feat: implement full bff logic
This commit is contained in:
Björn Fromme
@@ -0,0 +1,295 @@
|
||||
name: epbff
|
||||
type: symfony
|
||||
docroot: public
|
||||
php_version: "8.4"
|
||||
webserver_type: apache-fpm
|
||||
xdebug_enabled: false
|
||||
additional_hostnames: []
|
||||
additional_fqdns: []
|
||||
database:
|
||||
type: mariadb
|
||||
version: "11.8"
|
||||
use_dns_when_possible: true
|
||||
composer_version: "2"
|
||||
web_environment: []
|
||||
nodejs_version: "24"
|
||||
corepack_enable: false
|
||||
|
||||
# Key features of DDEV's config.yaml:
|
||||
|
||||
# name: <projectname> # Name of the project, automatically provides
|
||||
# http://projectname.ddev.site and https://projectname.ddev.site
|
||||
# If the name is omitted, the project will take the name of the enclosing directory,
|
||||
# which is useful if you want to have a copy of the project side by side with this one.
|
||||
|
||||
# type: <projecttype> # asterios, backdrop, cakephp, codeigniter, craftcms, drupal, drupal6, drupal7, drupal8, drupal9, drupal10, drupal11, drupal12, generic, joomla, laravel, magento, magento2, php, shopware6, silverstripe, symfony, typo3, wordpress, wp-bedrock
