981cecbcbd
The provisioned IdP client (https://auth.forgecore.work) is confidential rather than public/PKCE-only, so a client secret must never reach the browser. The frontend now only performs the Authorization Code + PKCE redirect itself (hand-rolled PKCE, oidc-client-ts dependency removed) and hands the resulting code + verifier to a new, intentionally unauthenticated POST /api/v1/auth/session endpoint, which performs the code-for-tokens exchange server-side using OIDC_CLIENT_SECRET and returns only {accessToken, expiresIn} — refresh_token/id_token are never forwarded to the client. New required backend env vars: OIDC_CLIENT_ID, OIDC_CLIENT_SECRET. Added frontend/proxy.conf.json so the Angular dev server forwards /api and /health to the local API without needing CORS.
23 lines
886 B
Plaintext
23 lines
886 B
Plaintext
APP_HTTPS_PORT=443
|
|
IMAGE_TAG=local
|
|
REGISTRY=local
|
|
POSTGRES_IMAGE_TAG=18.4-alpine
|
|
REDIS_IMAGE_TAG=8.8.1-alpine
|
|
POSTGRES_DB=travel_planner
|
|
POSTGRES_USER=travel_planner
|
|
POSTGRES_PASSWORD=change-me-outside-source-control
|
|
DATABASE_URL=postgresql://travel_planner:change-me-outside-source-control@postgres:5432/travel_planner
|
|
REDIS_URL=redis://redis:6379
|
|
APP_VERSION=dev
|
|
TEAMCITY_BUILD_NUMBER=local
|
|
SOURCE_REVISION=local
|
|
TLS_CERT_FILE=/etc/travel-planner/tls/tls.crt
|
|
TLS_KEY_FILE=/etc/travel-planner/tls/tls.key
|
|
OIDC_ISSUER=https://idp.example.invalid/realms/travel-planner
|
|
OIDC_AUDIENCE=travel-planner-api
|
|
OIDC_CLIENT_ID=travel-planner-web
|
|
# OIDC_CLIENT_SECRET: this client is confidential (holds a secret). Never commit
|
|
# a real value here; supply it only via the deployment host's secret store /
|
|
# the developer's own shell environment.
|
|
OIDC_CLIENT_SECRET=change-me-outside-source-control
|