Lucas Berger
668ed9be0d
- src/auth/middleware.ts: re-exports oidcAuthMiddleware, processOAuthCallback,
getAuth from @hono/oidc-auth; documents required env vars and AUTH-02
refresh-token rotation (no iframe, D-12)
- src/routes/me.ts: GET / calls getAuth → upsertUser(iss, sub, email) →
returns { user: { id, displayName, color } }; identity keyed on iss+sub
- src/index.ts: /callback registered before oidcAuthMiddleware; /api/*
guarded; /health remains unauthenticated; /api/me mounted
- apps/pwa/src/api/client.ts: typed fetchMe() with credentials: 'include'
- apps/pwa/src/App.tsx: useQuery(['me'], fetchMe); renders member name and
color swatch; retains /health stack indicator from Plan 01
- tsc --noEmit: clean; all tests pass
27 lines
1.3 KiB
TypeScript
27 lines
1.3 KiB
TypeScript
/**
|
|
* OIDC authentication middleware wiring.
|
|
*
|
|
* Configures @hono/oidc-auth for Authelia as the identity provider.
|
|
*
|
|
* Required env vars:
|
|
* OIDC_AUTH_SECRET — 32+ char random string for JWT cookie signing (T-02-03)
|
|
* OIDC_ISSUER — Authelia base URL (middleware fetches /.well-known/openid-configuration)
|
|
* OIDC_CLIENT_ID — registered client ID in Authelia
|
|
* OIDC_CLIENT_SECRET — PLAIN text secret (NOT the pbkdf2 hash — see Pitfall 7)
|
|
* OIDC_REDIRECT_URI — https://familysync.<domain>/callback
|
|
* OIDC_AUTH_EXTERNAL_URL — https://familysync.<domain> — MANDATORY behind Pangolin (Pitfall 1)
|
|
*
|
|
* Session persistence (AUTH-02):
|
|
* @hono/oidc-auth stores the refresh token in the signed JWT cookie.
|
|
* Every OIDC_AUTH_REFRESH_INTERVAL (default 15 min) the middleware calls
|
|
* the token endpoint with the stored refresh token — no iframe required (D-12).
|
|
* Session lifespan is governed by OIDC_AUTH_EXPIRES (default 1 day) and
|
|
* Authelia's refresh_token_lifespan.
|
|
*
|
|
* Scopes: openid, profile, email only — no 'groups' scope (D-11).
|
|
*
|
|
* Source: https://github.com/honojs/middleware/tree/main/packages/oidc-auth
|
|
*/
|
|
|
|
export { oidcAuthMiddleware, processOAuthCallback, getAuth } from '@hono/oidc-auth'
|