added successfully."})
 
 @api_v2_bp.route('/auth/users/<user_email>', methods=['DELETE'])
@@ -2180,4 +2184,8 @@ def manage_auth_user(user_email):
     if not _save_encrypted_config(config_data, fernet):
         return jsonify({"error": "failed_to_save_config"}), 500
 
+    current_app.config['OAUTH_AUTHORIZED_USERS'] = [
+        user['email'] for user in config_data.get('authorized_users', [])
+    ]
+
     return jsonify({"status": "success", "message": "User deleted successfully."})