From b8f5ed50bac7530edab71b28732763361ec4171a Mon Sep 17 00:00:00 2001 From: Alexanderamiri Date: Fri, 23 Oct 2026 17:45:58 +0200 Subject: [PATCH 1/2] feat(auth): use platform public Cognito client with helter group gate - app.yaml auth: client public (PKCE, no secret), groups [helter], localhost:3000 callback/logout URLs for local dev, and auth.env aliases so the platform injects NUXT_PUBLIC_OIDC_CLIENT_ID and NUXT_PUBLIC_OIDC_AUTHORITY directly. - Drop entrypoint.sh (it duplicated that mapping); run node directly as the node user (uid 1000). - Remove offline_access from the requested scopes: Cognito does not support it and rejects the authorize request with invalid_scope. The code grant still returns a refresh token. Co-Authored-By: Claude Opus 5.5 (1M context) --- CLAUDE.md | 4 ++-- Dockerfile | 7 ++++--- README.md | 8 ++++---- app.yaml | 8 ++++++++ app/composables/useAuth.ts | 2 +- entrypoint.sh | 5 ----- 6 files changed, 19 insertions(+), 15 deletions(-) delete mode 100644 entrypoint.sh diff --git a/CLAUDE.md b/CLAUDE.md index 2c43fac..5e30f50 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -54,8 +54,8 @@ There are no unit tests in this project. |----------|---------|-------------| | `CUPCAKE_BACKEND` | `http://127.0.0.1:8080` (dev) / `https://cupcake-backend.java.no` (prod) | Backend URL for server-side proxy | | `CUPCAKE_FRONTEND` | `localhost` | Hostname for Vite `allowedHosts` | -| `NUXT_PUBLIC_OIDC_AUTHORITY` | `https://auth.home.chrissearle.org/realms/HA12` | Keycloak realm URL | -| `NUXT_PUBLIC_OIDC_CLIENT_ID` | `cupcake-client` | OIDC client ID | +| `NUXT_PUBLIC_OIDC_AUTHORITY` | Cognito internal pool issuer | OIDC issuer URL | +| `NUXT_PUBLIC_OIDC_CLIENT_ID` | empty | OIDC client ID | For local dev against the Cupcake backend with `JWT_ENABLED=false`, no OIDC config overrides are needed. diff --git a/Dockerfile b/Dockerfile index bf9af1d..52cc105 100644 --- a/Dockerfile +++ b/Dockerfile @@ -23,8 +23,9 @@ ENV NODE_ENV=production WORKDIR /app COPY --from=build /app/.output ./ -COPY entrypoint.sh /entrypoint.sh -RUN chmod +x /entrypoint.sh -ENTRYPOINT ["/entrypoint.sh"] +# uid 1000 (node), matching the platform's compute.user default. +USER node + +CMD ["node", "/app/server/index.mjs"] diff --git a/README.md b/README.md index 036f677..4bf770a 100644 --- a/README.md +++ b/README.md @@ -41,7 +41,7 @@ pnpm dev The cupcake backend must be running locally unless you override `CUPCAKE_BACKEND`. With `JWT_ENABLED=false` on the backend, no auth configuration is needed. -The frontend OIDC defaults point to the development Keycloak realm, so no `NUXT_PUBLIC_OIDC_*` overrides are needed for local dev against that environment. +The frontend OIDC authority defaults to the Cognito internal pool. To log in locally, set `NUXT_PUBLIC_OIDC_CLIENT_ID` (see Configuration). ## Preview a production build @@ -65,10 +65,10 @@ ESLint and Prettier are also enforced via pre-commit hooks (lint-staged). | ---------------------------- | ---------------------------------------------------- | ------------------------------------------------------------------------ | | `CUPCAKE_BACKEND` | Backend base URL for the server-side proxy | `http://127.0.0.1:8080` (dev) / `https://cupcake-backend.java.no` (prod) | | `CUPCAKE_FRONTEND` | Hostname the dev server allows (Vite `allowedHosts`) | `localhost` | -| `NUXT_PUBLIC_OIDC_AUTHORITY` | OIDC authority URL (e.g. Keycloak realm URL) | `https://auth.home.chrissearle.org/realms/HA12` | -| `NUXT_PUBLIC_OIDC_CLIENT_ID` | OIDC client ID | `cupcake-client` | +| `NUXT_PUBLIC_OIDC_AUTHORITY` | OIDC authority (issuer) URL | Cognito internal pool issuer | +| `NUXT_PUBLIC_OIDC_CLIENT_ID` | OIDC client ID | empty | -`NUXT_PUBLIC_OIDC_AUTHORITY` and `NUXT_PUBLIC_OIDC_CLIENT_ID` must match the `OIDC_WELL_KNOWN_URL` and `OIDC_EXPECTED_AZP` values configured on the