bastian/travel-planner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: fully backend-driven OIDC session flow (session cookie, not bearer token)

Browse Source 
Replace the hybrid flow (frontend PKCE + POST /auth/session token
exchange, access token in sessionStorage) with a classic backend-driven
BFF: the browser only ever navigates to GET /api/v1/auth/login and is
redirected straight to the IdP; PKCE verifier/state live server-side in
Redis (SessionStoreService); GET /api/v1/auth/callback (now the
registered IdP redirect URI, replacing the frontend's /auth/callback
route, which is deleted) verifies the id_token, JIT-provisions the
user, creates a Redis-backed session, and sets one httpOnly SameSite=Lax
cookie before redirecting into the app. No token material of any kind
ever reaches the browser.

OidcAuthGuard (per-request bearer JWT verification) is replaced by
SessionAuthGuard (cookie -> Redis session lookup) across every
controller that used it. cookie-parser is now wired into main.ts.

Frontend AuthService shrinks to login()/logout()/ensureSessionChecked();
pkce.ts, auth.interceptor.ts, and the callback component/route are all
removed as dead code under this model.

New required env var: APP_BASE_URL (source of truth for the OIDC
redirect_uri and the post-login redirect target).

Verified end-to-end against the real API, Redis, and a mocked IdP:
login redirect shape, callback cookie + redirect, state-replay
rejection, /users/me 401<->200 around the cookie, and logout.
This commit is contained in:
Bastian Wagner
2026-08-17 17:33:55 +02:00
parent 4aca6b64a0
commit 1d2467049d
58 changed files with 936 additions and 574 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
backend/apps/api/src/trips/trip-invitations.controller.ts
View File

@@ -7,8 +7,8 @@ import {
Post,
UseGuards,
} from '@nestjs/common';
import { OidcAuthGuard } from '../../../../libs/auth/src';
import type { AuthenticatedUser } from '../../../../libs/auth/src';
import { SessionAuthGuard } from '../../../../libs/auth/src';
import type { SessionUser } from '../../../../libs/auth/src';
import {
TripInvitationsService,
TripMembershipGuard,
@@ -26,11 +26,11 @@ export class TripInvitationsController {
constructor(private readonly invitationsService: TripInvitationsService) {}
@Post('trips/:tripId/invitations')
@UseGuards(OidcAuthGuard, TripMembershipGuard)
@UseGuards(SessionAuthGuard, TripMembershipGuard)
@TripRoles('OWNER')
create(
@Param('tripId') tripId: string,
@CurrentUser() currentUser: AuthenticatedUser,
@CurrentUser() currentUser: SessionUser,
@Body() dto: CreateTripInvitationDto,
): Promise<{ invitation: TripInvitation; rawToken: string }> {
return this.invitationsService.createInvitation(
@@ -41,14 +41,14 @@ export class TripInvitationsController {
}
@Get('trips/:tripId/invitations')
@UseGuards(OidcAuthGuard, TripMembershipGuard)
@UseGuards(SessionAuthGuard, TripMembershipGuard)
@TripRoles('OWNER')
list(@Param('tripId') tripId: string): Promise<TripInvitation[]> {
return this.invitationsService.listInvitations(tripId);
}
@Delete('trips/:tripId/invitations/:invitationId')
@UseGuards(OidcAuthGuard, TripMembershipGuard)
@UseGuards(SessionAuthGuard, TripMembershipGuard)
@TripRoles('OWNER')
remove(
@Param('tripId') tripId: string,
@@ -58,10 +58,10 @@ export class TripInvitationsController {
}
@Post('invitations/:token/accept')
@UseGuards(OidcAuthGuard)
@UseGuards(SessionAuthGuard)
accept(
@Param('token') token: string,
@CurrentUser() currentUser: AuthenticatedUser,
@CurrentUser() currentUser: SessionUser,
): Promise<TripMember> {
return this.invitationsService.acceptInvitation(token, currentUser.id);
}