1d2467049d
Replace the hybrid flow (frontend PKCE + POST /auth/session token exchange, access token in sessionStorage) with a classic backend-driven BFF: the browser only ever navigates to GET /api/v1/auth/login and is redirected straight to the IdP; PKCE verifier/state live server-side in Redis (SessionStoreService); GET /api/v1/auth/callback (now the registered IdP redirect URI, replacing the frontend's /auth/callback route, which is deleted) verifies the id_token, JIT-provisions the user, creates a Redis-backed session, and sets one httpOnly SameSite=Lax cookie before redirecting into the app. No token material of any kind ever reaches the browser. OidcAuthGuard (per-request bearer JWT verification) is replaced by SessionAuthGuard (cookie -> Redis session lookup) across every controller that used it. cookie-parser is now wired into main.ts. Frontend AuthService shrinks to login()/logout()/ensureSessionChecked(); pkce.ts, auth.interceptor.ts, and the callback component/route are all removed as dead code under this model. New required env var: APP_BASE_URL (source of truth for the OIDC redirect_uri and the post-login redirect target). Verified end-to-end against the real API, Redis, and a mocked IdP: login redirect shape, callback cookie + redirect, state-replay rejection, /users/me 401<->200 around the cookie, and logout.
27 lines
1.1 KiB
Plaintext
27 lines
1.1 KiB
Plaintext
APP_HTTPS_PORT=443
|
|
IMAGE_TAG=local
|
|
REGISTRY=local
|
|
POSTGRES_IMAGE_TAG=18.4-alpine
|
|
REDIS_IMAGE_TAG=8.8.1-alpine
|
|
POSTGRES_DB=travel_planner
|
|
POSTGRES_USER=travel_planner
|
|
POSTGRES_PASSWORD=change-me-outside-source-control
|
|
DATABASE_URL=postgresql://travel_planner:change-me-outside-source-control@postgres:5432/travel_planner
|
|
REDIS_URL=redis://redis:6379
|
|
APP_VERSION=dev
|
|
TEAMCITY_BUILD_NUMBER=local
|
|
SOURCE_REVISION=local
|
|
TLS_CERT_FILE=/etc/travel-planner/tls/tls.crt
|
|
TLS_KEY_FILE=/etc/travel-planner/tls/tls.key
|
|
OIDC_ISSUER=https://idp.example.invalid/realms/travel-planner
|
|
OIDC_AUDIENCE=travel-planner-api
|
|
OIDC_CLIENT_ID=travel-planner-web
|
|
# OIDC_CLIENT_SECRET: this client is confidential (holds a secret). Never commit
|
|
# a real value here; supply it only via the deployment host's secret store /
|
|
# the developer's own shell environment.
|
|
OIDC_CLIENT_SECRET=change-me-outside-source-control
|
|
# APP_BASE_URL: the public origin end users load the app from (used to build the
|
|
# OIDC redirect_uri and the post-login redirect target). Must match a redirect
|
|
# URI registered with the IdP client, e.g. https://travel-planner.example.com
|
|
APP_BASE_URL=http://localhost:4200
|