mirror of
https://github.com/hanzoai/bootnode.git
synced 2026-09-30 20:46:32 +00:00
zeekay
33849ab656
The brand-neutral refactor regressed login to a hand-rolled OAuth authorize
URL (no PKCE, wrong path `${iamUrl}/oauth/authorize`) plus a backend
code-exchange POST to /v1/auth/oauth/callback — a route api-go does not
expose. Both break IAM login: the hand-rolled URL hits a path IAM serves
its 200 SPA catch-all for (silent breakage), and the callback 404s.
Restore the one canonical way per HIP-0111:
- lib/iam.ts: @hanzo/iam/browser IAM client, white-labelled by the active
brand (serverUrl + clientId), PKCE S256, endpoints resolved via OIDC
discovery. No hand-rolled authorize URL, no genericOAuth, no /api/auth.
- login: getIam().signinRedirect() in production (SDK owns PKCE + state).
- callback: getIam().handleCallback() does the PKCE token exchange
client-side; the IAM access token becomes the session bearer.
- brand default: bootnode IAM is id.bootno.de / bootnode-platform (was
hanzo.id / bootnode-web — wrong issuer + unregistered client).
- package.json: add @hanzo/iam ^0.11.0 (used but missing from deps).
- public/config.example.json: in-repo reference for the per-brand catalog
(registered clientId per host) so the deploy provisions real clients.
Build + typecheck green.
30 lines
1.6 KiB
JSON
30 lines
1.6 KiB
JSON
{
|
|
"_comment": "REFERENCE multi-brand catalog (HIP-0111). The deploy (universe / CF-Pages) provisions config.json (and/or window.__BRAND_CATALOG__) from a catalog of this shape, host-keyed. iam.url is the canonical OIDC issuer (serverUrl); iam.clientId is the REGISTERED Casdoor app for that host (<org>-web3 / bootnode-platform / pars-app) whose redirectUris include https://<host>/auth/callback. These are PUBLIC values (no secrets) — the @hanzo/iam SPA PKCE flow is a public client. Do NOT invent client IDs: an unregistered clientId returns 'Invalid client_id' and IAM serves its 200 SPA catch-all, which is silent breakage. Brand identity (logos/colors/links) is elided here; only the iam + host wiring is shown as the source of truth.",
|
|
"defaultKey": "bootnode",
|
|
"hosts": [
|
|
{ "match": "web3.hanzo.ai", "key": "hanzo" },
|
|
{ "match": "cloud.lux.network", "key": "lux" },
|
|
{ "match": "web3.lux.network", "key": "lux" },
|
|
{ "match": "web3.zoo.ngo", "key": "zoo" },
|
|
{ "match": "cloud.pars.network", "key": "pars" },
|
|
{ "match": "bootno.de", "key": "bootnode" }
|
|
],
|
|
"brands": {
|
|
"hanzo": {
|
|
"iam": { "url": "https://iam.hanzo.ai", "clientId": "hanzo-web3", "domain": "iam.hanzo.ai" }
|
|
},
|
|
"lux": {
|
|
"iam": { "url": "https://lux.id", "clientId": "lux-web3", "domain": "lux.id" }
|
|
},
|
|
"zoo": {
|
|
"iam": { "url": "https://zoo.id", "clientId": "zoo-web3", "domain": "zoo.id" }
|
|
},
|
|
"pars": {
|
|
"iam": { "url": "https://pars.id", "clientId": "pars-app", "domain": "pars.id" }
|
|
},
|
|
"bootnode": {
|
|
"iam": { "url": "https://id.bootno.de", "clientId": "bootnode-platform", "domain": "id.bootno.de" }
|
|
}
|
|
}
|
|
}
|