1d2467049d
Replace the hybrid flow (frontend PKCE + POST /auth/session token exchange, access token in sessionStorage) with a classic backend-driven BFF: the browser only ever navigates to GET /api/v1/auth/login and is redirected straight to the IdP; PKCE verifier/state live server-side in Redis (SessionStoreService); GET /api/v1/auth/callback (now the registered IdP redirect URI, replacing the frontend's /auth/callback route, which is deleted) verifies the id_token, JIT-provisions the user, creates a Redis-backed session, and sets one httpOnly SameSite=Lax cookie before redirecting into the app. No token material of any kind ever reaches the browser. OidcAuthGuard (per-request bearer JWT verification) is replaced by SessionAuthGuard (cookie -> Redis session lookup) across every controller that used it. cookie-parser is now wired into main.ts. Frontend AuthService shrinks to login()/logout()/ensureSessionChecked(); pkce.ts, auth.interceptor.ts, and the callback component/route are all removed as dead code under this model. New required env var: APP_BASE_URL (source of truth for the OIDC redirect_uri and the post-login redirect target). Verified end-to-end against the real API, Redis, and a mocked IdP: login redirect shape, callback cookie + redirect, state-replay rejection, /users/me 401<->200 around the cookie, and logout.
113 lines
3.1 KiB
YAML
113 lines
3.1 KiB
YAML
services:
|
|
edge:
|
|
image: "${REGISTRY}/travel-edge:${IMAGE_TAG}"
|
|
build:
|
|
context: .
|
|
dockerfile: docker/edge.Dockerfile
|
|
args:
|
|
OIDC_ISSUER: "${OIDC_ISSUER}"
|
|
OIDC_CLIENT_ID: "${OIDC_CLIENT_ID}"
|
|
ports:
|
|
- "${APP_HTTPS_PORT:-443}:443"
|
|
volumes:
|
|
- "${TLS_CERT_FILE}:/run/tls/tls.crt:ro"
|
|
- "${TLS_KEY_FILE}:/run/tls/tls.key:ro"
|
|
depends_on:
|
|
api:
|
|
condition: service_healthy
|
|
networks: [travel]
|
|
restart: unless-stopped
|
|
|
|
api:
|
|
image: "${REGISTRY}/travel-api:${IMAGE_TAG}"
|
|
build:
|
|
context: .
|
|
dockerfile: docker/api.Dockerfile
|
|
expose:
|
|
- "3000"
|
|
environment:
|
|
DATABASE_URL: "postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}"
|
|
REDIS_URL: "redis://redis:6379"
|
|
OIDC_ISSUER: "${OIDC_ISSUER}"
|
|
OIDC_AUDIENCE: "${OIDC_AUDIENCE}"
|
|
OIDC_CLIENT_ID: "${OIDC_CLIENT_ID}"
|
|
OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}"
|
|
APP_BASE_URL: "${APP_BASE_URL}"
|
|
APP_VERSION: "${APP_VERSION:-dev}"
|
|
TEAMCITY_BUILD_NUMBER: "${TEAMCITY_BUILD_NUMBER:-local}"
|
|
SOURCE_REVISION: "${SOURCE_REVISION:-local}"
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "node -e \"fetch('http://127.0.0.1:3000/health/ready').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 20
|
|
start_period: 10s
|
|
networks: [travel]
|
|
restart: unless-stopped
|
|
|
|
worker:
|
|
image: "${REGISTRY}/travel-worker:${IMAGE_TAG}"
|
|
build:
|
|
context: .
|
|
dockerfile: docker/worker.Dockerfile
|
|
environment:
|
|
DATABASE_URL: "postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}"
|
|
REDIS_URL: "redis://redis:6379"
|
|
OIDC_ISSUER: "${OIDC_ISSUER}"
|
|
OIDC_AUDIENCE: "${OIDC_AUDIENCE}"
|
|
OIDC_CLIENT_ID: "${OIDC_CLIENT_ID}"
|
|
OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}"
|
|
APP_BASE_URL: "${APP_BASE_URL}"
|
|
APP_VERSION: "${APP_VERSION:-dev}"
|
|
TEAMCITY_BUILD_NUMBER: "${TEAMCITY_BUILD_NUMBER:-local}"
|
|
SOURCE_REVISION: "${SOURCE_REVISION:-local}"
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
networks: [travel]
|
|
restart: unless-stopped
|
|
|
|
postgres:
|
|
image: "postgres:${POSTGRES_IMAGE_TAG:-18.4-alpine}"
|
|
environment:
|
|
POSTGRES_DB: "${POSTGRES_DB}"
|
|
POSTGRES_USER: "${POSTGRES_USER}"
|
|
POSTGRES_PASSWORD: "${POSTGRES_PASSWORD}"
|
|
expose:
|
|
- "5432"
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 20
|
|
networks: [travel]
|
|
restart: unless-stopped
|
|
|
|
redis:
|
|
image: "redis:${REDIS_IMAGE_TAG:-8.8.1-alpine}"
|
|
expose:
|
|
- "6379"
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 20
|
|
networks: [travel]
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
postgres_data:
|
|
|
|
networks:
|
|
travel:
|
|
driver: bridge
|