Hanzo Dev
b81e6561fb
Re-implement the IAM-only rip on the re-rooted @hanzochat main (the old
auth/iam-only branch shares no history and is unmergeable). @hanzo/iam owns
every credential step via redirect-PKCE to hanzo.id; /auth/callback completes
the token exchange.
Client
- iam.ts: one always-configured IAM SDK singleton (env + prod defaults
hanzo.id / hanzo-chat), redirect_uri ${origin}/auth/callback
- Login.tsx: single "Log in with Hanzo" -> signinRedirect(); auto-redirect
on mount unless ?redirect=false
- drop LoginForm, Registration, ResetPassword, RequestPasswordReset,
SocialButton, SocialLoginRender (+ specs); drop the register / forgot /
reset routes
- GuestLimitDialog / LandingPage / login.ts: login = IAM signinRedirect
Server
- delete local + third-party passport strategies (local, apple, discord,
facebook, github, google, ldap, saml) and their specs
- keep jwt / openid / openidJwt strategies for IAM JWT validation
- socialLogins: Hanzo IAM (OpenID Connect) only
- auth routes: drop /login, /register, /requestPasswordReset, /resetPassword
- remove dead requireLocalAuth / requireLdapAuth middleware + LoginController
Build
- give the @hanzochat/api rollup enough heap (cross-env
NODE_OPTIONS=--max-old-space-size=8192) to fix the OOM exit 134
- raise the Dockerfile heap default to 8192 to match
62 lines
1.9 KiB
JavaScript
62 lines
1.9 KiB
JavaScript
// file deepcode ignore NoRateLimitingForLogin: `loginLimiter` is applied per-route to the IdP-initiation GETs (not the machine-driven /callback routes, which would break the OIDC code exchange)
|
|
const express = require('express');
|
|
const passport = require('passport');
|
|
const { randomState } = require('openid-client');
|
|
const { logger } = require('@hanzochat/data-schemas');
|
|
const { ErrorTypes } = require('@hanzochat/data-provider');
|
|
const { createSetBalanceConfig } = require('@hanzochat/api');
|
|
const { checkDomainAllowed, loginLimiter, logHeaders } = require('~/server/middleware');
|
|
const { createOAuthHandler } = require('~/server/controllers/auth/oauth');
|
|
const { getAppConfig } = require('~/server/services/Config');
|
|
const { Balance } = require('~/db/models');
|
|
|
|
const setBalanceConfig = createSetBalanceConfig({
|
|
getAppConfig,
|
|
Balance,
|
|
});
|
|
|
|
const router = express.Router();
|
|
|
|
const domains = {
|
|
client: process.env.DOMAIN_CLIENT,
|
|
server: process.env.DOMAIN_SERVER,
|
|
};
|
|
|
|
router.use(logHeaders);
|
|
|
|
const oauthHandler = createOAuthHandler();
|
|
|
|
router.get('/error', (req, res) => {
|
|
/** A single error message is pushed by passport when authentication fails. */
|
|
const errorMessage = req.session?.messages?.pop() || 'Unknown OAuth error';
|
|
logger.error('Error in OAuth authentication:', {
|
|
message: errorMessage,
|
|
});
|
|
|
|
res.redirect(`${domains.client}/login?redirect=false&error=${ErrorTypes.AUTH_FAILED}`);
|
|
});
|
|
|
|
/**
|
|
* Hanzo IAM (OpenID Connect) Routes
|
|
*/
|
|
router.get('/openid', loginLimiter, (req, res, next) => {
|
|
return passport.authenticate('openid', {
|
|
session: false,
|
|
state: randomState(),
|
|
})(req, res, next);
|
|
});
|
|
|
|
router.get(
|
|
'/openid/callback',
|
|
passport.authenticate('openid', {
|
|
failureRedirect: `${domains.client}/oauth/error`,
|
|
failureMessage: true,
|
|
session: false,
|
|
}),
|
|
setBalanceConfig,
|
|
checkDomainAllowed,
|
|
oauthHandler,
|
|
);
|
|
|
|
module.exports = router;
|