admin.schubert/Validation_Suite
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(auth): correct local cookie security configuration

Browse source
This commit is contained in:
Schubert Ferenc 2026-07-11 15:50:15 +02:00
parent b584e60273
commit 155fdbb16a
67 changed files with 1003 additions and 62 deletions
Download patch file Download diff file Expand all files Collapse all files

32
validation-suite/frontend/atlas/app/api/login/route.ts Normal file
View file

@ -0,0 +1,32 @@
import { cookies } from "next/headers";
import { NextResponse } from "next/server";
import { AUTH_COOKIE_NAME, buildAuthCookieOptions } from "@/lib/auth";
const mercuryBase = `${process.env.MERCURY_INTERNAL_URL ?? "http://mercury-api:8000"}/api/v1`;
export async function POST(request: Request) {
const body = await request.json();
try {
const response = await fetch(`${mercuryBase}/auth/login`, {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify(body)
});
const data = await response.json();
if (!response.ok) {
return NextResponse.json(data, { status: response.status });
}
const cookieStore = await cookies();
cookieStore.set({
name: AUTH_COOKIE_NAME,
value: data.access_token,
...buildAuthCookieOptions(data.expires_in)
});
return NextResponse.json({ user: data.user, expires_in: data.expires_in });
} catch (error) {
return NextResponse.json(
{ detail: "Der Anmeldedienst ist momentan nicht erreichbar." },
{ status: 502 }
);
}
}

13
validation-suite/frontend/atlas/app/api/logout/route.ts Normal file
View file

@ -0,0 +1,13 @@
import { cookies } from "next/headers";
import { NextResponse } from "next/server";
import { AUTH_COOKIE_NAME, buildAuthCookieOptions } from "@/lib/auth";
export async function POST() {
const cookieStore = await cookies();
cookieStore.set({
name: AUTH_COOKIE_NAME,
value: "",
...buildAuthCookieOptions(0)
});
return NextResponse.json({ status: "ok" });
}

18
validation-suite/frontend/atlas/app/api/me/route.ts Normal file
View file

@ -0,0 +1,18 @@
import { cookies } from "next/headers";
import { NextResponse } from "next/server";
import { AUTH_COOKIE_NAME } from "@/lib/auth";
const mercuryBase = `${process.env.MERCURY_INTERNAL_URL ?? "http://mercury-api:8000"}/api/v1`;
export async function GET() {
const cookieStore = await cookies();
const token = cookieStore.get(AUTH_COOKIE_NAME)?.value;
if (!token) {
return NextResponse.json({ detail: "Not authenticated" }, { status: 401 });
}
const response = await fetch(`${mercuryBase}/auth/me`, {
headers: { Authorization: `Bearer ${token}` }
});
const data = await response.json();
return NextResponse.json(data, { status: response.status });
}

41
validation-suite/frontend/atlas/app/api/v1/[...path]/route.ts Normal file
View file

@ -0,0 +1,41 @@
import { cookies } from "next/headers";
import { NextRequest, NextResponse } from "next/server";
import { AUTH_COOKIE_NAME } from "@/lib/auth";
const mercuryBase = `${process.env.MERCURY_INTERNAL_URL ?? "http://mercury-api:8000"}/api/v1`;
async function forward(request: NextRequest, method: string, path: string[]) {
const cookieStore = await cookies();
const token = cookieStore.get(AUTH_COOKIE_NAME)?.value;
if (!token) {
return NextResponse.json({ detail: "Not authenticated" }, { status: 401 });
}
const url = new URL(`${mercuryBase}/${path.join("/")}${request.nextUrl.search}`);
const headers = new Headers(request.headers);
headers.set("Authorization", `Bearer ${token}`);
headers.delete("host");
headers.delete("cookie");
const init: RequestInit = { method, headers };
if (method !== "GET" && method !== "HEAD") {
init.body = await request.text();
}
const response = await fetch(url, init);
const contentType = response.headers.get("content-type") ?? "";
if (contentType.includes("application/json")) {
return NextResponse.json(await response.json(), { status: response.status });
}
return new NextResponse(response.body, { status: response.status, headers: { "content-type": contentType } });
}
export async function GET(request: NextRequest, { params }: { params: Promise<{ path: string[] }> }) {
return forward(request, "GET", (await params).path);
}
export async function POST(request: NextRequest, { params }: { params: Promise<{ path: string[] }> }) {
return forward(request, "POST", (await params).path);
}
export async function PUT(request: NextRequest, { params }: { params: Promise<{ path: string[] }> }) {
return forward(request, "PUT", (await params).path);
}
export async function DELETE(request: NextRequest, { params }: { params: Promise<{ path: string[] }> }) {
return forward(request, "DELETE", (await params).path);
}