|
||||
# See https://docs.ddev.com/en/stable/users/quickstart/ for more
|
||||
# information on the different project types
|
||||
|
||||
# docroot: <relative_path> # Relative path to the directory containing index.php.
|
||||
|
||||
# php_version: "8.4" # PHP version to use, "5.6" through "8.5"
|
||||
|
||||
# You can explicitly specify the webimage but this
|
||||
# is not recommended, as the images are often closely tied to DDEV's behavior,
|
||||
# so this can break upgrades.
|
||||
|
||||
# webimage: <docker_image>
|
||||
# It’s unusual to change this option, and we don’t recommend it without Docker experience and a good reason.
|
||||
# Typically, this means additions to the existing web image using a .ddev/web-build/Dockerfile.*
|
||||
|
||||
# database:
|
||||
# type: <dbtype> # mysql, mariadb, postgres
|
||||
# version: <version> # database version, like "10.11" or "8.0"
|
||||
# MariaDB versions can be 5.5-10.8, 10.11, 11.4, 11.8, 12.3
|
||||
# MySQL versions can be 5.5-8.0, 8.4
|
||||
# PostgreSQL versions can be 9-18
|
||||
|
||||
# router_http_port: <port> # Port to be used for http (defaults to global configuration, usually 80)
|
||||
# router_https_port: <port> # Port for https (defaults to global configuration, usually 443)
|
||||
|
||||
# xdebug_enabled: false # Set to true to enable Xdebug and "ddev start" or "ddev restart"
|
||||
# Note that for most people the commands
|
||||
# "ddev xdebug" to enable Xdebug and "ddev xdebug off" to disable it work better,
|
||||
# as leaving Xdebug enabled all the time is a big performance hit.
|
||||
|
||||
# xhgui_http_port: "8143"
|
||||
# xhgui_https_port: "8142"
|
||||
# The XHGui ports can be changed from the default 8143 and 8142
|
||||
# Very rarely used
|
||||
|
||||
# host_xhgui_port: "8142"
|
||||
# Can be used to change the host binding port of the XHGui
|
||||
# application. Rarely used; only when port conflict and
|
||||
# bind_all_ports is used (normally with router disabled)
|
||||
|
||||
# xhprof_mode: [prepend|xhgui|global]
|
||||
# Default is "xhgui"
|
||||
|
||||
# webserver_type: nginx-fpm, apache-fpm, generic
|
||||
|
||||
# timezone: Europe/Berlin
|
||||
# If timezone is unset, DDEV will attempt to derive it from the host system timezone
|
||||
# using the $TZ environment variable or the /etc/localtime symlink.
|
||||
# This is the timezone used in the containers and by PHP;
|
||||
# it can be set to any valid timezone,
|
||||
# see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
|
||||
# For example Europe/Dublin or MST7MDT
|
||||
|
||||
# composer_root: <relative_path>
|
||||
# Relative path to the Composer root directory from the project root. This is
|
||||
# the directory which contains the composer.json and where all Composer related
|
||||
# commands are executed.
|
||||
|
||||
# composer_version: "2"
|
||||
# You can set it to "" or "2" (default) for Composer v2
|
||||
# to use the latest major version available at the time your container is built.
|
||||
# It is also possible to use any other Composer version channel. This includes:
|
||||
# - 2.2 (latest Composer LTS version)
|
||||
# - stable
|
||||
# - preview
|
||||
# - snapshot
|
||||
# Alternatively, an explicit Composer version may be specified, for example "2.2.18".
|
||||
# To reinstall Composer after the image was built, run "ddev utility rebuild".
|
||||
|
||||
# nodejs_version: "24"
|
||||
# change from the default system Node.js version to any other version.
|
||||
# See https://docs.ddev.com/en/stable/users/configuration/config/#nodejs_version for more information
|
||||
# and https://www.npmjs.com/package/n#specifying-nodejs-versions for the full documentation.
|
||||
|
||||
# corepack_enable: false
|
||||
# Change to 'true' to 'corepack enable' and gain access to latest versions of yarn/pnpm
|
||||
|
||||
# additional_hostnames:
|
||||
# - somename
|
||||
# - someothername
|
||||
# would provide http and https URLs for "somename.ddev.site"
|
||||
# and "someothername.ddev.site".
|
||||
|
||||
# additional_fqdns:
|
||||
# - example.com
|
||||
# - sub1.example.com
|
||||
# would provide http and https URLs for "example.com" and "sub1.example.com"
|
||||
# Please take care with this because it can cause great confusion.
|
||||
|
||||
# upload_dirs: "custom/upload/dir"
|
||||
#
|
||||
# upload_dirs:
|
||||
# - custom/upload/dir
|
||||
# - ../private
|
||||
#
|
||||
# would set the destination paths for ddev import-files to <docroot>/custom/upload/dir
|
||||
# When Mutagen is enabled this path is bind-mounted so that all the files
|
||||
# in the upload_dirs don't have to be synced into Mutagen.
|
||||
|
||||
# disable_upload_dirs_warning: false
|
||||
# If true, turns off the normal warning that says
|
||||
# "You have Mutagen enabled and your 'php' project type doesn't have upload_dirs set"
|
||||
|
||||
# ddev_version_constraint: ""
|
||||
# Example:
|
||||
# ddev_version_constraint: ">= 1.24.8"
|
||||
# This will enforce that the running ddev version is within this constraint.
|
||||
# See https://github.com/Masterminds/semver#checking-version-constraints for
|
||||
# supported constraint formats
|
||||
|
||||
# working_dir:
|
||||
# web: /var/www/html
|
||||
# db: /home
|
||||
# would set the default working directory for the web and db services.
|
||||
# These values specify the destination directory for ddev ssh and the
|
||||
# directory in which commands passed into ddev exec are run.
|
||||
|
||||
# omit_containers: [db, ddev-ssh-agent]
|
||||
# Currently only these containers are supported. Some containers can also be
|
||||
# omitted globally in the ~/.ddev/global_config.yaml. Note that if you omit
|
||||
# the "db" container, several standard features of DDEV that access the
|
||||
# database container will be unusable. In the global configuration it is also
|
||||
# possible to omit ddev-router, but not here.
|
||||
|
||||
# performance_mode: "global"
|
||||
# DDEV offers performance optimization strategies to improve the filesystem
|
||||
# performance depending on your host system. Should be configured globally.
|
||||
#
|
||||
# If set, will override the global config. Possible values are:
|
||||
# - "global": uses the value from the global config.
|
||||
# - "none": disables performance optimization for this project.
|
||||
# - "mutagen": enables Mutagen for this project.
|
||||
#
|
||||
# See https://docs.ddev.com/en/stable/users/install/performance/#mutagen
|
||||
|
||||
# fail_on_hook_fail: False
|
||||
# Decide whether 'ddev start' should be interrupted by a failing hook
|
||||
|
||||
# host_https_port: "59002"
|
||||
# The host port binding for https can be explicitly specified. It is
|
||||
# dynamic unless otherwise specified.
|
||||
# This is not used by most people, most people use the *router* instead
|
||||
# of the localhost port.
|
||||
|
||||
# host_webserver_port: "59001"
|
||||
# The host port binding for the ddev-webserver can be explicitly specified. It is
|
||||
# dynamic unless otherwise specified.
|
||||
# This is not used by most people, most people use the *router* instead
|
||||
# of the localhost port.
|
||||
|
||||
# host_db_port: "59002"
|
||||
# The host port binding for the ddev-dbserver can be explicitly specified. It is dynamic
|
||||
# unless explicitly specified.
|
||||
|
||||
# mailpit_http_port: "8025"
|
||||
# mailpit_https_port: "8026"
|
||||
# The Mailpit ports can be changed from the default 8025 and 8026
|
||||
|
||||
# host_mailpit_port: "8025"
|
||||
# The mailpit port is not normally bound on the host at all, instead being routed
|
||||
# through ddev-router, but it can be bound directly to localhost if specified here.
|
||||
|
||||
# webimage_extra_packages: ['php${DDEV_PHP_VERSION}-tidy', 'php${DDEV_PHP_VERSION}-yac']
|
||||
# Extra Debian packages that are needed in the webimage can be added here
|
||||
|
||||
# dbimage_extra_packages: [netcat, telnet, sudo]
|
||||
# Extra Debian packages that are needed in the dbimage can be added here
|
||||
|
||||
# use_dns_when_possible: true
|
||||
# If the host has internet access and the domain configured can
|
||||
# successfully be looked up, DNS will be used for hostname resolution
|
||||
# instead of editing /etc/hosts
|
||||
# Defaults to true
|
||||
|
||||
# project_tld: ddev.site
|
||||
# The top-level domain used for project URLs
|
||||
# The default "ddev.site" allows DNS lookup via a wildcard
|
||||
|
||||
# share_default_provider: ngrok
|
||||
# The default share provider to use for "ddev share"
|
||||
# Defaults to global configuration, usually "ngrok"
|
||||
# Can be "ngrok" or "cloudflared" or the name of a custom provider from .ddev/share-providers/
|
||||
|
||||
# share_provider_args: --basic-auth username:pass1234
|
||||
# Provide extra flags to the share provider script
|
||||
# See https://docs.ddev.com/en/stable/users/configuration/config/#share_provider_args
|
||||
|
||||
# disable_settings_management: false
|
||||
# If true, DDEV will not create CMS-specific settings files like
|
||||
# Drupal's settings.php/settings.ddev.php or TYPO3's additional.php
|
||||
# In this case the user must provide all such settings.
|
||||
|
||||
# You can inject environment variables into the web container with:
|
||||
# web_environment:
|
||||
# - SOMEENV=somevalue
|
||||
# - SOMEOTHERENV=someothervalue
|
||||
|
||||
# no_project_mount: false
|
||||
# (Experimental) If true, DDEV will not mount the project into the web container;
|
||||
# the user is responsible for mounting it manually or via a script.
|
||||
# This is to enable experimentation with alternate file mounting strategies.
|
||||
# For advanced users only!
|
||||
|
||||
# bind_all_interfaces: false
|
||||
# If true, host ports will be bound on all network interfaces,
|
||||
# not the localhost interface only. This means that ports
|
||||
# will be available on the local network if the host firewall
|
||||
# allows it.
|
||||
|
||||
# default_container_timeout: 120
|
||||
# The default time that DDEV waits for all containers to become ready can be increased from
|
||||
# the default 120. This helps in importing huge databases, for example.
|
||||
|
||||
#web_extra_exposed_ports:
|
||||
#- name: nodejs
|
||||
# container_port: 3000
|
||||
# http_port: 2999
|
||||
# https_port: 3000
|
||||
#- name: something
|
||||
# container_port: 4000
|
||||
# https_port: 4000
|
||||
# http_port: 3999
|
||||
# Allows a set of extra ports to be exposed via ddev-router
|
||||
# Fill in all three fields even if you don’t intend to use the https_port!
|
||||
# If you don’t add https_port, then it defaults to 0 and ddev-router will fail to start.
|
||||
#
|
||||
# The port behavior on the ddev-webserver must be arranged separately, for example
|
||||
# using web_extra_daemons.
|
||||
# For example, with a web app on port 3000 inside the container, this config would
|
||||
# expose that web app on https://<project>.ddev.site:9999 and http://<project>.ddev.site:9998
|
||||
# web_extra_exposed_ports:
|
||||
# - name: myapp
|
||||
# container_port: 3000
|
||||
# http_port: 9998
|
||||
# https_port: 9999
|
||||
|
||||
#web_extra_daemons:
|
||||
#- name: "http-1"
|
||||
# command: "/var/www/html/node_modules/.bin/http-server -p 3000"
|
||||
# directory: /var/www/html
|
||||
#- name: "http-2"
|
||||
# command: "/var/www/html/node_modules/.bin/http-server /var/www/html/sub -p 3000"
|
||||
# directory: /var/www/html
|
||||
|
||||
# override_config: false
|
||||
# By default, config.*.yaml files are *merged* into the configuration
|
||||
# But this means that some things can't be overridden
|
||||
# For example, if you have 'use_dns_when_possible: true' you can't override it with a merge
|
||||
# and you can't erase existing hooks or all environment variables.
|
||||
# However, with "override_config: true" in a particular config.*.yaml file,
|
||||
# 'use_dns_when_possible: false' can override the existing values, and
|
||||
# hooks:
|
||||
# post-start: []
|
||||
# or
|
||||
# web_environment: []
|
||||
# or
|
||||
# additional_hostnames: []
|
||||
# can have their intended effect. 'override_config' affects only behavior of the
|
||||
# config.*.yaml file it exists in.
|
||||
|
||||
# Many DDEV commands can be extended to run tasks before or after the
|
||||
# DDEV command is executed, for example "post-start", "post-import-db",
|
||||
# "pre-composer", "post-composer"
|
||||
# See https://docs.ddev.com/en/stable/users/extend/custom-commands/ for more
|
||||
# information on the commands that can be extended and the tasks you can define
|
||||
# for them. Example:
|
||||
#hooks:
|
||||
## Un-comment to consume async message.
|
||||
# post-start:
|
||||
# - exec: symfony run --daemon --watch=config,src,templates,vendor bin/console messenger:consume async -vv
|
||||
@@ -0,0 +1,30 @@
|
||||
###> symfony/framework-bundle ###
|
||||
APP_ENV=dev
|
||||
APP_SECRET=changeme_generate_with_php_bin_console_secrets_generate_keys
|
||||
###< symfony/framework-bundle ###
|
||||
|
||||
###> keycloak ###
|
||||
# Keycloak client registered for the BFF only (confidential client,
|
||||
# "Standard flow" + PKCE enabled, redirect URI = KEYCLOAK_REDIRECT_URI).
|
||||
# Apps never register their own Keycloak client — they all go through this one.
|
||||
KEYCLOAK_BASE_URL=https://keycloak.corp.internal
|
||||
KEYCLOAK_REALM=corp
|
||||
KEYCLOAK_CLIENT_ID=bff
|
||||
KEYCLOAK_CLIENT_SECRET=changeme
|
||||
KEYCLOAK_REDIRECT_URI=https://bff.corp.internal/auth/callback
|
||||
KEYCLOAK_POST_LOGOUT_REDIRECT=https://appsmith.corp.internal
|
||||
###< keycloak ###
|
||||
|
||||
###> backend ###
|
||||
BACKEND_BASE_URL=https://backend.corp.internal/api
|
||||
# One env var per additional named backend, matching config/services.yaml's
|
||||
# `backends` map — requests select a non-default backend via the
|
||||
# X-Backend header, e.g.:
|
||||
# BACKEND_CRM_API_URL=https://crm-api.corp.internal
|
||||
###< backend ###
|
||||
|
||||
###> appsmith apps ###
|
||||
# One line per Appsmith app you register — add more as you build more apps,
|
||||
# and add a matching line in config/services.yaml under appsmith.apps.
|
||||
APP_SANDBOX_LOGIN_URL=https://appsmith.corp.internal/app/sandbox/login-abc123
|
||||
###< appsmith apps ###
|
||||
+11
@@ -0,0 +1,11 @@
|
||||
###> symfony/framework-bundle ###
|
||||
/.env.local
|
||||
/.env.local.php
|
||||
/.env.*.local
|
||||
/config/secrets/prod/prod.decrypt.private.php
|
||||
/public/bundles/
|
||||
/var/
|
||||
/vendor/
|
||||
###< symfony/framework-bundle ###
|
||||
|
||||
.DS_Store
|
||||
@@ -0,0 +1,190 @@
|
||||
# Symfony BFF for Keycloak SSO across self-hosted Appsmith apps
|
||||
|
||||
For a description of the implemented concept see https://auth0.com/blog/the-backend-for-frontend-pattern-bff/
|
||||
|
||||
## Requirements
|
||||
|
||||
- PHP >= 8.1, Composer
|
||||
- A Keycloak realm you can register a confidential client in
|
||||
|
||||
## Configuration
|
||||
|
||||
```bash
|
||||
composer install
|
||||
cp .env .env.local # keep .env as the checked-in template, override real values in .env.local
|
||||
```
|
||||
|
||||
### Environment variables (`.env.local`)
|
||||
|
||||
| Variable | Purpose |
|
||||
|---|---|
|
||||
| `APP_SECRET` | Random string (`openssl rand -hex 32`) |
|
||||
| `KEYCLOAK_BASE_URL` | e.g. `https://keycloak.corp.internal` |
|
||||
| `KEYCLOAK_REALM` | Realm name |
|
||||
| `KEYCLOAK_CLIENT_ID` | Confidential client id (see below) |
|
||||
| `KEYCLOAK_CLIENT_SECRET` | That client's secret |
|
||||
| `KEYCLOAK_REDIRECT_URI` | `https://<bff-host>/auth/callback` |
|
||||
| `KEYCLOAK_POST_LOGOUT_REDIRECT` | Where Keycloak sends the browser after `end_session` |
|
||||
| `BACKEND_BASE_URL` | Default backend the proxy forwards to |
|
||||
| `BACKEND_<KEY>_URL` | Optional additional backends (see "Backends" below) |
|
||||
| `APP_<KEY>_LOGIN_URL` | One per Appsmith app (see "Apps" below) |
|
||||
|
||||
### Keycloak client
|
||||
|
||||
Register **one** confidential client for the BFF (Appsmith apps never get their own):
|
||||
- Standard flow (Authorization Code) + PKCE enabled
|
||||
- Redirect URI = `KEYCLOAK_REDIRECT_URI`
|
||||
|
||||
### Apps (`config/services.yaml` → `appsmith.apps`)
|
||||
|
||||
One entry per Appsmith app: its login-return URL and the Keycloak client role required to use it.
