feat: use fetch with trusted certificates for oidc (#2412)

* feat: use fetch with trusted certificates for oidc

* fix: change custom-fetch symbol from auth-core to next-auth

* test: add mock for next-auth in events test

* refactor: use package import instead of relative import

packages/auth/package.json

@@ -25,6 +25,7 @@
   "dependencies": {
     "@auth/core": "^0.38.0",
     "@auth/drizzle-adapter": "^1.8.0",
+    "@homarr/certificates": "workspace:^0.1.0",
     "@homarr/common": "workspace:^0.1.0",
     "@homarr/db": "workspace:^0.1.0",
     "@homarr/definitions": "workspace:^0.1.0",

packages/auth/providers/oidc/oidc-provider.ts

@@ -1,6 +1,9 @@
 import type { ReadonlyHeaders } from "next/dist/server/web/spec-extension/adapters/headers";
 import type { OIDCConfig } from "@auth/core/providers";
 import type { Profile } from "@auth/core/types";
+import { customFetch } from "next-auth";
+
+import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
 
 import { env } from "../../env";
 import { createRedirectUri } from "../../redirect";
@@ -35,6 +38,10 @@ export const OidcProvider = (headers: ReadonlyHeaders | null): OIDCConfig<Profil
       provider: "oidc",
     };
   },
+  // The type for fetch is not identical, but for what we need it it's okay to not be an 1:1 match
+  // See documentation https://authjs.dev/guides/corporate-proxy?framework=next-js
+  // @ts-expect-error `undici` has a `duplex` option
+  [customFetch]: fetchWithTrustedCertificatesAsync,
 });
 
 export const extractProfileName = (profile: Profile) => {

packages/auth/test/events.spec.ts

@@ -11,6 +11,7 @@ import { colorSchemeCookieKey, everyoneGroup } from "@homarr/definitions";
 
 import { createSignInEventHandler } from "../events";
 
+vi.mock("next-auth", () => ({}));
 vi.mock("../env", () => {
   return {
     env: {

pnpm-lock.yaml

@@ -639,6 +639,9 @@ importers:
       '@auth/drizzle-adapter':
         specifier: ^1.8.0
         version: 1.8.0
+      '@homarr/certificates':
+        specifier: workspace:^0.1.0
+        version: link:../certificates
       '@homarr/common':
         specifier: workspace:^0.1.0
         version: link:../common