Hanzo Dev
b81e6561fb
Re-implement the IAM-only rip on the re-rooted @hanzochat main (the old
auth/iam-only branch shares no history and is unmergeable). @hanzo/iam owns
every credential step via redirect-PKCE to hanzo.id; /auth/callback completes
the token exchange.
Client
- iam.ts: one always-configured IAM SDK singleton (env + prod defaults
hanzo.id / hanzo-chat), redirect_uri ${origin}/auth/callback
- Login.tsx: single "Log in with Hanzo" -> signinRedirect(); auto-redirect
on mount unless ?redirect=false
- drop LoginForm, Registration, ResetPassword, RequestPasswordReset,
SocialButton, SocialLoginRender (+ specs); drop the register / forgot /
reset routes
- GuestLimitDialog / LandingPage / login.ts: login = IAM signinRedirect
Server
- delete local + third-party passport strategies (local, apple, discord,
facebook, github, google, ldap, saml) and their specs
- keep jwt / openid / openidJwt strategies for IAM JWT validation
- socialLogins: Hanzo IAM (OpenID Connect) only
- auth routes: drop /login, /register, /requestPasswordReset, /resetPassword
- remove dead requireLocalAuth / requireLdapAuth middleware + LoginController
Build
- give the @hanzochat/api rollup enough heap (cross-env
NODE_OPTIONS=--max-old-space-size=8192) to fix the OOM exit 134
- raise the Dockerfile heap default to 8192 to match
35 lines
1.5 KiB
JavaScript
35 lines
1.5 KiB
JavaScript
const express = require('express');
|
|
const {
|
|
graphTokenController,
|
|
refreshController,
|
|
} = require('~/server/controllers/AuthController');
|
|
const {
|
|
regenerateBackupCodes,
|
|
disable2FA,
|
|
confirm2FA,
|
|
enable2FA,
|
|
verify2FA,
|
|
} = require('~/server/controllers/TwoFactorController');
|
|
const { verify2FAWithTempToken } = require('~/server/controllers/auth/TwoFactorAuthController');
|
|
const { logoutController } = require('~/server/controllers/auth/LogoutController');
|
|
const middleware = require('~/server/middleware');
|
|
|
|
const router = express.Router();
|
|
|
|
// Hanzo IAM (OpenID Connect) owns every credential step. The local
|
|
// email/password and third-party social login routes are intentionally
|
|
// absent; the only session-lifecycle routes kept here are logout, token
|
|
// refresh, 2FA and the graph token — all guarded by IAM-issued JWTs.
|
|
router.post('/logout', middleware.requireJwtAuth, logoutController);
|
|
router.post('/refresh', refreshController);
|
|
router.get('/2fa/enable', middleware.requireJwtAuth, enable2FA);
|
|
router.post('/2fa/verify', middleware.requireJwtAuth, verify2FA);
|
|
router.post('/2fa/verify-temp', middleware.checkBan, verify2FAWithTempToken);
|
|
router.post('/2fa/confirm', middleware.requireJwtAuth, confirm2FA);
|
|
router.post('/2fa/disable', middleware.requireJwtAuth, disable2FA);
|
|
router.post('/2fa/backup/regenerate', middleware.requireJwtAuth, regenerateBackupCodes);
|
|
|
|
router.get('/graph-token', middleware.requireJwtAuth, graphTokenController);
|
|
|
|
module.exports = router;
|