981cecbcbd
The provisioned IdP client (https://auth.forgecore.work) is confidential rather than public/PKCE-only, so a client secret must never reach the browser. The frontend now only performs the Authorization Code + PKCE redirect itself (hand-rolled PKCE, oidc-client-ts dependency removed) and hands the resulting code + verifier to a new, intentionally unauthenticated POST /api/v1/auth/session endpoint, which performs the code-for-tokens exchange server-side using OIDC_CLIENT_SECRET and returns only {accessToken, expiresIn} — refresh_token/id_token are never forwarded to the client. New required backend env vars: OIDC_CLIENT_ID, OIDC_CLIENT_SECRET. Added frontend/proxy.conf.json so the Angular dev server forwards /api and /health to the local API without needing CORS.
16 lines
572 B
TypeScript
16 lines
572 B
TypeScript
import { Body, Controller, Post } from '@nestjs/common';
|
|
import { TokenExchangeService } from '../../../../libs/auth/src';
|
|
import type { AuthorizationCodeExchangeRequest, AuthorizationCodeExchangeResult } from '../../../../libs/auth/src';
|
|
|
|
@Controller('auth')
|
|
export class AuthSessionController {
|
|
constructor(private readonly tokenExchange: TokenExchangeService) {}
|
|
|
|
@Post('session')
|
|
createSession(
|
|
@Body() dto: AuthorizationCodeExchangeRequest,
|
|
): Promise<AuthorizationCodeExchangeResult> {
|
|
return this.tokenExchange.exchangeAuthorizationCode(dto);
|
|
}
|
|
}
|