backend. +In the platform deployment both are injected via `auth.env` in `app.yaml` (aliases of `COGNITO_ISSUER_URL` and `COGNITO_CLIENT_ID` for the platform-created public Cognito client). For local login against Cognito, set `NUXT_PUBLIC_OIDC_CLIENT_ID` to that client ID; `http://localhost:3000/` is a registered callback. ## Proxy middleware diff --git a/app.yaml b/app.yaml index 1c0276e..8e5ab9b 100644 --- a/app.yaml +++ b/app.yaml @@ -13,11 +13,19 @@ routing: auth: pool: internal + client: public callback_urls: - https://cupcake.javazone.no/ - https://cupcake.javazone.no/auth/callback + - http://localhost:3000/ logout_urls: - https://cupcake.javazone.no/ + - http://localhost:3000/ + groups: + - helter + env: + COGNITO_CLIENT_ID: NUXT_PUBLIC_OIDC_CLIENT_ID + COGNITO_ISSUER_URL: NUXT_PUBLIC_OIDC_AUTHORITY environment: CUPCAKE_BACKEND: https://cupcake-backend.javazone.no diff --git a/app/composables/useAuth.ts b/app/composables/useAuth.ts index 4857b34..91bc639 100644 --- a/app/composables/useAuth.ts +++ b/app/composables/useAuth.ts @@ -36,7 +36,7 @@ function getUserManager(): UserManager { client_id: oidcClientId, redirect_uri: `${origin}/`, response_type: "code", - scope: "openid profile email offline_access", + scope: "openid profile email", userStore: new WebStorageStateStore({ store: window.sessionStorage }), automaticSilentRenew: false, loadUserInfo: false, diff --git a/entrypoint.sh b/entrypoint.sh deleted file mode 100644 index 9ade17c..0000000 --- a/entrypoint.sh +++ /dev/null @@ -1,5 +0,0 @@ -#!/bin/sh -set -e -export NUXT_PUBLIC_OIDC_AUTHORITY="${COGNITO_ISSUER_URL}" -export NUXT_PUBLIC_OIDC_CLIENT_ID="${COGNITO_CLIENT_ID}" -exec node /app/server/index.mjs From fb057e5a0488e33e6950955ef4c53ad5b90303d0 Mon Sep 17 00:00:00 2001 From: "javabin-platform[bot]" Date: Fri, 23 Oct 2026 16:08:12 +0000 Subject: [PATCH 2/2] [skip ci] Update generated Terraform from app.yaml --- terraform/main.tf | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/terraform/main.tf b/terraform/main.tf index cd862d1..c97d05b 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -4,6 +4,7 @@ module "platform" { project = "javabin" domain = "javazone.no" + team = "cupcake" } module "ecr" { @@ -34,12 +35,14 @@ module "routing" { module "auth" { source = "git::https://github.com/javaBin/platform//terraform/modules/cognito-app-client?ref=main" - app_name = "cupcake" - team = "cupcake" - pool = "internal" - callback_urls = ["https://cupcake.javazone.no/", "https://cupcake.javazone.no/auth/callback"] - logout_urls = ["https://cupcake.javazone.no/"] - project = "javabin" + app_name = "cupcake" + team = "cupcake" + pool = "internal" + client_type = "public" + project = "javabin" + callback_urls = ["https://cupcake.javazone.no/", "https://cupcake.javazone.no/auth/callback", "http://localhost:3000/"] + logout_urls = ["https://cupcake.javazone.no/", "http://localhost:3000/"] + allowed_groups = ["helter"] } module "task_role" { @@ -73,14 +76,17 @@ module "service" { readonly_root_filesystem = true target_group_arn = module.routing.target_group_arn environment = { - CUPCAKE_BACKEND = "https://cupcake-backend.javazone.no" - COGNITO_USER_POOL_ID = module.auth.user_pool_id - COGNITO_DOMAIN = module.auth.user_pool_domain - COGNITO_ISSUER_URL = module.auth.issuer_url + CUPCAKE_BACKEND = "https://cupcake-backend.javazone.no" + COGNITO_USER_POOL_ID = module.auth.user_pool_id + COGNITO_DOMAIN = module.auth.user_pool_domain + COGNITO_ISSUER_URL = module.auth.issuer_url + COGNITO_WELL_KNOWN_URL = module.auth.well_known_url + COGNITO_GROUPS = "helter" + NUXT_PUBLIC_OIDC_AUTHORITY = module.auth.issuer_url } secrets = { - COGNITO_CLIENT_ID = module.auth.client_id_arn - COGNITO_CLIENT_SECRET = module.auth.client_secret_arn + COGNITO_CLIENT_ID = module.auth.client_id_arn + NUXT_PUBLIC_OIDC_CLIENT_ID = module.auth.client_id_arn } }