Admin
e7e854959f
Add Authorization Code + PKCE login/logout against Zitadel, handled entirely server-side with an httpOnly signed session cookie: - $lib/server/auth: openid-client discovery (config cached), jose-signed session encode/decode, cookie/name constants - routes: /login (builds the authorize URL with PKCE/state/nonce, ?mode=register -> prompt=create), /auth/callback (code exchange + session cookie), /logout (clears session + Zitadel end_session) - hooks.server populates locals.user/accessToken from the session - +layout.server exposes the user; Navbar shows the signed-in user + Salir, or Iniciar sesión / Registrarse - switch to adapter-node; env-driven config (.env gitignored, .env.example committed) with issuer http://host.docker.internal:8080 Verified: svelte-check + build clean; dev smoke test shows the landing in the logged-out state and /login issuing a 302 to Zitadel's authorize endpoint with PKCE/state/nonce (discovery reachable). Real client id/secret still needed to complete the token exchange.
15 lines
545 B
Bash
15 lines
545 B
Bash
# Zitadel OIDC (server-side auth)
|
|
ZITADEL_ISSUER=http://host.docker.internal:8080
|
|
ZITADEL_CLIENT_ID=your-web-app-client-id
|
|
ZITADEL_CLIENT_SECRET=your-web-app-client-secret
|
|
|
|
# Where Zitadel redirects back after login (must be registered in the app)
|
|
AUTH_REDIRECT_URI=http://localhost:5173/auth/callback
|
|
AUTH_POST_LOGOUT_URI=http://localhost:5173/
|
|
|
|
# Secret used to sign the session cookie (any long random string)
|
|
SESSION_SECRET=change-me-to-a-long-random-string
|
|
|
|
# Backend API base URL (used from later parts)
|
|
API_BASE_URL=http://localhost:5111
|