feat: auth proxy

keep-ui/auth.ts

@@ -1,5 +1,6 @@
 import NextAuth from "next-auth";
 import type { NextAuthConfig } from "next-auth";
+import { customFetch } from "next-auth";
 import Credentials from "next-auth/providers/credentials";
 import Keycloak from "next-auth/providers/keycloak";
 import Auth0 from "next-auth/providers/auth0";
@@ -8,6 +9,9 @@ import { AuthError } from "next-auth";
 import { AuthenticationError, AuthErrorCodes } from "@/errors";
 import type { JWT } from "@auth/core/jwt";
 
+// see https://authjs.dev/guides/corporate-proxy
+import { ProxyAgent, fetch as undici } from "undici";
+
 export class BackendRefusedError extends AuthError {
   static type = "BackendRefusedError";
 }
@@ -34,6 +38,22 @@ const authType =
     ? AuthType.NOAUTH
     : (authTypeEnv as AuthType);
 
+// Proxy configuration
+const proxyUrl =
+  process.env.HTTP_PROXY ||
+  process.env.HTTPS_PROXY ||
+  process.env.http_proxy ||
+  process.env.https_proxy;
+const dispatcher = proxyUrl ? new ProxyAgent(proxyUrl) : undefined;
+
+function proxyFetch(
+  ...args: Parameters<typeof fetch>
+): ReturnType<typeof fetch> {
+  if (!dispatcher) return fetch(...args);
+  // @ts-expect-error `undici` has a `duplex` option
+  return undici(args[0], { ...args[1], dispatcher });
+}
+
 async function refreshAccessToken(token: any) {
   const issuerUrl = process.env.KEYCLOAK_ISSUER;
   const refreshTokenUrl = `${issuerUrl}/protocol/openid-connect/token`;
@@ -170,6 +190,8 @@ const providerConfigs = {
             .KEEP_AZUREAD_CLIENT_ID!}/default openid profile email`,
         },
       },
+      // see https://authjs.dev/guides/corporate-proxy
+      [customFetch]: proxyFetch,
     }),
   ],
 };

keep-ui/package.json

@@ -97,6 +97,7 @@
     "swr": "^2.2.5",
     "tailwind-merge": "^1.12.0",
     "tailwindcss": "^3.4.1",
+    "undici": "^6.21.0",
     "uuid": "^8.3.2",
     "yaml": "^2.2.2",
     "zustand": "^5.0.1"