|
||||
|
||||
```yaml
|
||||
appsmith.apps:
|
||||
crm:
|
||||
url: '%env(APP_CRM_LOGIN_URL)%'
|
||||
role: 'app-crm-access'
|
||||
helpdesk:
|
||||
url: '%env(APP_HELPDESK_LOGIN_URL)%'
|
||||
role: 'app-helpdesk-access'
|
||||
```
|
||||
|
||||
Add the matching `APP_<KEY>_LOGIN_URL` in `.env.local`. No code changes needed.
|
||||
|
||||
Role setup in Keycloak:
|
||||
1. On the BFF client → **Roles** → create one role per app (e.g. `app-crm-access`).
|
||||
2. Create a group per app, assign the matching role under the group's **Role mapping**.
|
||||
3. Put users in whichever groups they need.
|
||||
4. Client → **Client scopes** → `<client>-dedicated` → **Mappers** → confirm a "client roles" mapper exists with **Add to access token** enabled (default for new clients).
|
||||
|
||||
Enforcement happens once, in `AuthController::callback`, by checking `resource_access.<client_id>.roles` on the access token right after login. The `/api/*` proxy does not re-check roles per request.
|
||||
|
||||
### Backends (`config/services.yaml` → `backends`)
|
||||
|
||||
One `default` entry plus any number of additional named backends:
|
||||
|
||||
```yaml
|
||||
backends:
|
||||
default:
|
||||
url: '%env(BACKEND_BASE_URL)%'
|
||||
crm_api:
|
||||
url: '%env(BACKEND_CRM_API_URL)%'
|
||||
```
|
||||
|
||||
Add the matching `BACKEND_<KEY>_URL` in `.env.local`. A proxied request uses `default` unless it sends an `X-Backend: <key>` header; unknown keys get `400 {"error":"unknown backend"}`. Any app may use any backend key.
|
||||
|
||||
### Running
|
||||
|
||||
```bash
|
||||
php -S 127.0.0.1:8000 -t public
|
||||
# or: symfony server:start
|
||||
```
|
||||
|
||||
Production: point your webserver at `public/` as document root, `APP_ENV=prod`, serve over TLS (the app sets `cookie_secure: true`).
|
||||
|
||||
Sessions are stored via Symfony's filesystem cache by default (`config/packages/cache.yaml`) — fine for one instance. For multiple instances behind a load balancer, switch the `bff.session_cache` pool to `cache.adapter.redis` and add `REDIS_DSN`.
|
||||
|
||||
## Appsmith app integration
|
||||
|
||||
Create a shared module with this js:
|
||||
|
||||
```js
|
||||
export default {
|
||||
isLoggedIn() {
|
||||
return !!appsmith.store.sid;
|
||||
},
|
||||
login(appKey) {
|
||||
navigateTo(`https://bff.ep-reisen.net/auth/login?app=${appKey}`, {}, 'SAME_WINDOW');
|
||||
},
|
||||
async checkReturningFromLogin(loginPageName, protectedPageName) {
|
||||
const sid = appsmith.URL.queryParams.sid;
|
||||
const error = appsmith.URL.queryParams.error;
|
||||
if (error === 'access_denied') {
|
||||
showAlert('You do not have access to this app.', 'error');
|
||||
navigateTo(loginPageName, {}, 'SAME_WINDOW');
|
||||
return;
|
||||
}
|
||||
if (sid) {
|
||||
await storeValue('sid', sid);
|
||||
navigateTo(protectedPageName, {}, 'SAME_WINDOW');
|
||||
}
|
||||
if (appsmith.store.sid && !appsmith.store.user) {
|
||||
const profile = await Bff_Me.run();
|
||||
await storeValue('user', profile);
|
||||
}
|
||||
},
|
||||
guardPage(loginPageName) {
|
||||
if (!this.isLoggedIn()) {
|
||||
navigateTo(loginPageName, {}, 'SAME_WINDOW');
|
||||
}
|
||||
},
|
||||
async logout() {
|
||||
const res = await Bff_Logout.run();
|
||||
await storeValue('sid', null);
|
||||
await storeValue('user', null);
|
||||
navigateTo(res.logout_url, {}, 'SAME_WINDOW');
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
On the login page add this js to be executed onLoad:
|
||||
|
||||
```js
|
||||
export default {
|
||||
onLoad() {
|
||||
return Bff.checkReturningFromLogin('Login', 'ProtectedPage');
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
On the protected page add this js to be execute onLoad:
|
||||
|
||||
```js
|
||||
export default {
|
||||
onLoad() {
|
||||
return Bff.guardPage('Login');
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Login state can be used to toggle visibility of UI elements in Appsmith with
|
||||
|
||||
```js
|
||||
// No sid? Not logged-in
|
||||
{{ !appsmith.store.sid }}
|
||||
// Sid? Logged-in
|
||||
{{ !!appsmith.store.sid }}
|
||||
```
|
||||
|
||||
and user info is accessible via
|
||||
|
||||
```js
|
||||
// Full user object
|
||||
{{ appsmith.store.user }}
|
||||
```
|
||||
|
||||
**API queries** — every protected query sets header `Authorization: Bearer {{appsmith.store.sid}}`, targeting `https://<bff-host>/api/<path>`. Add `X-Backend: <key>` to route a specific query to a non-default backend. Add a 401 handler (`onError`) on each:
|
||||
|
||||
```js
|
||||
storeValue('sid', null);
|
||||
navigateTo('LoginPage', {}, 'REPLACE');
|
||||
```
|
||||
|
||||
**User profile** — one query `Bff_Me`: `GET /auth/me`, header `Authorization: Bearer {{appsmith.store.sid}}`. Returns:
|
||||
|
||||
```json
|
||||
{
|
||||
"email": "[email protected]",
|
||||
"email_verified": true,
|
||||
"name": "Jane Doe",
|
||||
"given_name": "Jane",
|
||||
"family_name": "Doe",
|
||||
"preferred_username": "jdoe"
|
||||
}
|
||||
```
|
||||
|
||||
Reference via `{{appsmith.store.user.email}}` etc. This is client-visible display data, not an authorization signal — the backend must still authorize off the real access token the BFF injects.
|
||||
|
||||
## Known limitation
|
||||
|
||||
Logout is immediate at the BFF but not push-propagated to other open app tabs — they find out on their next API call (401). For centrally-triggered logout (e.g. admin-disabled user), add OIDC back-channel logout separately.
|
||||
Executable
+13
@@ -0,0 +1,13 @@
|
||||
#!/usr/bin/env php
|
||||
<?php
|
||||
|
||||
use App\Kernel;
|
||||
use Symfony\Bundle\FrameworkBundle\Console\Application;
|
||||
|
||||
require_once dirname(__DIR__).'/vendor/autoload_runtime.php';
|
||||
|
||||
return function (array $context) {
|
||||
$kernel = new Kernel($context['APP_ENV'], (bool) $context['APP_DEBUG']);
|
||||
|
||||
return new Application($kernel);
|
||||
};
|
||||
@@ -0,0 +1,64 @@
|
||||
{
|
||||
"type": "project",
|
||||
"license": "proprietary",
|
||||
"description": "BFF for Keycloak SSO across self-hosted Appsmith apps",
|
||||
"require": {
|
||||
"php": ">=8.2",
|
||||
"ext-ctype": "*",
|
||||
"ext-iconv": "*",
|
||||
"firebase/php-jwt": "^7.1",
|
||||
"symfony/cache": "7.*",
|
||||
"symfony/console": "7.*",
|
||||
"symfony/dotenv": "7.*",
|
||||
"symfony/flex": "^2",
|
||||
"symfony/framework-bundle": "7.*",
|
||||
"symfony/http-client": "7.*",
|
||||
"symfony/monolog-bundle": "^4.0",
|
||||
"symfony/runtime": "7.*",
|
||||
"symfony/yaml": "7.*"
|
||||
},
|
||||
"require-dev": {
|
||||
"deployer/deployer": "^8.0",
|
||||
"symfony/maker-bundle": "^1.60"
|
||||
},
|
||||
"config": {
|
||||
"allow-plugins": {
|
||||
"symfony/flex": true,
|
||||
"symfony/runtime": true
|
||||
},
|
||||
"sort-packages": true
|
||||
},
|
||||
"autoload": {
|
||||
"psr-4": {
|
||||
"App\\": "src/"
|
||||
}
|
||||
},
|
||||
"autoload-dev": {
|
||||
"psr-4": {
|
||||
"App\\Tests\\": "tests/"
|
||||
}
|
||||
},
|
||||
"replace": {
|
||||
"symfony/polyfill-ctype": "*",
|
||||
"symfony/polyfill-iconv": "*",
|
||||
"symfony/polyfill-php72": "*",
|
||||
"symfony/polyfill-php73": "*",
|
||||
"symfony/polyfill-php74": "*",
|
||||
"symfony/polyfill-php80": "*",
|
||||
"symfony/polyfill-php81": "*"
|
||||
},
|
||||
"scripts": {
|
||||
"auto-scripts": {
|
||||
"cache:clear": "symfony-cmd",
|
||||
"assets:install %PUBLIC_DIR%": "symfony-cmd"
|
||||
},
|
||||
"post-install-cmd": ["@auto-scripts"],
|
||||
"post-update-cmd": ["@auto-scripts"]
|
||||
},
|
||||
"extra": {
|
||||
"symfony": {
|
||||
"allow-contrib": false,
|
||||
"require": "7.*"
|
||||
}
|
||||
}
|
||||
}
|
||||
Generated
+3665
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,7 @@
|
||||
<?php
|
||||
|
||||
return [
|
||||
Symfony\Bundle\FrameworkBundle\FrameworkBundle::class => ['all' => true],
|
||||
Symfony\Bundle\MakerBundle\MakerBundle::class => ['dev' => true],
|
||||
Symfony\Bundle\MonologBundle\MonologBundle::class => ['all' => true],
|
||||
];
|
||||
@@ -0,0 +1,16 @@
|
||||
framework:
|
||||
cache:
|
||||
app: cache.adapter.filesystem
|
||||
|
||||
pools:
