mirror of
https://github.com/dadosfera/maestro.git
synced 2026-10-10 19:19:07 +00:00
38 lines
1.6 KiB
Markdown
38 lines
1.6 KiB
Markdown
# Auth
|
|
|
|
## SSO/oAuth
|
|
|
|
### Strategy
|
|
We are using [PassportJs](https://www.passportjs.org/) to handle oAuth authentications.
|
|
|
|
When the client (front end) makes a `GET /auth/oauth/{strategy}` Passport automatically redirects the user to the `strategy` login page. To do that we must configure and use a **Passport Strategy**. We must also have a callback route, conventionally `GET /auth/oauth/{strategy}/callback`, so the oAuth app can report the status of the user's login.
|
|
|
|
- If the oAuth is successfull we call DUC's `AuthOauthSignIn` request that gets the tokens from Cognito and saves them on cache temporarily under a key we call `session`. Duc returns that `session` to maestro which then redirects the user to our app login page with that `session` as a query param.
|
|
|
|
- If the oAuth login is not successfull for some reason or the user **does not** exist on DUC's database we redirect the user to our login page with an `error` and `error_description` as query params.
|
|
|
|
### Routes
|
|
|
|
So in order to have an SSO login, besides configuring the Strategy, we must have two routes for each Strategy, like in the example below:
|
|
|
|
```ts
|
|
@Get('oauth/google')
|
|
@UseGuards(AuthGuard('google-login'))
|
|
googleOauth() {
|
|
this.logger.info('/oauth/google');
|
|
return true;
|
|
}
|
|
|
|
@Get('oauth/google/callback')
|
|
@UseGuards(AuthGuard('google-login'))
|
|
@Redirect()
|
|
async googleOauthCallback(@Req() req) {
|
|
const { url, email, token, language = 'pt-br' } = await this.callback(req);
|
|
if (url.searchParams.get('error')) {
|
|
this.logger.error('/oauth/google - ERROR');
|
|
return { url: url.href };
|
|
}
|
|
// ... Rest of the logic
|
|
return { url: url.href };
|
|
}
|
|
``` |