1d2467049d
Replace the hybrid flow (frontend PKCE + POST /auth/session token exchange, access token in sessionStorage) with a classic backend-driven BFF: the browser only ever navigates to GET /api/v1/auth/login and is redirected straight to the IdP; PKCE verifier/state live server-side in Redis (SessionStoreService); GET /api/v1/auth/callback (now the registered IdP redirect URI, replacing the frontend's /auth/callback route, which is deleted) verifies the id_token, JIT-provisions the user, creates a Redis-backed session, and sets one httpOnly SameSite=Lax cookie before redirecting into the app. No token material of any kind ever reaches the browser. OidcAuthGuard (per-request bearer JWT verification) is replaced by SessionAuthGuard (cookie -> Redis session lookup) across every controller that used it. cookie-parser is now wired into main.ts. Frontend AuthService shrinks to login()/logout()/ensureSessionChecked(); pkce.ts, auth.interceptor.ts, and the callback component/route are all removed as dead code under this model. New required env var: APP_BASE_URL (source of truth for the OIDC redirect_uri and the post-login redirect target). Verified end-to-end against the real API, Redis, and a mocked IdP: login redirect shape, callback cookie + redirect, state-replay rejection, /users/me 401<->200 around the cookie, and logout.
22 lines
613 B
TypeScript
22 lines
613 B
TypeScript
import { RequestMethod } from '@nestjs/common';
|
|
import { NestFactory } from '@nestjs/core';
|
|
import cookieParser from 'cookie-parser';
|
|
import { ApiModule } from './api.module';
|
|
|
|
export async function bootstrapApi(): Promise<void> {
|
|
const app = await NestFactory.create(ApiModule);
|
|
app.enableShutdownHooks();
|
|
app.use(cookieParser());
|
|
app.setGlobalPrefix('api/v1', {
|
|
exclude: [
|
|
{ path: 'health/live', method: RequestMethod.GET },
|
|
{ path: 'health/ready', method: RequestMethod.GET },
|
|
],
|
|
});
|
|
await app.listen(3000, '0.0.0.0');
|
|
}
|
|
|
|
if (require.main === module) {
|
|
void bootstrapApi();
|
|
}
|