feat: migrate to authorization_code grant_type (#1986)

* feat: migrate to authorization_code grant_type * bump tweek-editor version
Soluto · Oct 25, 2022 · 1e619cb · 1e619cb
1 parent 0c4eaca
commit 1e619cb
Show file tree

Hide file tree

Showing 11 changed files with 25 additions and 17 deletions.
diff --git a/deployments/dev/docker-compose.e2e.yml b/deployments/dev/docker-compose.e2e.yml
@@ -46,7 +46,7 @@ services:
             "ClientId": "tweek-openid-mock-client",
             "Description": "Client for implicit flow",
             "AllowedGrantTypes": [
-                "implicit"
+                "authorization_code"
             ],
             "AllowAccessTokensViaBrowser": true,
             "RedirectUris": [
@@ -59,7 +59,9 @@ services:
                 "email"
             ],
             "IdentityTokenLifetime": 3600,
-            "AccessTokenLifetime": 3600
+            "AccessTokenLifetime": 3600,
+            "RequireClientSecret": false,
+            "RequirePkce": true
           }
         ]
 

diff --git a/deployments/dev/docker-compose.local-editor.yml b/deployments/dev/docker-compose.local-editor.yml
@@ -23,9 +23,9 @@ services:
         [
             {
               "ClientId": "tweek-openid-mock-client",
-              "Description": "Client for implicit flow",
+              "Description": "Tweek client",
               "AllowedGrantTypes": [
-                  "implicit"
+                  "authorization_code"
               ],
               "AllowAccessTokensViaBrowser": true,
               "RedirectUris": [
@@ -38,7 +38,9 @@ services:
                   "email"
               ],
               "IdentityTokenLifetime": 3600,
-              "AccessTokenLifetime": 3600
+              "AccessTokenLifetime": 3600,
+              "RequireClientSecret": false,
+              "RequirePkce": true
             }
           ]
 

diff --git a/deployments/dev/docker-compose.override.yml b/deployments/dev/docker-compose.override.yml
@@ -123,7 +123,7 @@ services:
             "ClientId": "tweek-openid-mock-client",
             "Description": "Tweek OIDC Mock",
             "AllowedGrantTypes": [
-                "implicit"
+                "authorization_code"
             ],
             "AllowAccessTokensViaBrowser": true,
             "RedirectUris": [
@@ -136,7 +136,9 @@ services:
                 "email"
             ],
             "IdentityTokenLifetime": 3600,
-            "AccessTokenLifetime": 3600
+            "AccessTokenLifetime": 3600,
+            "RequireClientSecret": false,
+            "RequirePkce": true
           }
         ]
       USERS_CONFIGURATION_INLINE: |

diff --git a/deployments/dev/gateway/config/gateway.json b/deployments/dev/gateway/config/gateway.json
@@ -18,7 +18,7 @@
             "login_type": "oidc",
             "additional_info": {},
             "scope": "openid profile email",
-            "response_type": "id_token"
+            "response_type": "code"
           }
         }
       }

diff --git a/deployments/dev/gateway/config/gateway.local.json b/deployments/dev/gateway/config/gateway.local.json
@@ -16,7 +16,7 @@
           "login_info": {
             "login_type": "oidc",
             "scope": "openid profile email",
-            "response_type": "id_token"
+            "response_type": "code"
           }
         }
       }

diff --git a/deployments/dev/gateway/config/gateway.test.json b/deployments/dev/gateway/config/gateway.test.json
@@ -11,7 +11,7 @@
           "login_info": {
             "login_type": "oidc",
             "scope": "openid profile email",
-            "response_type": "id_token"
+            "response_type": "code"
           }
         }
       },

diff --git a/deployments/dev/tilt.yml b/deployments/dev/tilt.yml
@@ -146,7 +146,7 @@ services:
             "ClientId": "tweek-openid-mock-client",
             "Description": "Tweek OIDC Mock",
             "AllowedGrantTypes": [
-                "implicit"
+                "authorization_code"
             ],
             "AllowAccessTokensViaBrowser": true,
             "RedirectUris": [
@@ -159,7 +159,9 @@ services:
                 "email"
             ],
             "IdentityTokenLifetime": 3600,
-            "AccessTokenLifetime": 3600
+            "AccessTokenLifetime": 3600,
+            "RequireClientSecret": false,
+            "RequirePkce": true
           }
         ]
       USERS_CONFIGURATION_INLINE: |

diff --git a/deployments/kubernetes/infra/gateway-config.yaml b/deployments/kubernetes/infra/gateway-config.yaml
@@ -23,7 +23,7 @@ data:
                         "login_info": {
                             "login_type": "oidc",
                             "scope": "openid profile email",
-                            "response_type": "id_token"
+                            "response_type": "code"
                         }
                     }
                 },

diff --git a/deployments/kubernetes/infra/oidc-server-mock.yaml b/deployments/kubernetes/infra/oidc-server-mock.yaml
@@ -11,7 +11,7 @@ spec:
     spec:
       containers:
       - name: oidc-mock
-        image: soluto/oidc-server-mock
+        image: soluto/oidc-server-mock:0.1.0
         env:
         - name: ASPNETCORE_ENVIRONMENT
           value: Development

diff --git a/services/editor/package.json b/services/editor/package.json
@@ -1,6 +1,6 @@
 {
   "name": "tweek-editor",
-  "version": "1.0.0-rc27",
+  "version": "1.0.0-rc28",
   "main": "dist/index.js",
   "repository": "Soluto/tweek",
   "author": "Soluto",

diff --git a/services/editor/src/services/auth/clients/oidc-auth-client.ts b/services/editor/src/services/auth/clients/oidc-auth-client.ts
@@ -3,8 +3,8 @@ import { AuthProvider } from 'tweek-client';
 import { BaseAuthClient, isTokenValid, RedirectState } from './base-auth-client';
 import storage from './storage';
 
-const basicOidcConfig = {
-  response_type: 'token id_token',
+const basicOidcConfig: Oidc.UserManagerSettings = {
+  response_type: 'code',
   filterProtocolClaims: true,
   loadUserInfo: true,
   automaticSilentRenew: true,