denis/gremiumhub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(frontend,backend): Remove hardcoded legalconsenthub keycloak client ID
Some checks failed
CI/CD Pipeline / backend (push) Has been cancelled
Details
CI/CD Pipeline / deploy (push) Has been cancelled
Details
CI/CD Pipeline / frontend (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Denis Lugowski
2026-03-16 08:29:54 +01:00
parent d4c6def398
commit 37a907e087
4 changed files with 12 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
legalconsenthub-backend/src/main/kotlin/com/betriebsratkanzlei/legalconsenthub/security/CustomJwtAuthenticationConverter.kt
View File

@@ -1,5 +1,6 @@
package com.betriebsratkanzlei.legalconsenthub.security package com.betriebsratkanzlei.legalconsenthub.security
import org.springframework.beans.factory.annotation.Value
import org.springframework.core.convert.converter.Converter import org.springframework.core.convert.converter.Converter
import org.springframework.security.authentication.AbstractAuthenticationToken import org.springframework.security.authentication.AbstractAuthenticationToken
import org.springframework.security.core.GrantedAuthority import org.springframework.security.core.GrantedAuthority
@@ -8,14 +9,16 @@ import org.springframework.security.oauth2.jwt.Jwt
import org.springframework.stereotype.Component import org.springframework.stereotype.Component
@Component @Component
class CustomJwtAuthenticationConverter : Converter<Jwt, AbstractAuthenticationToken> { class CustomJwtAuthenticationConverter(
@Value("\${legalconsenthub.keycloak.client-id}") private val keycloakClientId: String,
) : Converter<Jwt, AbstractAuthenticationToken> {
override fun convert(jwt: Jwt): AbstractAuthenticationToken { override fun convert(jwt: Jwt): AbstractAuthenticationToken {
val userId = jwt.subject val userId = jwt.subject
val username = jwt.getClaimAsString("name") val username = jwt.getClaimAsString("name")
val resourceAccess = jwt.getClaimAsMap("resource_access") as? Map<*, *> val resourceAccess = jwt.getClaimAsMap("resource_access") as? Map<*, *>
val legalconsenthubResource = resourceAccess?.get("legalconsenthub") as? Map<*, *> val clientResource = resourceAccess?.get(keycloakClientId) as? Map<*, *>
val roles = (legalconsenthubResource?.get("roles") as? List<*>)?.mapNotNull { it as? String } ?: emptyList() val roles = (clientResource?.get("roles") as? List<*>)?.mapNotNull { it as? String } ?: emptyList()
val organizationIds = extractOrganizationIds(jwt) val organizationIds = extractOrganizationIds(jwt)

2
legalconsenthub-backend/src/main/resources/application.yaml
View File

@@ -63,6 +63,8 @@ spring:
max-request-size: 50MB max-request-size: 50MB
legalconsenthub: legalconsenthub:
keycloak:
client-id: ${KEYCLOAK_CLIENT_ID:gremiumhub}
file: file:
storage: storage:
filesystem: filesystem:

6
legalconsenthub/server/routes/auth/keycloak.get.ts
View File

@@ -21,7 +21,7 @@ export default defineOAuthKeycloakEventHandler({
} }
const organizations = decodedJwt ? extractOrganizations(decodedJwt) : [] const organizations = decodedJwt ? extractOrganizations(decodedJwt) : []
const roles = decodedJwt ? extractRoles(decodedJwt) : [] const roles = decodedJwt ? extractRoles(decodedJwt, config.oauth.keycloak.clientId) : []
await setUserSession(event, { await setUserSession(event, {
user: { user: {
@@ -71,6 +71,6 @@ function extractOrganizations(decoded: KeycloakTokenPayload): Organization[] {
return organizations return organizations
} }
function extractRoles(decoded: KeycloakTokenPayload): string[] { function extractRoles(decoded: KeycloakTokenPayload, clientId: string): string[] {
return decoded?.resource_access?.legalconsenthub?.roles ?? [] return decoded?.resource_access?.[clientId]?.roles ?? []
} }

6
legalconsenthub/types/keycloak.ts
View File

@@ -5,11 +5,7 @@ export interface KeycloakTokenPayload {
family_name?: string family_name?: string
email?: string email?: string
organization?: Record<string, { id?: string }> organization?: Record<string, { id?: string }>
resource_access?: { resource_access?: Record<string, { roles?: string[] } | undefined>
legalconsenthub?: {
roles?: string[]
}
}
} }
export interface Organization { export interface Organization {