bootrapping support

src/internal/adapters/authelia/adapter.go

@@ -43,7 +43,7 @@ func New(cfg Config, httpClient HTTPClient) *AutheliaAdapter {
 // values — and requests the full fixed scope set. PKCE is omitted because
 // the confidential client_secret authenticates the token exchange instead.
 func (a *AutheliaAdapter) AuthorizeURL(_ context.Context, req domain.AuthRequest) (string, error) {
-	base := strings.TrimRight(a.cfg.BaseURL, "/") + "/api/oidc/authorization"
+	base := strings.TrimRight(a.authorizeBaseURL(), "/") + "/api/oidc/authorization"
 
 	q := url.Values{}
 	q.Set("client_id", a.cfg.ClientID)
@@ -136,7 +136,7 @@ type tokenResponse struct {
 // exchangeCode sends a POST to Authelia's token endpoint and returns the
 // parsed token response. On any HTTP or status error it returns a non-nil error.
 func (a *AutheliaAdapter) exchangeCode(_ context.Context, code string) (*tokenResponse, error) {
-	tokenURL := strings.TrimRight(a.cfg.BaseURL, "/") + "/api/oidc/token"
+	tokenURL := strings.TrimRight(a.tokenBaseURL(), "/") + "/api/oidc/token"
 
 	body := url.Values{}
 	body.Set("grant_type", "authorization_code")
@@ -173,6 +173,20 @@ func (a *AutheliaAdapter) exchangeCode(_ context.Context, code string) (*tokenRe
 	return &tr, nil
 }
 
+func (a *AutheliaAdapter) authorizeBaseURL() string {
+	if a.cfg.BrowserBaseURL != "" {
+		return a.cfg.BrowserBaseURL
+	}
+	return a.cfg.BaseURL
+}
+
+func (a *AutheliaAdapter) tokenBaseURL() string {
+	if a.cfg.TokenBaseURL != "" {
+		return a.cfg.TokenBaseURL
+	}
+	return a.cfg.BaseURL
+}
+
 // parseIDTokenClaims extracts the JWT payload claims without verifying the
 // signature. This is intentional — the token is received directly from the
 // upstream OIDC provider over a server-to-server TLS connection.