|
||||
# Backs App\Session\BffSessionStore. Filesystem is fine for a
|
||||
# single instance under low/moderate traffic — safe across
|
||||
# concurrent PHP-FPM workers, no extra service to run.
|
||||
#
|
||||
# If you ever scale to multiple BFF instances/containers,
|
||||
# switch adapter to cache.adapter.redis and add:
|
||||
# provider: '%env(REDIS_DSN)%'
|
||||
# No code changes needed elsewhere.
|
||||
bff.session_cache:
|
||||
adapter: cache.adapter.filesystem
|
||||
default_lifetime: 3600
|
||||
@@ -0,0 +1,19 @@
|
||||
framework:
|
||||
secret: '%env(APP_SECRET)%'
|
||||
http_method_override: false
|
||||
handle_all_throwables: true
|
||||
|
||||
# Used only for the short-lived PKCE/state leg in AuthController
|
||||
# (/auth/login -> /auth/callback). App sessions are the separate
|
||||
# Redis-backed, sid-keyed store in App\Session\BffSessionStore.
|
||||
session:
|
||||
cookie_secure: true
|
||||
cookie_httponly: true
|
||||
cookie_samesite: 'lax'
|
||||
|
||||
http_client: ~
|
||||
|
||||
# Filesystem cache is sufficient here — used only to cache Keycloak's
|
||||
# JWKS in IdTokenDecoder, not for session state.
|
||||
cache:
|
||||
app: cache.adapter.filesystem
|
||||
@@ -0,0 +1,58 @@
|
||||
monolog:
|
||||
channels:
|
||||
- deprecation # Deprecations are logged in the dedicated "deprecation" channel when it exists
|
||||
|
||||
when@dev:
|
||||
monolog:
|
||||
handlers:
|
||||
main:
|
||||
type: stream
|
||||
path: "%kernel.logs_dir%/%kernel.environment%.log"
|
||||
level: debug
|
||||
channels: ["!event"]
|
||||
console:
|
||||
type: console
|
||||
process_psr_3_messages: false
|
||||
channels: ["!event", "!doctrine", "!console"]
|
||||
|
||||
when@test:
|
||||
monolog:
|
||||
handlers:
|
||||
main:
|
||||
type: fingers_crossed
|
||||
action_level: error
|
||||
handler: nested
|
||||
excluded_http_codes: [404, 405]
|
||||
channels: ["!event"]
|
||||
nested:
|
||||
type: stream
|
||||
path: "%kernel.logs_dir%/%kernel.environment%.log"
|
||||
level: debug
|
||||
|
||||
when@prod:
|
||||
monolog:
|
||||
handlers:
|
||||
main:
|
||||
type: fingers_crossed
|
||||
action_level: error
|
||||
handler: nested
|
||||
excluded_http_codes: [404, 405]
|
||||
channels: ["!deprecation"]
|
||||
buffer_size: 50 # How many messages should be saved? Prevent memory leaks
|
||||
nested:
|
||||
# Plain rsync/Deployer shared hosting (see deploy.php), not a
|
||||
# container — nothing collects stderr here, so log to the
|
||||
# shared var/log dir that already survives releases.
|
||||
type: rotating_file
|
||||
path: "%kernel.logs_dir%/%kernel.environment%.log"
|
||||
max_files: 14
|
||||
level: debug
|
||||
console:
|
||||
type: console
|
||||
process_psr_3_messages: false
|
||||
channels: ["!event", "!doctrine"]
|
||||
deprecation:
|
||||
type: rotating_file
|
||||
channels: [deprecation]
|
||||
path: "%kernel.logs_dir%/%kernel.environment%.deprecation.log"
|
||||
max_files: 14
|
||||
@@ -0,0 +1,3 @@
|
||||
framework:
|
||||
router:
|
||||
strict_requirements: null
|
||||
@@ -0,0 +1,12 @@
|
||||
framework:
|
||||
router:
|
||||
utf8: true
|
||||
|
||||
# Configure how to generate URLs in non-HTTP contexts, such as CLI commands.
|
||||
# See https://symfony.com/doc/current/routing.html#generating-urls-in-commands
|
||||
#default_uri: http://localhost
|
||||
|
||||
when@prod:
|
||||
framework:
|
||||
router:
|
||||
strict_requirements: null
|
||||
@@ -0,0 +1,5 @@
|
||||
<?php
|
||||
|
||||
if (file_exists(dirname(__DIR__).'/var/cache/prod/App_KernelProdContainer.preload.php')) {
|
||||
require dirname(__DIR__).'/var/cache/prod/App_KernelProdContainer.preload.php';
|
||||
}
|
||||
@@ -0,0 +1,968 @@
|
||||
<?php
|
||||
|
||||
// This file is auto-generated and is for apps only. Bundles SHOULD NOT rely on its content.
|
||||
|
||||
namespace Symfony\Component\DependencyInjection\Loader\Configurator;
|
||||
|
||||
use Symfony\Component\Config\Loader\ParamConfigurator as Param;
|
||||
|
||||
/**
|
||||
* This class provides array-shapes for configuring the services and bundles of an application.
|
||||
*
|
||||
* Services declared with the config() method below are autowired and autoconfigured by default.
|
||||
*
|
||||
* This is for apps only. Bundles SHOULD NOT use it.
