Admin
e7e854959f
Add Authorization Code + PKCE login/logout against Zitadel, handled entirely server-side with an httpOnly signed session cookie: - $lib/server/auth: openid-client discovery (config cached), jose-signed session encode/decode, cookie/name constants - routes: /login (builds the authorize URL with PKCE/state/nonce, ?mode=register -> prompt=create), /auth/callback (code exchange + session cookie), /logout (clears session + Zitadel end_session) - hooks.server populates locals.user/accessToken from the session - +layout.server exposes the user; Navbar shows the signed-in user + Salir, or Iniciar sesión / Registrarse - switch to adapter-node; env-driven config (.env gitignored, .env.example committed) with issuer http://host.docker.internal:8080 Verified: svelte-check + build clean; dev smoke test shows the landing in the logged-out state and /login issuing a 302 to Zitadel's authorize endpoint with PKCE/state/nonce (discovery reachable). Real client id/secret still needed to complete the token exchange.
22 lines
585 B
TypeScript
22 lines
585 B
TypeScript
import type { Handle } from '@sveltejs/kit';
|
|
import { decodeSession, SESSION_COOKIE } from '$lib/server/auth';
|
|
|
|
export const handle: Handle = async ({ event, resolve }) => {
|
|
const session = await decodeSession(event.cookies.get(SESSION_COOKIE));
|
|
|
|
if (session && session.expiresAt * 1000 > Date.now()) {
|
|
event.locals.user = {
|
|
sub: session.sub,
|
|
name: session.name,
|
|
email: session.email,
|
|
picture: session.picture
|
|
};
|
|
event.locals.accessToken = session.accessToken;
|
|
} else {
|
|
event.locals.user = null;
|
|
event.locals.accessToken = null;
|
|
}
|
|
|
|
return resolve(event);
|
|
};
|