981cecbcbd
The provisioned IdP client (https://auth.forgecore.work) is confidential rather than public/PKCE-only, so a client secret must never reach the browser. The frontend now only performs the Authorization Code + PKCE redirect itself (hand-rolled PKCE, oidc-client-ts dependency removed) and hands the resulting code + verifier to a new, intentionally unauthenticated POST /api/v1/auth/session endpoint, which performs the code-for-tokens exchange server-side using OIDC_CLIENT_SECRET and returns only {accessToken, expiresIn} — refresh_token/id_token are never forwarded to the client. New required backend env vars: OIDC_CLIENT_ID, OIDC_CLIENT_SECRET. Added frontend/proxy.conf.json so the Angular dev server forwards /api and /health to the local API without needing CORS.
33 lines
792 B
JSON
33 lines
792 B
JSON
{
|
|
"name": "frontend",
|
|
"version": "0.0.0",
|
|
"scripts": {
|
|
"ng": "ng",
|
|
"start": "ng serve",
|
|
"build": "ng build",
|
|
"watch": "ng build --watch --configuration development",
|
|
"test": "ng test"
|
|
},
|
|
"private": true,
|
|
"dependencies": {
|
|
"@angular/common": "^21.2.0",
|
|
"@angular/compiler": "^21.2.0",
|
|
"@angular/core": "^21.2.0",
|
|
"@angular/forms": "^21.2.0",
|
|
"@angular/platform-browser": "^21.2.0",
|
|
"@angular/router": "^21.2.0",
|
|
"@angular/service-worker": "^21.2.0",
|
|
"rxjs": "~7.8.0",
|
|
"tslib": "^2.3.0"
|
|
},
|
|
"devDependencies": {
|
|
"@angular/build": "^21.2.6",
|
|
"@angular/cli": "^21.2.6",
|
|
"@angular/compiler-cli": "^21.2.0",
|
|
"jsdom": "^28.0.0",
|
|
"prettier": "^3.8.1",
|
|
"typescript": "~5.9.2",
|
|
"vitest": "^4.0.8"
|
|
}
|
|
}
|