|
||||
*
|
||||
* Example:
|
||||
*
|
||||
* ```php
|
||||
* // config/services.php
|
||||
* namespace Symfony\Component\DependencyInjection\Loader\Configurator;
|
||||
*
|
||||
* return App::config([
|
||||
* 'services' => [
|
||||
* 'App\\' => [
|
||||
* 'resource' => '../src/',
|
||||
* ],
|
||||
* ],
|
||||
* ]);
|
||||
* ```
|
||||
*
|
||||
* @psalm-type ImportsConfig = list<string|array{
|
||||
* resource: string,
|
||||
* type?: string|null,
|
||||
* ignore_errors?: bool|'not_found',
|
||||
* }>
|
||||
* @psalm-type ParametersConfig = array<string, scalar|\UnitEnum|array<scalar|\UnitEnum|array<mixed>|Param|null>|Param|null>
|
||||
* @psalm-type ArgumentsType = list<mixed>|array<string, mixed>
|
||||
* @psalm-type CallType = array<string, ArgumentsType>|array{0:string, 1?:ArgumentsType, 2?:bool}|array{method:string, arguments?:ArgumentsType, returns_clone?:bool}
|
||||
* @psalm-type TagsType = list<string|array<string, array<string, mixed>>> // arrays inside the list must have only one element, with the tag name as the key
|
||||
* @psalm-type CallbackType = string|array{0:string|ReferenceConfigurator,1:string}|\Closure|ReferenceConfigurator
|
||||
* @psalm-type DeprecationType = array{package: string, version: string, message?: string}
|
||||
* @psalm-type DefaultsType = array{
|
||||
* public?: bool,
|
||||
* tags?: TagsType,
|
||||
* resource_tags?: TagsType,
|
||||
* autowire?: bool,
|
||||
* autoconfigure?: bool,
|
||||
* bind?: array<string, mixed>,
|
||||
* }
|
||||
* @psalm-type InstanceofType = array{
|
||||
* shared?: bool,
|
||||
* lazy?: bool|string,
|
||||
* public?: bool,
|
||||
* properties?: array<string, mixed>,
|
||||
* configurator?: CallbackType,
|
||||
* calls?: list<CallType>,
|
||||
* tags?: TagsType,
|
||||
* resource_tags?: TagsType,
|
||||
* autowire?: bool,
|
||||
* bind?: array<string, mixed>,
|
||||
* constructor?: string,
|
||||
* }
|
||||
* @psalm-type DefinitionType = array{
|
||||
* class?: string,
|
||||
* file?: string,
|
||||
* parent?: string,
|
||||
* shared?: bool,
|
||||
* synthetic?: bool,
|
||||
* lazy?: bool|string,
|
||||
* public?: bool,
|
||||
* abstract?: bool,
|
||||
* deprecated?: DeprecationType,
|
||||
* factory?: CallbackType,
|
||||
* configurator?: CallbackType,
|
||||
* arguments?: ArgumentsType,
|
||||
* properties?: array<string, mixed>,
|
||||
* calls?: list<CallType>,
|
||||
* tags?: TagsType,
|
||||
* resource_tags?: TagsType,
|
||||
* decorates?: string,
|
||||
* decoration_inner_name?: string,
|
||||
* decoration_priority?: int,
|
||||
* decoration_on_invalid?: 'exception'|'ignore'|null,
|
||||
* autowire?: bool,
|
||||
* autoconfigure?: bool,
|
||||
* bind?: array<string, mixed>,
|
||||
* constructor?: string,
|
||||
* from_callable?: CallbackType,
|
||||
* }
|
||||
* @psalm-type AliasType = string|array{
|
||||
* alias: string,
|
||||
* public?: bool,
|
||||
* deprecated?: DeprecationType,
|
||||
* }
|
||||
* @psalm-type PrototypeType = array{
|
||||
* resource: string,
|
||||
* namespace?: string,
|
||||
* exclude?: string|list<string>,
|
||||
* parent?: string,
|
||||
* shared?: bool,
|
||||
* lazy?: bool|string,
|
||||
* public?: bool,
|
||||
* abstract?: bool,
|
||||
* deprecated?: DeprecationType,
|
||||
* factory?: CallbackType,
|
||||
* arguments?: ArgumentsType,
|
||||
* properties?: array<string, mixed>,
|
||||
* configurator?: CallbackType,
|
||||
* calls?: list<CallType>,
|
||||
* tags?: TagsType,
|
||||
* resource_tags?: TagsType,
|
||||
* autowire?: bool,
|
||||
* autoconfigure?: bool,
|
||||
* bind?: array<string, mixed>,
|
||||
* constructor?: string,
|
||||
* }
|
||||
* @psalm-type StackType = array{
|
||||
* stack: list<DefinitionType|AliasType|PrototypeType|array<class-string, ArgumentsType|null>>,
|
||||
* public?: bool,
|
||||
* deprecated?: DeprecationType,
|
||||
* }
|
||||
* @psalm-type ServicesConfig = array{
|
||||
* _defaults?: DefaultsType,
|
||||
* _instanceof?: array<class-string, InstanceofType>,
|
||||
* ...<string, DefinitionType|AliasType|PrototypeType|StackType|ArgumentsType|null>
|
||||
* }
|
||||
* @psalm-type ExtensionType = array<string, mixed>
|
||||
* @psalm-type FrameworkConfig = array{
|
||||
* secret?: scalar|Param|null,
|
||||
* http_method_override?: bool|Param, // Set true to enable support for the '_method' request parameter to determine the intended HTTP method on POST requests. // Default: false
|
||||
* allowed_http_method_override?: null|list<string|Param>,
|
||||
* trust_x_sendfile_type_header?: scalar|Param|null, // Set true to enable support for xsendfile in binary file responses. // Default: "%env(bool:default::SYMFONY_TRUST_X_SENDFILE_TYPE_HEADER)%"
|
||||
* ide?: scalar|Param|null, // Default: "%env(default::SYMFONY_IDE)%"
|
||||
* test?: bool|Param,
|
||||
* default_locale?: scalar|Param|null, // Default: "en"
|
||||
* set_locale_from_accept_language?: bool|Param, // Whether to use the Accept-Language HTTP header to set the Request locale (only when the "_locale" request attribute is not passed). // Default: false
|
||||
* set_content_language_from_locale?: bool|Param, // Whether to set the Content-Language HTTP header on the Response using the Request locale. // Default: false
|
||||
* enabled_locales?: list<scalar|Param|null>,
|
||||
* trusted_hosts?: Param|string|list<scalar|Param|null>,
|
||||
* trusted_proxies?: mixed, // Default: ["%env(default::SYMFONY_TRUSTED_PROXIES)%"]
|
||||
* trusted_headers?: Param|string|list<scalar|Param|null>,
|
||||
* error_controller?: scalar|Param|null, // Default: "error_controller"
|
||||
* handle_all_throwables?: bool|Param, // HttpKernel will handle all kinds of \Throwable. // Default: true
|
||||
* csrf_protection?: bool|array{
|
||||
* enabled?: scalar|Param|null, // Default: null
|
||||
* stateless_token_ids?: list<scalar|Param|null>,
|
||||
* check_header?: scalar|Param|null, // Whether to check the CSRF token in a header in addition to a cookie when using stateless protection. // Default: false
|
||||
* cookie_name?: scalar|Param|null, // The name of the cookie to use when using stateless protection. // Default: "csrf-token"
|
||||
* },
|
||||
* form?: bool|array{ // Form configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* csrf_protection?: bool|array{
|
||||
* enabled?: scalar|Param|null, // Default: null
|
||||
* token_id?: scalar|Param|null, // Default: null
|
||||
* field_name?: scalar|Param|null, // Default: "_token"
|
||||
* field_attr?: array<string, scalar|Param|null>,
|
||||
* },
|
||||
* },
|
||||
* http_cache?: bool|array{ // HTTP cache configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* debug?: bool|Param, // Default: "%kernel.debug%"
|
||||
* trace_level?: "none"|"short"|"full"|Param,
|
||||
* trace_header?: scalar|Param|null,
|
||||
* default_ttl?: int|Param,
|
||||
* private_headers?: list<scalar|Param|null>,
|
||||
* skip_response_headers?: list<scalar|Param|null>,
|
||||
* allow_reload?: bool|Param,
|
||||
* allow_revalidate?: bool|Param,
|
||||
* stale_while_revalidate?: int|Param,
|
||||
* stale_if_error?: int|Param,
|
||||
* terminate_on_cache_hit?: bool|Param,
|
||||
* },
|
||||
* esi?: bool|array{ // ESI configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* },
|
||||
* ssi?: bool|array{ // SSI configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* },
|
||||
* fragments?: bool|array{ // Fragments configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* hinclude_default_template?: scalar|Param|null, // Default: null
|
||||
* path?: scalar|Param|null, // Default: "/_fragment"
|
||||
* },
|
||||
* profiler?: bool|array{ // Profiler configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* collect?: bool|Param, // Default: true
|
||||
* collect_parameter?: scalar|Param|null, // The name of the parameter to use to enable or disable collection on a per request basis. // Default: null
|
||||
* only_exceptions?: bool|Param, // Default: false
|
||||
* only_main_requests?: bool|Param, // Default: false
|
||||
* dsn?: scalar|Param|null, // Default: "file:%kernel.cache_dir%/profiler"
|
||||
* collect_serializer_data?: bool|Param, // Enables the serializer data collector and profiler panel. // Default: false
|
||||
* },
|
||||
* workflows?: bool|array{
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* workflows?: array<string, array{ // Default: []
|
||||
* audit_trail?: bool|array{
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* },
|
||||
* type?: "workflow"|"state_machine"|Param, // Default: "state_machine"
|
||||
* marking_store?: array{
|
||||
* type?: "method"|Param,
|
||||
* property?: scalar|Param|null,
|
||||
* service?: scalar|Param|null,
|
||||
* },
|
||||
* supports?: Param|string|list<scalar|Param|null>,
|
||||
* definition_validators?: list<scalar|Param|null>,
|
||||
* support_strategy?: scalar|Param|null,
|
||||
* initial_marking?: \BackedEnum|Param|string|list<scalar|Param|null>,
|
||||
* events_to_dispatch?: null|list<string|Param>,
|
||||
* places?: Param|string|list<array{ // Default: []
|
||||
* name?: scalar|Param|null,
|
||||
* metadata?: array<string, mixed>,
|
||||
* }>,
|
||||
* transitions?: list<array{ // Default: []
|
||||
* name?: string|Param,
|
||||
* guard?: string|Param, // An expression to block the transition.
|
||||
* from?: \BackedEnum|Param|string|list<array{ // Default: []
|
||||
* place?: string|Param,
|
||||
* weight?: int|Param, // Default: 1
|
||||
* }>,
|
||||
* to?: \BackedEnum|Param|string|list<array{ // Default: []
|
||||
* place?: string|Param,
|
||||
* weight?: int|Param, // Default: 1
|
||||
* }>,
|
||||
* weight?: int|Param, // Default: 1
|
||||
* metadata?: array<string, mixed>,
|
||||
* }>,
|
||||
* metadata?: array<string, mixed>,
|
||||
* }>,
|
||||
* },
|
||||
* router?: bool|array{ // Router configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* resource?: scalar|Param|null,
|
||||
* type?: scalar|Param|null,
|
||||
* cache_dir?: scalar|Param|null, // Deprecated: Setting the "framework.router.cache_dir.cache_dir" configuration option is deprecated. It will be removed in version 8.0. // Default: "%kernel.build_dir%"
|
||||
* default_uri?: scalar|Param|null, // The default URI used to generate URLs in a non-HTTP context. // Default: null
|
||||
* http_port?: scalar|Param|null, // Default: 80
|
||||
* https_port?: scalar|Param|null, // Default: 443
|
||||
* strict_requirements?: scalar|Param|null, // set to true to throw an exception when a parameter does not match the requirements set to false to disable exceptions when a parameter does not match the requirements (and return null instead) set to null to disable parameter checks against requirements 'true' is the preferred configuration in development mode, while 'false' or 'null' might be preferred in production // Default: true
|
||||
* utf8?: bool|Param, // Default: true
|
||||
* },
|
||||
* session?: bool|array{ // Session configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* storage_factory_id?: scalar|Param|null, // Default: "session.storage.factory.native"
|
||||
* handler_id?: scalar|Param|null, // Defaults to using the native session handler, or to the native *file* session handler if "save_path" is not null.
