refactor(dev): dockerify auth-server (#24377)

Description
-----------

A while ago I asked on Discord if you people would be interested in removing incompatibilities with rootless docker. See: https://discord.com/channels/979116623879368755/1071165397228855327/1442974448776122592

The e2e tests in `e2e/src/api/specs/oauth.e2e-spec.ts` depend on a docker feature [host-gateway](https://docs.docker.com/reference/cli/dockerd/#configure-host-gateway-ip) that seemingly does not work on rootless docker.

So the suggested change is to dockerify the `auth-server` and not run it on the docker host.

I would love to receive feedback on this PR and feel free to request further improvements. Things that come to my mind:

* Compile typescript instead of using `tsx`
* Add hot-reloading of source files in `auth-server/` for development
* Add `eslint` configuration for the new folder

How Has This Been Tested?
------------------------

I'm running both default and rootless docker on my machine with [docker contexts](https://docs.docker.com/engine/manage-resources/contexts/):
```
docker context ls
NAME         DESCRIPTION                               DOCKER ENDPOINT                     ERROR
default                                                unix:///var/run/docker.sock
rootless *                                             unix:///run/user/1000/docker.sock
```

If I follow the steps from the [documentation](https://docs.immich.app/developer/testing) then `oauth.e2e-spec.ts` will fail because the `auth-server` on my host can't be reached.

The tests pass after these steps:
1. `git switch refactor-auth-server-as-service`
2. `make e2e`
3. In another terminal `cd e2e`
4. `pnpm run test src/api/specs/oauth.e2e-spec.ts` passes

Checklist:
----------

- [x] I have performed a self-review of my own code
- [x] I have made corresponding changes to the documentation if applicable
- [x] I have no unrelated changes in the PR.
- [ ] I have confirmed that any new dependencies are strictly necessary.
- [ ] I have written tests for new code (if applicable)
- [ ] I have followed naming conventions/patterns in the surrounding code
- [ ] All code in `src/services/` uses repositories implementations for database calls, filesystem operations, etc.
- [ ] All code in `src/repositories/` is pretty basic/simple and does not have any immich specific logic (that belongs in `src/services/`)

e2e/docker-compose.yml

@@ -1,6 +1,12 @@
 name: immich-e2e
 
 services:
+  e2e-auth-server:
+    build:
+      context: ../e2e-auth-server
+    ports:
+      - 2286:2286
+
   immich-server:
     container_name: immich-e2e-server
     image: immich-server:latest
@@ -27,8 +33,6 @@ services:
       - IMMICH_IGNORE_MOUNT_CHECK_ERRORS=true
     volumes:
       - ./test-assets:/test-assets
-    extra_hosts:
-      - 'auth-server:host-gateway'
     depends_on:
       redis:
         condition: service_started

e2e/package.json

@@ -22,12 +22,12 @@
     "@eslint/js": "^9.8.0",
     "@faker-js/faker": "^10.1.0",
     "@immich/cli": "file:../cli",
+    "@immich/e2e-auth-server": "file:../e2e-auth-server",
     "@immich/sdk": "file:../open-api/typescript-sdk",
     "@playwright/test": "^1.44.1",
     "@socket.io/component-emitter": "^3.1.2",
     "@types/luxon": "^3.4.2",
     "@types/node": "^24.10.4",
-    "@types/oidc-provider": "^9.0.0",
     "@types/pg": "^8.15.1",
     "@types/pngjs": "^6.0.4",
     "@types/supertest": "^6.0.2",
@@ -38,9 +38,7 @@
     "eslint-plugin-unicorn": "^62.0.0",
     "exiftool-vendored": "^34.3.0",
     "globals": "^16.0.0",
-    "jose": "^5.6.3",
     "luxon": "^3.4.4",
-    "oidc-provider": "^9.0.0",
     "pg": "^8.11.3",
     "pngjs": "^7.0.0",
     "prettier": "^3.7.4",

e2e/src/api/specs/oauth.e2e-spec.ts

@@ -1,3 +1,4 @@
+import { OAuthClient, OAuthUser } from '@immich/e2e-auth-server';
 import {
   LoginResponseDto,
   SystemConfigOAuthDto,
@@ -8,13 +9,12 @@ import {
 } from '@immich/sdk';
 import { createHash, randomBytes } from 'node:crypto';
 import { errorDto } from 'src/responses';
-import { OAuthClient, OAuthUser } from 'src/setup/auth-server';
 import { app, asBearerAuth, baseUrl, utils } from 'src/utils';
 import request from 'supertest';
 import { beforeAll, describe, expect, it } from 'vitest';
 
 const authServer = {
-  internal: 'http://auth-server:2286',
+  internal: 'http://e2e-auth-server:2286',
   external: 'http://127.0.0.1:2286',
 };
 

