78612ea29d
- Add JWT Bearer token validation to API Gateway with restricted CORS - Add cookie-based JWT validation to FileService for browser image requests - Create shared authentication infrastructure in FictionArchive.Service.Shared - Update frontend to set fa_session cookie after OIDC login - Add [Authorize] attributes to GraphQL mutations with role-based restrictions - Configure OIDC settings for both services in docker-compose Implements FA-17: Authentication for microservices architecture
53 lines
1.4 KiB
C#
53 lines
1.4 KiB
C#
using FictionArchive.Service.Shared.Extensions;
|
|
|
|
namespace FictionArchive.API;
|
|
|
|
public class Program
|
|
{
|
|
public static void Main(string[] args)
|
|
{
|
|
var builder = WebApplication.CreateBuilder(args);
|
|
|
|
builder.Services.AddHealthChecks();
|
|
|
|
#region Fusion Gateway
|
|
|
|
builder.Services.AddHttpClient("Fusion");
|
|
|
|
builder.Services
|
|
.AddFusionGatewayServer()
|
|
.ConfigureFromFile("gateway.fgp")
|
|
.CoreBuilder.ApplySaneDefaults();
|
|
|
|
#endregion
|
|
|
|
// Add authentication
|
|
builder.Services.AddOidcAuthentication(builder.Configuration);
|
|
builder.Services.AddFictionArchiveAuthorization();
|
|
|
|
builder.Services.AddCors(options =>
|
|
{
|
|
options.AddPolicy("AllowFictionArchiveOrigins",
|
|
policyBuilder =>
|
|
{
|
|
policyBuilder.WithOrigins("https://fictionarchive.orfl.xyz", "http://localhost:5173")
|
|
.AllowAnyMethod()
|
|
.AllowAnyHeader()
|
|
.AllowCredentials();
|
|
});
|
|
});
|
|
|
|
var app = builder.Build();
|
|
|
|
app.UseCors("AllowFictionArchiveOrigins");
|
|
|
|
app.UseAuthentication();
|
|
app.UseAuthorization();
|
|
|
|
app.MapHealthChecks("/healthz");
|
|
|
|
app.MapGraphQL();
|
|
|
|
app.RunWithGraphQLCommands(args);
|
|
}
|
|
} |