|
||||
* name?: scalar|Param|null,
|
||||
* cookie_lifetime?: scalar|Param|null,
|
||||
* cookie_path?: scalar|Param|null,
|
||||
* cookie_domain?: scalar|Param|null,
|
||||
* cookie_secure?: true|false|"auto"|Param, // Default: "auto"
|
||||
* cookie_httponly?: bool|Param, // Default: true
|
||||
* cookie_samesite?: null|"lax"|"strict"|"none"|Param, // Default: "lax"
|
||||
* use_cookies?: bool|Param,
|
||||
* gc_divisor?: scalar|Param|null,
|
||||
* gc_probability?: scalar|Param|null,
|
||||
* gc_maxlifetime?: scalar|Param|null,
|
||||
* save_path?: scalar|Param|null, // Defaults to "%kernel.cache_dir%/sessions" if the "handler_id" option is not null.
|
||||
* metadata_update_threshold?: int|Param, // Seconds to wait between 2 session metadata updates. // Default: 0
|
||||
* sid_length?: int|Param, // Deprecated: Setting the "framework.session.sid_length.sid_length" configuration option is deprecated. It will be removed in version 8.0. No alternative is provided as PHP 8.4 has deprecated the related option.
|
||||
* sid_bits_per_character?: int|Param, // Deprecated: Setting the "framework.session.sid_bits_per_character.sid_bits_per_character" configuration option is deprecated. It will be removed in version 8.0. No alternative is provided as PHP 8.4 has deprecated the related option.
|
||||
* },
|
||||
* request?: bool|array{ // Request configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* formats?: array<string, Param|string|list<scalar|Param|null>>,
|
||||
* },
|
||||
* assets?: bool|array{ // Assets configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* strict_mode?: bool|Param, // Throw an exception if an entry is missing from the manifest.json. // Default: false
|
||||
* version_strategy?: scalar|Param|null, // Default: null
|
||||
* version?: scalar|Param|null, // Default: null
|
||||
* version_format?: scalar|Param|null, // Default: "%%s?%%s"
|
||||
* json_manifest_path?: scalar|Param|null, // Default: null
|
||||
* base_path?: scalar|Param|null, // Default: ""
|
||||
* base_urls?: Param|string|list<scalar|Param|null>,
|
||||
* packages?: array<string, array{ // Default: []
|
||||
* strict_mode?: bool|Param, // Throw an exception if an entry is missing from the manifest.json. // Default: false
|
||||
* version_strategy?: scalar|Param|null, // Default: null
|
||||
* version?: scalar|Param|null,
|
||||
* version_format?: scalar|Param|null, // Default: null
|
||||
* json_manifest_path?: scalar|Param|null, // Default: null
|
||||
* base_path?: scalar|Param|null, // Default: ""
|
||||
* base_urls?: Param|string|list<scalar|Param|null>,
|
||||
* }>,
|
||||
* },
|
||||
* asset_mapper?: bool|array{ // Asset Mapper configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* paths?: Param|string|array<string, scalar|Param|null>,
|
||||
* excluded_patterns?: list<scalar|Param|null>,
|
||||
* exclude_dotfiles?: bool|Param, // If true, any files starting with "." will be excluded from the asset mapper. // Default: true
|
||||
* server?: bool|Param, // If true, a "dev server" will return the assets from the public directory (true in "debug" mode only by default). // Default: true
|
||||
* public_prefix?: scalar|Param|null, // The public path where the assets will be written to (and served from when "server" is true). // Default: "/assets/"
|
||||
* missing_import_mode?: "strict"|"warn"|"ignore"|Param, // Behavior if an asset cannot be found when imported from JavaScript or CSS files - e.g. "import './non-existent.js'". "strict" means an exception is thrown, "warn" means a warning is logged, "ignore" means the import is left as-is. // Default: "warn"
|
||||
* extensions?: array<string, scalar|Param|null>,
|
||||
* importmap_path?: scalar|Param|null, // The path of the importmap.php file. // Default: "%kernel.project_dir%/importmap.php"
|
||||
* importmap_polyfill?: scalar|Param|null, // The importmap name that will be used to load the polyfill. Set to false to disable. // Default: "es-module-shims"
|
||||
* importmap_script_attributes?: array<string, scalar|Param|null>,
|
||||
* vendor_dir?: scalar|Param|null, // The directory to store JavaScript vendors. // Default: "%kernel.project_dir%/assets/vendor"
|
||||
* precompress?: bool|array{ // Precompress assets with Brotli, Zstandard and gzip.
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* formats?: list<scalar|Param|null>,
|
||||
* extensions?: list<scalar|Param|null>,
|
||||
* },
|
||||
* },
|
||||
* translator?: bool|array{ // Translator configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* fallbacks?: Param|string|list<scalar|Param|null>,
|
||||
* logging?: bool|Param, // Default: false
|
||||
* formatter?: scalar|Param|null, // Default: "translator.formatter.default"
|
||||
* cache_dir?: scalar|Param|null, // Default: "%kernel.cache_dir%/translations"
|
||||
* default_path?: scalar|Param|null, // The default path used to load translations. // Default: "%kernel.project_dir%/translations"
|
||||
* paths?: list<scalar|Param|null>,
|
||||
* pseudo_localization?: bool|array{
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* accents?: bool|Param, // Default: true
|
||||
* expansion_factor?: float|Param, // Default: 1.0
|
||||
* brackets?: bool|Param, // Default: true
|
||||
* parse_html?: bool|Param, // Default: false
|
||||
* localizable_html_attributes?: list<scalar|Param|null>,
|
||||
* },
|
||||
* providers?: array<string, array{ // Default: []
|
||||
* dsn?: scalar|Param|null,
|
||||
* domains?: list<scalar|Param|null>,
|
||||
* locales?: list<scalar|Param|null>,
|
||||
* }>,
|
||||
* globals?: array<string, Param|string|array{ // Default: []
|
||||
* value?: mixed,
|
||||
* message?: string|Param,
|
||||
* parameters?: array<string, scalar|Param|null>,
|
||||
* domain?: string|Param,
|
||||
* }>,
|
||||
* },
|
||||
* validation?: bool|array{ // Validation configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* cache?: scalar|Param|null, // Deprecated: Setting the "framework.validation.cache.cache" configuration option is deprecated. It will be removed in version 8.0.
|
||||
* enable_attributes?: bool|Param, // Default: true
|
||||
* static_method?: Param|string|list<scalar|Param|null>,
|
||||
* translation_domain?: scalar|Param|null, // Default: "validators"
|
||||
* email_validation_mode?: "html5"|"html5-allow-no-tld"|"strict"|"loose"|Param, // Default: "html5"
|
||||
* mapping?: array{
|
||||
* paths?: list<scalar|Param|null>,
|
||||
* },
|
||||
* not_compromised_password?: bool|array{
|
||||
* enabled?: bool|Param, // When disabled, compromised passwords will be accepted as valid. // Default: true
|
||||
* endpoint?: scalar|Param|null, // API endpoint for the NotCompromisedPassword Validator. // Default: null
|
||||
* },
|
||||
* disable_translation?: bool|Param, // Default: false
|
||||
* auto_mapping?: array<string, array{ // Default: []
|
||||
* services?: list<scalar|Param|null>,
|
||||
* }>,
|
||||
* },
|
||||
* annotations?: bool|array{
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* },
|
||||
* serializer?: bool|array{ // Serializer configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* enable_attributes?: bool|Param, // Default: true
|
||||
* name_converter?: scalar|Param|null,
|
||||
* circular_reference_handler?: scalar|Param|null,
|
||||
* max_depth_handler?: scalar|Param|null,
|
||||
* mapping?: array{
|
||||
* paths?: list<scalar|Param|null>,
|
||||
* },
|
||||
* default_context?: array<string, mixed>,
|
||||
* named_serializers?: array<string, array{ // Default: []
|
||||
* name_converter?: scalar|Param|null,
|
||||
* default_context?: array<string, mixed>,
|
||||
* include_built_in_normalizers?: bool|Param, // Whether to include the built-in normalizers // Default: true
|
||||
* include_built_in_encoders?: bool|Param, // Whether to include the built-in encoders // Default: true
|
||||
* }>,
|
||||
* },
|
||||
* property_access?: bool|array{ // Property access configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* magic_call?: bool|Param, // Default: false
|
||||
* magic_get?: bool|Param, // Default: true
|
||||
* magic_set?: bool|Param, // Default: true
|
||||
* throw_exception_on_invalid_index?: bool|Param, // Default: false
|
||||
* throw_exception_on_invalid_property_path?: bool|Param, // Default: true
|
||||
* },
|
||||
* type_info?: bool|array{ // Type info configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* aliases?: array<string, scalar|Param|null>,
|
||||
* },
|
||||
* property_info?: bool|array{ // Property info configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* with_constructor_extractor?: bool|Param, // Registers the constructor extractor.
