hrms-bangkok/hrms-edm
7
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

updated config

Browse source
This commit is contained in:
Warunee Tamkoo 2024-12-20 18:38:14 +07:00
parent e9287e8dd7
commit ea5988ee82
3 changed files with 28 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

10
Services/client/src/services/KeyCloakService.ts
View file

@ -1,6 +1,14 @@
import Keycloak from 'keycloak-js' import Keycloak from 'keycloak-js'
const keycloak = new Keycloak('/keycloak.json') const keycloakConfig = {
realm: import.meta.env.KC_REALMS,
'auth-server-url': import.meta.env.KC_URL,
'ssl-required': 'external',
resource: 'edm',
'public-client': true,
'confidential-port': 0,
}
const keycloak = new Keycloak(keycloakConfig)
let init = false let init = false

6
Services/server/.env.example
View file

@ -1,7 +1,7 @@
# Keycloak public key # Keycloak public key
PUBLIC_KEY=keycloak.public.key AUTH_PUBLIC_KEY=keycloak.public.key
REALM_URL=https://keycloak.local/realms/EDM AUTH_REALM_URL=https://keycloak.local/realms/EDM
PREFERRED_AUTH=online AUTH_PREFERRED_MODE=online
MANAGEMENT_ROLE=doc-management MANAGEMENT_ROLE=doc-management
# App port # App port
PORT=25570 PORT=25570

32
Services/server/src/utils/auth.ts
View file

@ -5,10 +5,10 @@ import HttpError from "../interfaces/http-error";
import HttpStatusCode from "../interfaces/http-status"; import HttpStatusCode from "../interfaces/http-status";
import { JwtPayload } from "jsonwebtoken"; import { JwtPayload } from "jsonwebtoken";
if (!process.env.PUBLIC_KEY && !process.env.REALM_URL) { if (!process.env.AUTH_PUBLIC_KEY && !process.env.AUTH_REALM_URL) {
throw new Error("Require public key or realm url."); throw new Error("Require public key or realm url.");
} }
if (process.env.PUBLIC_KEY && process.env.REALM_URL && !process.env.PREFERRED_AUTH) { if (process.env.AUTH_PUBLIC_KEY && process.env.AUTH_REALM_URL && !process.env.AUTH_PREFERRED_MODE) {
throw new Error("Preferred auth type must be specified if public key and realm url is provided."); throw new Error("Preferred auth type must be specified if public key and realm url is provided.");
} }
if (!process.env.MANAGEMENT_ROLE) { if (!process.env.MANAGEMENT_ROLE) {
@ -17,7 +17,7 @@ if (!process.env.MANAGEMENT_ROLE) {
const jwtVerify = createVerifier({ const jwtVerify = createVerifier({
key: async () => { key: async () => {
return `-----BEGIN PUBLIC KEY-----\n${process.env.PUBLIC_KEY}\n-----END PUBLIC KEY-----`; return `-----BEGIN PUBLIC KEY-----\n${process.env.AUTH_PUBLIC_KEY}\n-----END PUBLIC KEY-----`;
}, },
}); });
@ -42,7 +42,7 @@ export async function expressAuthentication(
let payload: JwtPayload = {}; let payload: JwtPayload = {};
switch (process.env.PREFERRED_AUTH) { switch (process.env.AUTH_PREFERRED_MODE) {
case "online": case "online":
payload = await verifyOnline(token); payload = await verifyOnline(token);
break; break;
@ -50,20 +50,20 @@ export async function expressAuthentication(
payload = await verifyOffline(token); payload = await verifyOffline(token);
break; break;
default: default:
if (process.env.REALM_URL) payload = await verifyOnline(token); if (process.env.AUTH_REALM_URL) payload = await verifyOnline(token);
if (process.env.PUBLIC_KEY) payload = await verifyOffline(token); if (process.env.AUTH_PUBLIC_KEY) payload = await verifyOffline(token);
break; break;
} }
if ( // if (
scopes && // scopes &&
scopes.length > 0 && // scopes.length > 0 &&
scopes // scopes
.map((v) => (v === "management-role" ? process.env.MANAGEMENT_ROLE : v)) // .map((v) => (v === "management-role" ? process.env.MANAGEMENT_ROLE : v))
.every((v) => !payload.role.includes(v)) // .every((v) => !payload.role.includes(v))
) { // ) {
throw new HttpError(HttpStatusCode.FORBIDDEN, "คุณไม่มีสิทธิในเข้าถึงข้อมูลนี้"); // throw new HttpError(HttpStatusCode.FORBIDDEN, "คุณไม่มีสิทธิในเข้าถึงข้อมูลนี้");
} // }
return payload; return payload;
} }
@ -75,7 +75,7 @@ async function verifyOffline(token: string) {
} }
async function verifyOnline(token: string) { async function verifyOnline(token: string) {
const res = await fetch(`${process.env.REALM_URL}/protocol/openid-connect/userinfo`, { const res = await fetch(`${process.env.AUTH_REALM_URL}/protocol/openid-connect/userinfo`, {
headers: { authorization: `Bearer ${token}` }, headers: { authorization: `Bearer ${token}` },
}).catch((e) => console.error(e)); }).catch((e) => console.error(e));