feat(publisher): authenticate with drupal

README.md

@@ -113,6 +113,51 @@ lagoon runtime configuration.
 lagoon add variable -p [project name] -e dev -N NETLIFY_SITE_ID -V [netlify site id]
 ```
 
+### Publisher authentication with Drupal
+
+Publisher access can require to authenticate with Drupal with OAuth2.
+To fully skip it, set this environment variable.
+
+```
+PUBLISHER_SKIP_AUTHENTICATION=true
+```
+
+#### Drupal configuration
+
+##### Check the hash salt
+
+It must be at least 32 chars long. See `DRUPAL_HASH_SALT` environment variable.
+
+##### Create Certificates
+
+Per environment.
+
+- Go to `/admin/config/people/simple_oauth`
+- Generate keys, set the directory to `../keys` 
+- Keys are gitignored
+
+##### Create Consumers
+
+Per environment, as Consumers are content entities.
+
+- Go to `/admin/config/services/consumer`
+- Delete the default Consumer
+- Create a Consumer 
+  - Label: `Publisher`
+  - Client ID: `publisher`
+  - Secret: a random string
+  - Redirect URI: `[publisher-url]/oauth/callback`
+  - Scope: `Publisher`
+
+##### Set the Access Publisher permission
+
+Add this permission to relevant roles.
+
+#### Publisher configuration
+
+Configure [website environment variables](./apps/website/.lagoon.env) based
+on Drupal configuration.
+
 ## Storybook
 
 If a `CHROMATIC_PROJECT_TOKEN` environment variable is set, the Storybook build

apps/cms/.gitignore

@@ -28,3 +28,6 @@ generated/operations.json
 
 # Translations from the FE
 generated/translations.json
+
+# OAuth2
+keys/*.key

apps/cms/composer.json

@@ -68,6 +68,7 @@
     "drupal/redirect": "^1.7",
     "drupal/reroute_email": "^2.2",
     "drupal/role_delegation": "^1.2",
+    "drupal/simple_oauth": "^5.2",
     "drupal/slack": "^1.4",
     "drupal/stage_file_proxy": "^2.0",
     "drupal/userprotect": "^1.2",
@@ -91,6 +92,9 @@
   },
   "extra": {
     "patches": {
+      "drupal/core": {
+        "#2706241 AccessAwareRouter does not respect HTTP method": "https://www.drupal.org/files/issues/2023-03-17/2706241-74.patch"
+      },
       "drupal/masquerade": {
         "#915756 Add masquerade to admin menu": "https://www.drupal.org/files/issues/2023-06-22/915756-15.patch"
       },