Admin/template-studio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refine: update server/auth.js

Browse Source
This commit is contained in:
Admin 2026-09-23 02:59:20 +00:00
parent 13d054fcc9
commit 4fdcc9b031
1 changed files with 28 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
server/auth.js
View File

@ -10,7 +10,11 @@ function config() {
issuer: process.env.KEYCLOAK_ISSUER?.replace(/\/$/, '') || '', issuer: process.env.KEYCLOAK_ISSUER?.replace(/\/$/, '') || '',
clientId: process.env.KEYCLOAK_CLIENT_ID || '', clientId: process.env.KEYCLOAK_CLIENT_ID || '',
clientSecret: process.env.KEYCLOAK_CLIENT_SECRET || '', clientSecret: process.env.KEYCLOAK_CLIENT_SECRET || '',
baseUrl: process.env.APP_BASE_URL?.replace(/\/$/, '') || '' baseUrl: process.env.APP_BASE_URL?.replace(/\/$/, '') || '',
allowedApiClients: String(process.env.TEMPLATE_API_ALLOWED_CLIENTS || '')
.split(',')
.map(value => value.trim())
.filter(Boolean)
} }
} }
@ -69,9 +73,14 @@ function redirectUri(req) {
return `${proto}://${req.get('host')}/auth/callback` return `${proto}://${req.get('host')}/auth/callback`
} }
function readSession(req) { export function readSession(req) {
if (!authRequired()) { if (!authRequired()) {
return { sub: 'local-dev', preferred_username: 'local-dev', name: 'Local developer', exp: Math.floor(Date.now() / 1000) + 3600 } return {
sub: 'local-dev',
preferred_username: 'local-dev',
name: 'Local developer',
exp: Math.floor(Date.now() / 1000) + 3600
}
} }
const session = unpack(parseCookies(req)[SESSION_COOKIE], 'session') const session = unpack(parseCookies(req)[SESSION_COOKIE], 'session')
if (!session || Number(session.exp || 0) <= Math.floor(Date.now() / 1000)) return null if (!session || Number(session.exp || 0) <= Math.floor(Date.now() / 1000)) return null
@ -83,6 +92,22 @@ function ensureConfigured() {
if (!issuer || !clientId || !clientSecret) throw new Error('Keycloak OIDC is not fully configured') if (!issuer || !clientId || !clientSecret) throw new Error('Keycloak OIDC is not fully configured')
} }
export async function verifyMachineToken(token) {
const { issuer, allowedApiClients } = config()
if (!issuer) throw new Error('KEYCLOAK_ISSUER is required')
if (!allowedApiClients.length) throw new Error('No API clients are allowed')
jwks ||= createRemoteJWKSet(new URL(`${issuer}/protocol/openid-connect/certs`))
const { payload } = await jwtVerify(token, jwks, { issuer })
const audiences = Array.isArray(payload.aud) ? payload.aud : [payload.aud].filter(Boolean)
const client = String(payload.azp || '')
const allowed = allowedApiClients.some(value => value === client || audiences.includes(value))
if (!allowed) throw new Error('Token client is not allowed to consume templates')
return payload
}
export function registerAuthRoutes(app) { export function registerAuthRoutes(app) {
app.get('/auth/login', (req, res, next) => { app.get('/auth/login', (req, res, next) => {
try { try {