|
||||
* },
|
||||
* cache?: array{ // Cache configuration
|
||||
* prefix_seed?: scalar|Param|null, // Used to namespace cache keys when using several apps with the same shared backend. // Default: "_%kernel.project_dir%.%kernel.container_class%"
|
||||
* app?: scalar|Param|null, // App related cache pools configuration. // Default: "cache.adapter.filesystem"
|
||||
* system?: scalar|Param|null, // System related cache pools configuration. // Default: "cache.adapter.system"
|
||||
* directory?: scalar|Param|null, // Default: "%kernel.share_dir%/pools/app"
|
||||
* default_psr6_provider?: scalar|Param|null,
|
||||
* default_redis_provider?: scalar|Param|null, // Default: "redis://localhost"
|
||||
* default_valkey_provider?: scalar|Param|null, // Default: "valkey://localhost"
|
||||
* default_memcached_provider?: scalar|Param|null, // Default: "memcached://localhost"
|
||||
* default_doctrine_dbal_provider?: scalar|Param|null, // Default: "database_connection"
|
||||
* default_pdo_provider?: scalar|Param|null, // Default: null
|
||||
* pools?: array<string, array{ // Default: []
|
||||
* adapters?: Param|string|list<scalar|Param|null>,
|
||||
* tags?: scalar|Param|null, // Default: null
|
||||
* public?: bool|Param, // Default: false
|
||||
* default_lifetime?: scalar|Param|null, // Default lifetime of the pool.
|
||||
* provider?: scalar|Param|null, // Overwrite the setting from the default provider for this adapter.
|
||||
* early_expiration_message_bus?: scalar|Param|null,
|
||||
* clearer?: scalar|Param|null,
|
||||
* }>,
|
||||
* },
|
||||
* php_errors?: array{ // PHP errors handling configuration
|
||||
* log?: mixed, // Use the application logger instead of the PHP logger for logging PHP errors. // Default: true
|
||||
* throw?: bool|Param, // Throw PHP errors as \ErrorException instances. // Default: true
|
||||
* },
|
||||
* exceptions?: array<string, array{ // Default: []
|
||||
* log_level?: scalar|Param|null, // The level of log message. Null to let Symfony decide. // Default: null
|
||||
* status_code?: scalar|Param|null, // The status code of the response. Null or 0 to let Symfony decide. // Default: null
|
||||
* log_channel?: scalar|Param|null, // The channel of log message. Null to let Symfony decide. // Default: null
|
||||
* }>,
|
||||
* web_link?: bool|array{ // Web links configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* },
|
||||
* lock?: Param|bool|string|array{ // Lock configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* resources?: Param|string|array<string, Param|string|list<scalar|Param|null>>,
|
||||
* },
|
||||
* semaphore?: Param|bool|string|array{ // Semaphore configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* resources?: Param|string|array<string, scalar|Param|null>,
|
||||
* },
|
||||
* messenger?: bool|array{ // Messenger configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* routing?: array<string, Param|string|array{ // Default: []
|
||||
* senders?: list<scalar|Param|null>,
|
||||
* }>,
|
||||
* serializer?: array{
|
||||
* default_serializer?: scalar|Param|null, // Service id to use as the default serializer for the transports. // Default: "messenger.transport.native_php_serializer"
|
||||
* symfony_serializer?: array{
|
||||
* format?: scalar|Param|null, // Serialization format for the messenger.transport.symfony_serializer service (which is not the serializer used by default). // Default: "json"
|
||||
* context?: array<string, mixed>,
|
||||
* },
|
||||
* },
|
||||
* transports?: array<string, Param|string|array{ // Default: []
|
||||
* dsn?: scalar|Param|null,
|
||||
* serializer?: scalar|Param|null, // Service id of a custom serializer to use. // Default: null
|
||||
* options?: array<string, mixed>,
|
||||
* failure_transport?: scalar|Param|null, // Transport name to send failed messages to (after all retries have failed). // Default: null
|
||||
* retry_strategy?: Param|string|array{
|
||||
* service?: scalar|Param|null, // Service id to override the retry strategy entirely. // Default: null
|
||||
* max_retries?: int|Param, // Default: 3
|
||||
* delay?: int|Param, // Time in ms to delay (or the initial value when multiplier is used). // Default: 1000
|
||||
* multiplier?: float|Param, // If greater than 1, delay will grow exponentially for each retry: this delay = (delay * (multiple ^ retries)). // Default: 2
|
||||
* max_delay?: int|Param, // Max time in ms that a retry should ever be delayed (0 = infinite). // Default: 0
|
||||
* jitter?: float|Param, // Randomness to apply to the delay (between 0 and 1). // Default: 0.1
|
||||
* },
|
||||
* rate_limiter?: scalar|Param|null, // Rate limiter name to use when processing messages. // Default: null
|
||||
* }>,
|
||||
* failure_transport?: scalar|Param|null, // Transport name to send failed messages to (after all retries have failed). // Default: null
|
||||
* stop_worker_on_signals?: Param|int|string|list<scalar|Param|null>,
|
||||
* default_bus?: scalar|Param|null, // Default: null
|
||||
* buses?: array<string, array{ // Default: {"messenger.bus.default":{"default_middleware":{"enabled":true,"allow_no_handlers":false,"allow_no_senders":true},"middleware":[]}}
|
||||
* default_middleware?: Param|bool|string|array{
|
||||
* enabled?: bool|Param, // Default: true
|
||||
* allow_no_handlers?: bool|Param, // Default: false
|
||||
* allow_no_senders?: bool|Param, // Default: true
|
||||
* },
|
||||
* middleware?: Param|string|list<Param|string|array{ // Default: []
|
||||
* id?: scalar|Param|null,
|
||||
* arguments?: list<mixed>,
|
||||
* }>,
|
||||
* }>,
|
||||
* },
|
||||
* scheduler?: bool|array{ // Scheduler configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* },
|
||||
* disallow_search_engine_index?: bool|Param, // Enabled by default when debug is enabled. // Default: true
|
||||
* http_client?: bool|array{ // HTTP Client configuration
|
||||
* enabled?: bool|Param, // Default: true
|
||||
* max_host_connections?: int|Param, // The maximum number of connections to a single host.
|
||||
* default_options?: array{
|
||||
* headers?: array<string, mixed>,
|
||||
* vars?: array<string, mixed>,
|
||||
* max_redirects?: int|Param, // The maximum number of redirects to follow.
|
||||
* http_version?: scalar|Param|null, // The default HTTP version, typically 1.1 or 2.0, leave to null for the best version.
|
||||
* resolve?: array<string, scalar|Param|null>,
|
||||
* proxy?: scalar|Param|null, // The URL of the proxy to pass requests through or null for automatic detection.
|
||||
* no_proxy?: scalar|Param|null, // A comma separated list of hosts that do not require a proxy to be reached.
|
||||
* timeout?: float|Param, // The idle timeout, defaults to the "default_socket_timeout" ini parameter.
|
||||
* max_duration?: float|Param, // The maximum execution time for the request+response as a whole.
|
||||
* bindto?: scalar|Param|null, // A network interface name, IP address, a host name or a UNIX socket to bind to.
|
||||
* verify_peer?: bool|Param, // Indicates if the peer should be verified in a TLS context.
|
||||
* verify_host?: bool|Param, // Indicates if the host should exist as a certificate common name.
|
||||
* cafile?: scalar|Param|null, // A certificate authority file.
|
||||
* capath?: scalar|Param|null, // A directory that contains multiple certificate authority files.
|
||||
* local_cert?: scalar|Param|null, // A PEM formatted certificate file.
|
||||
* local_pk?: scalar|Param|null, // A private key file.
|
||||
* passphrase?: scalar|Param|null, // The passphrase used to encrypt the "local_pk" file.
|
||||
* ciphers?: scalar|Param|null, // A list of TLS ciphers separated by colons, commas or spaces (e.g. "RC3-SHA:TLS13-AES-128-GCM-SHA256"...)
|
||||
* peer_fingerprint?: array{ // Associative array: hashing algorithm => hash(es).
|
||||
* sha1?: mixed,
|
||||
* pin-sha256?: mixed,
|
||||
* md5?: mixed,
|
||||
* },
|
||||
* crypto_method?: scalar|Param|null, // The minimum version of TLS to accept; must be one of STREAM_CRYPTO_METHOD_TLSv*_CLIENT constants.
|
||||
* extra?: array<string, mixed>,
|
||||
* rate_limiter?: scalar|Param|null, // Rate limiter name to use for throttling requests. // Default: null
|
||||
* caching?: bool|array{ // Caching configuration.
