feat: support self-hosted ory via kratos admin url

Author: drankou

scripts/check-app-env.ts

@@ -5,16 +5,25 @@ import { clientSchema, serverSchema, validateEnv } from '../src/lib/env'
 const projectDir = process.cwd()
 loadEnvConfig(projectDir)
 
+// Always required when AUTH_PROVIDER=ory, regardless of deploy target.
 const oryRequiredEnvVars = [
   'AUTH_SECRET',
   'ORY_SDK_URL',
   'ORY_OAUTH2_CLIENT_ID',
   'ORY_OAUTH2_CLIENT_SECRET',
   'ORY_OAUTH2_AUDIENCE',
-  'ORY_PROJECT_API_TOKEN',
   'DASHBOARD_API_ADMIN_TOKEN',
 ] as const
 
+// Identity admin surface: pick exactly one.
+//   - ORY_PROJECT_API_TOKEN: Ory Network. Bearer for the unified SDK host.
+//   - ORY_KRATOS_ADMIN_URL:  self-hosted Kratos admin (gated by network).
+// At least one must be set so IdentityApi calls can resolve.
+const oryIdentityAdminEnvVars = [
+  'ORY_PROJECT_API_TOKEN',
+  'ORY_KRATOS_ADMIN_URL',
+] as const
+
 const schema = serverSchema
   .merge(clientSchema)
   .refine(
@@ -81,6 +90,17 @@ const schema = serverSchema
         path: ['AUTH_PROVIDER'],
       })
     }
+
+    const hasIdentityAdmin = oryIdentityAdminEnvVars.some(
+      (envVar) => !!data[envVar]
+    )
+    if (!hasIdentityAdmin) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: `AUTH_PROVIDER=ory requires either ${oryIdentityAdminEnvVars.join(' (Ory Network) or ')} (self-hosted Kratos admin)`,
+        path: ['AUTH_PROVIDER'],
+      })
+    }
   })
 
 validateEnv(schema)

src/core/server/auth/ory/client.ts

@@ -5,12 +5,19 @@ import { Configuration, IdentityApi, OAuth2Api } from '@ory/client-fetch'
 let cachedIdentityApi: IdentityApi | null = null
 let cachedOAuth2Api: OAuth2Api | null = null
 
-// the IdentityApi requires the Ory project admin token (PAT). callers should
-// ensure ORY_PROJECT_API_TOKEN is set at deploy time when AUTH_PROVIDER=ory.
+// IdentityApi resolution:
+//   1. ORY_KRATOS_ADMIN_URL — self-hosted Kratos admin (e.g. local devenv :4434).
+//   2. ORY_SDK_URL          — Ory Network (identity admin co-located on the SDK host).
+//
+// The PAT is attached only when configured: Ory Network gates on it,
+// self-hosted Kratos admin uses network reachability instead.
 export function getOryIdentityApi(): IdentityApi {
   if (cachedIdentityApi) return cachedIdentityApi
 
-  cachedIdentityApi = new IdentityApi(getOryConfiguration())
+  cachedIdentityApi = new IdentityApi(
+    getOryConfiguration(process.env.ORY_KRATOS_ADMIN_URL)
+  )
+
   return cachedIdentityApi
 }
 
@@ -21,19 +28,17 @@ export function getOryOAuth2Api(): OAuth2Api {
   return cachedOAuth2Api
 }
 
-function getOryConfiguration(): Configuration {
-  const basePath = process.env.ORY_SDK_URL
-  const accessToken = process.env.ORY_PROJECT_API_TOKEN
+function getOryConfiguration(basePathOverride?: string): Configuration {
+  const basePath = basePathOverride ?? process.env.ORY_SDK_URL
 
   if (!basePath) {
     throw new Error('ORY_SDK_URL is not configured')
   }
-  if (!accessToken) {
-    throw new Error('ORY_PROJECT_API_TOKEN is not configured')
-  }
+
+  const accessToken = process.env.ORY_PROJECT_API_TOKEN
 
   return new Configuration({
     basePath: basePath.replace(/\/$/, ''),
-    accessToken,
+    ...(accessToken ? { accessToken } : {}),
   })
 }

src/lib/env.ts

@@ -22,6 +22,7 @@ export const serverSchema = z.object({
   ORY_OAUTH2_CLIENT_SECRET: z.string().min(1).optional(),
   ORY_OAUTH2_AUDIENCE: z.string().min(1).optional(),
   ORY_PROJECT_API_TOKEN: z.string().min(1).optional(),
+  ORY_KRATOS_ADMIN_URL: z.url().optional(),
 
   OTEL_SERVICE_NAME: z.string().optional(),
   OTEL_EXPORTER_OTLP_ENDPOINT: z.url().optional(),