1d2467049d
Replace the hybrid flow (frontend PKCE + POST /auth/session token exchange, access token in sessionStorage) with a classic backend-driven BFF: the browser only ever navigates to GET /api/v1/auth/login and is redirected straight to the IdP; PKCE verifier/state live server-side in Redis (SessionStoreService); GET /api/v1/auth/callback (now the registered IdP redirect URI, replacing the frontend's /auth/callback route, which is deleted) verifies the id_token, JIT-provisions the user, creates a Redis-backed session, and sets one httpOnly SameSite=Lax cookie before redirecting into the app. No token material of any kind ever reaches the browser. OidcAuthGuard (per-request bearer JWT verification) is replaced by SessionAuthGuard (cookie -> Redis session lookup) across every controller that used it. cookie-parser is now wired into main.ts. Frontend AuthService shrinks to login()/logout()/ensureSessionChecked(); pkce.ts, auth.interceptor.ts, and the callback component/route are all removed as dead code under this model. New required env var: APP_BASE_URL (source of truth for the OIDC redirect_uri and the post-login redirect target). Verified end-to-end against the real API, Redis, and a mocked IdP: login redirect shape, callback cookie + redirect, state-replay rejection, /users/me 401<->200 around the cookie, and logout.
88 lines
2.3 KiB
JSON
88 lines
2.3 KiB
JSON
{
|
|
"$schema": "./node_modules/@angular/cli/lib/config/schema.json",
|
|
"version": 1,
|
|
"cli": {
|
|
"packageManager": "npm",
|
|
"analytics": false
|
|
},
|
|
"newProjectRoot": "projects",
|
|
"projects": {
|
|
"frontend": {
|
|
"projectType": "application",
|
|
"schematics": {
|
|
"@schematics/angular:component": {
|
|
"style": "scss"
|
|
}
|
|
},
|
|
"root": "",
|
|
"sourceRoot": "src",
|
|
"prefix": "app",
|
|
"architect": {
|
|
"build": {
|
|
"builder": "@angular/build:application",
|
|
"options": {
|
|
"browser": "src/main.ts",
|
|
"tsConfig": "tsconfig.app.json",
|
|
"inlineStyleLanguage": "scss",
|
|
"assets": [
|
|
{
|
|
"glob": "**/*",
|
|
"input": "public"
|
|
}
|
|
],
|
|
"styles": ["src/styles.scss"]
|
|
},
|
|
"configurations": {
|
|
"production": {
|
|
"budgets": [
|
|
{
|
|
"type": "initial",
|
|
"maximumWarning": "500kB",
|
|
"maximumError": "1MB"
|
|
},
|
|
{
|
|
"type": "anyComponentStyle",
|
|
"maximumWarning": "4kB",
|
|
"maximumError": "8kB"
|
|
}
|
|
],
|
|
"outputHashing": "all",
|
|
"serviceWorker": "ngsw-config.json",
|
|
"fileReplacements": [
|
|
{
|
|
"replace": "src/environments/environment.ts",
|
|
"with": "src/environments/environment.production.ts"
|
|
}
|
|
]
|
|
},
|
|
"development": {
|
|
"optimization": false,
|
|
"extractLicenses": false,
|
|
"sourceMap": true
|
|
}
|
|
},
|
|
"defaultConfiguration": "production"
|
|
},
|
|
"serve": {
|
|
"builder": "@angular/build:dev-server",
|
|
"options": {
|
|
"proxyConfig": "proxy.conf.json"
|
|
},
|
|
"configurations": {
|
|
"production": {
|
|
"buildTarget": "frontend:build:production"
|
|
},
|
|
"development": {
|
|
"buildTarget": "frontend:build:development"
|
|
}
|
|
},
|
|
"defaultConfiguration": "development"
|
|
},
|
|
"test": {
|
|
"builder": "@angular/build:unit-test"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|