e2e/src/setup/auth-server.ts

@@ -1,133 +0,0 @@
-import { exportJWK, generateKeyPair } from 'jose';
-import Provider from 'oidc-provider';
-
-export enum OAuthClient {
-  DEFAULT = 'client-default',
-  RS256_TOKENS = 'client-RS256-tokens',
-  RS256_PROFILE = 'client-RS256-profile',
-}
-
-export enum OAuthUser {
-  NO_EMAIL = 'no-email',
-  NO_NAME = 'no-name',
-  WITH_QUOTA = 'with-quota',
-  WITH_USERNAME = 'with-username',
-  WITH_ROLE = 'with-role',
-}
-
-const claims = [
-  { sub: OAuthUser.NO_EMAIL },
-  {
-    sub: OAuthUser.NO_NAME,
-    email: 'oauth-no-name@immich.app',
-    email_verified: true,
-  },
-  {
-    sub: OAuthUser.WITH_USERNAME,
-    email: 'oauth-with-username@immich.app',
-    email_verified: true,
-    immich_username: 'user-username',
-  },
-  {
-    sub: OAuthUser.WITH_QUOTA,
-    email: 'oauth-with-quota@immich.app',
-    email_verified: true,
-    preferred_username: 'user-quota',
-    immich_quota: 25,
-  },
-  {
-    sub: OAuthUser.WITH_ROLE,
-    email: 'oauth-with-role@immich.app',
-    email_verified: true,
-    immich_role: 'admin',
-  },
-];
-
-const withDefaultClaims = (sub: string) => ({
-  sub,
-  email: `${sub}@immich.app`,
-  name: 'OAuth User',
-  given_name: `OAuth`,
-  family_name: 'User',
-  email_verified: true,
-});
-
-const getClaims = (sub: string) => claims.find((user) => user.sub === sub) || withDefaultClaims(sub);
-
-const setup = async () => {
-  const { privateKey, publicKey } = await generateKeyPair('RS256');
-
-  const redirectUris = ['http://127.0.0.1:2285/auth/login', 'https://photos.immich.app/oauth/mobile-redirect'];
-  const port = 2286;
-  const host = '0.0.0.0';
-  const oidc = new Provider(`http://${host}:${port}`, {
-    renderError: async (ctx, out, error) => {
-      console.error(out);
-      console.error(error);
-      ctx.body = 'Internal Server Error';
-    },
-    findAccount: (ctx, sub) => ({ accountId: sub, claims: () => getClaims(sub) }),
-    scopes: ['openid', 'email', 'profile'],
-    claims: {
-      openid: ['sub'],
-      email: ['email', 'email_verified'],
-      profile: [
-        'name',
-        'given_name',
-        'family_name',
-        'preferred_username',
-        'immich_quota',
-        'immich_username',
-        'immich_role',
-      ],
-    },
-    features: {
-      jwtUserinfo: {
-        enabled: true,
-      },
-    },
-    cookies: {
-      names: {
-        session: 'oidc.session',
-        interaction: 'oidc.interaction',
-        resume: 'oidc.resume',
-        state: 'oidc.state',
-      },
-    },
-    pkce: {
-      required: () => false,
-    },
-    jwks: { keys: [await exportJWK(privateKey)] },
-    clients: [
-      {
-        client_id: OAuthClient.DEFAULT,
-        client_secret: OAuthClient.DEFAULT,
-        redirect_uris: redirectUris,
-        grant_types: ['authorization_code'],
-        response_types: ['code'],
-      },
-      {
-        client_id: OAuthClient.RS256_TOKENS,
-        client_secret: OAuthClient.RS256_TOKENS,
-        redirect_uris: redirectUris,
-        grant_types: ['authorization_code'],
-        id_token_signed_response_alg: 'RS256',
-        jwks: { keys: [await exportJWK(publicKey)] },
-      },
-      {
-        client_id: OAuthClient.RS256_PROFILE,
-        client_secret: OAuthClient.RS256_PROFILE,
-        redirect_uris: redirectUris,
-        grant_types: ['authorization_code'],
-        userinfo_signed_response_alg: 'RS256',
-        jwks: { keys: [await exportJWK(publicKey)] },
-      },
-    ],
-  });
-
-  const onStart = () => console.log(`[auth-server] http://${host}:${port}/.well-known/openid-configuration`);
-  const app = oidc.listen(port, host, onStart);
-  return () => app.close();
-};
-
-export default setup;

e2e/vitest.config.ts

@@ -1,7 +1,7 @@
 import { defineConfig } from 'vitest/config';
 
 // skip `docker compose up` if `make e2e` was already run
-const globalSetup: string[] = ['src/setup/auth-server.ts'];
+const globalSetup: string[] = [];
 try {
   await fetch('http://127.0.0.1:2285/api/server-info/ping');
 } catch {