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* cache_pool?: string|Param, // The taggable cache pool to use for storing the responses. // Default: "cache.http_client"
|
||||
* shared?: bool|Param, // Indicates whether the cache is shared (public) or private. // Default: true
|
||||
* max_ttl?: int|Param, // The maximum TTL (in seconds) allowed for cached responses. Null means no cap. // Default: null
|
||||
* },
|
||||
* retry_failed?: bool|array{
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* retry_strategy?: scalar|Param|null, // service id to override the retry strategy. // Default: null
|
||||
* http_codes?: Param|int|string|array<string, array{ // Default: []
|
||||
* code?: int|Param,
|
||||
* methods?: Param|string|list<string|Param>,
|
||||
* }>,
|
||||
* max_retries?: int|Param, // Default: 3
|
||||
* delay?: int|Param, // Time in ms to delay (or the initial value when multiplier is used). // Default: 1000
|
||||
* multiplier?: float|Param, // If greater than 1, delay will grow exponentially for each retry: delay * (multiple ^ retries). // Default: 2
|
||||
* max_delay?: int|Param, // Max time in ms that a retry should ever be delayed (0 = infinite). // Default: 0
|
||||
* jitter?: float|Param, // Randomness in percent (between 0 and 1) to apply to the delay. // Default: 0.1
|
||||
* },
|
||||
* },
|
||||
* mock_response_factory?: scalar|Param|null, // The id of the service that should generate mock responses. It should be either an invokable or an iterable.
|
||||
* scoped_clients?: array<string, Param|string|array{ // Default: []
|
||||
* scope?: scalar|Param|null, // The regular expression that the request URL must match before adding the other options. When none is provided, the base URI is used instead.
|
||||
* base_uri?: scalar|Param|null, // The URI to resolve relative URLs, following rules in RFC 3985, section 2.
|
||||
* auth_basic?: scalar|Param|null, // An HTTP Basic authentication "username:password".
|
||||
* auth_bearer?: scalar|Param|null, // A token enabling HTTP Bearer authorization.
|
||||
* auth_ntlm?: scalar|Param|null, // A "username:password" pair to use Microsoft NTLM authentication (requires the cURL extension).
|
||||
* query?: array<string, scalar|Param|null>,
|
||||
* headers?: array<string, mixed>,
|
||||
* max_redirects?: int|Param, // The maximum number of redirects to follow.
|
||||
* http_version?: scalar|Param|null, // The default HTTP version, typically 1.1 or 2.0, leave to null for the best version.
|
||||
* resolve?: array<string, scalar|Param|null>,
|
||||
* proxy?: scalar|Param|null, // The URL of the proxy to pass requests through or null for automatic detection.
|
||||
* no_proxy?: scalar|Param|null, // A comma separated list of hosts that do not require a proxy to be reached.
|
||||
* timeout?: float|Param, // The idle timeout, defaults to the "default_socket_timeout" ini parameter.
|
||||
* max_duration?: float|Param, // The maximum execution time for the request+response as a whole.
|
||||
* bindto?: scalar|Param|null, // A network interface name, IP address, a host name or a UNIX socket to bind to.
|
||||
* verify_peer?: bool|Param, // Indicates if the peer should be verified in a TLS context.
|
||||
* verify_host?: bool|Param, // Indicates if the host should exist as a certificate common name.
|
||||
* cafile?: scalar|Param|null, // A certificate authority file.
|
||||
* capath?: scalar|Param|null, // A directory that contains multiple certificate authority files.
|
||||
* local_cert?: scalar|Param|null, // A PEM formatted certificate file.
|
||||
* local_pk?: scalar|Param|null, // A private key file.
|
||||
* passphrase?: scalar|Param|null, // The passphrase used to encrypt the "local_pk" file.
|
||||
* ciphers?: scalar|Param|null, // A list of TLS ciphers separated by colons, commas or spaces (e.g. "RC3-SHA:TLS13-AES-128-GCM-SHA256"...).
|
||||
* peer_fingerprint?: array{ // Associative array: hashing algorithm => hash(es).
|
||||
* sha1?: mixed,
|
||||
* pin-sha256?: mixed,
|
||||
* md5?: mixed,
|
||||
* },
|
||||
* crypto_method?: scalar|Param|null, // The minimum version of TLS to accept; must be one of STREAM_CRYPTO_METHOD_TLSv*_CLIENT constants.
|
||||
* extra?: array<string, mixed>,
|
||||
* rate_limiter?: scalar|Param|null, // Rate limiter name to use for throttling requests. // Default: null
|
||||
* caching?: bool|array{ // Caching configuration.
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* cache_pool?: string|Param, // The taggable cache pool to use for storing the responses. // Default: "cache.http_client"
|
||||
* shared?: bool|Param, // Indicates whether the cache is shared (public) or private. // Default: true
|
||||
* max_ttl?: int|Param, // The maximum TTL (in seconds) allowed for cached responses. Null means no cap. // Default: null
|
||||
* },
|
||||
* retry_failed?: bool|array{
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* retry_strategy?: scalar|Param|null, // service id to override the retry strategy. // Default: null
|
||||
* http_codes?: Param|int|string|array<string, array{ // Default: []
|
||||
* code?: int|Param,
|
||||
* methods?: Param|string|list<string|Param>,
|
||||
* }>,
|
||||
* max_retries?: int|Param, // Default: 3
|
||||
* delay?: int|Param, // Time in ms to delay (or the initial value when multiplier is used). // Default: 1000
|
||||
* multiplier?: float|Param, // If greater than 1, delay will grow exponentially for each retry: delay * (multiple ^ retries). // Default: 2
|
||||
* max_delay?: int|Param, // Max time in ms that a retry should ever be delayed (0 = infinite). // Default: 0
|
||||
* jitter?: float|Param, // Randomness in percent (between 0 and 1) to apply to the delay. // Default: 0.1
|
||||
* },
|
||||
* }>,
|
||||
* },
|
||||
* mailer?: bool|array{ // Mailer configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* message_bus?: scalar|Param|null, // The message bus to use. Defaults to the default bus if the Messenger component is installed. // Default: null
|
||||
* dsn?: scalar|Param|null, // Default: null
|
||||
* transports?: array<string, scalar|Param|null>,
|
||||
* envelope?: array{ // Mailer Envelope configuration
|
||||
* sender?: scalar|Param|null,
|
||||
* recipients?: Param|string|list<scalar|Param|null>,
|
||||
* allowed_recipients?: Param|string|list<scalar|Param|null>,
|
||||
* },
|
||||
* headers?: array<string, Param|string|array{ // Default: []
|
||||
* value?: mixed,
|
||||
* }>,
|
||||
* dkim_signer?: bool|array{ // DKIM signer configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* key?: scalar|Param|null, // Key content, or path to key (in PEM format with the `file://` prefix) // Default: ""
|
||||
* domain?: scalar|Param|null, // Default: ""
|
||||
* select?: scalar|Param|null, // Default: ""
|
||||
* passphrase?: scalar|Param|null, // The private key passphrase // Default: ""
|
||||
* options?: array<string, mixed>,
|
||||
* },
|
||||
* smime_signer?: bool|array{ // S/MIME signer configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* key?: scalar|Param|null, // Path to key (in PEM format) // Default: ""
|
||||
* certificate?: scalar|Param|null, // Path to certificate (in PEM format without the `file://` prefix) // Default: ""
|
||||
* passphrase?: scalar|Param|null, // The private key passphrase // Default: null
|
||||
* extra_certificates?: scalar|Param|null, // Default: null
|
||||
* sign_options?: int|Param, // Default: null
|
||||
* },
|
||||
* smime_encrypter?: bool|array{ // S/MIME encrypter configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* repository?: scalar|Param|null, // S/MIME certificate repository service. This service shall implement the `Symfony\Component\Mailer\EventListener\SmimeCertificateRepositoryInterface`. // Default: ""
|
||||
* cipher?: int|Param, // A set of algorithms used to encrypt the message // Default: null
|
||||
* },
|
||||
* },
|
||||
* secrets?: bool|array{
|
||||
* enabled?: bool|Param, // Default: true
|
||||
* vault_directory?: scalar|Param|null, // Default: "%kernel.project_dir%/config/secrets/%kernel.runtime_environment%"
|
||||
* local_dotenv_file?: scalar|Param|null, // Default: "%kernel.project_dir%/.env.%kernel.environment%.local"
|
||||
* decryption_env_var?: scalar|Param|null, // Default: "base64:default::SYMFONY_DECRYPTION_SECRET"
|
||||
* },
|
||||
* notifier?: bool|array{ // Notifier configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* message_bus?: scalar|Param|null, // The message bus to use. Defaults to the default bus if the Messenger component is installed. // Default: null
|
||||
* chatter_transports?: array<string, scalar|Param|null>,
|
||||
* texter_transports?: array<string, scalar|Param|null>,
|
||||
* notification_on_failed_messages?: bool|Param, // Default: false
|
||||
* channel_policy?: array<string, Param|string|list<scalar|Param|null>>,
|
||||
* admin_recipients?: list<array{ // Default: []
|
||||
* email?: scalar|Param|null,
|
||||
* phone?: scalar|Param|null, // Default: ""
|
||||
* }>,
|
||||
* },
|
||||
* rate_limiter?: bool|array{ // Rate limiter configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* limiters?: array<string, array{ // Default: []
|
||||
* lock_factory?: scalar|Param|null, // The service ID of the lock factory used by this limiter (or null to disable locking). // Default: "auto"
|
||||
* cache_pool?: scalar|Param|null, // The cache pool to use for storing the current limiter state. // Default: "cache.rate_limiter"
|
||||
* storage_service?: scalar|Param|null, // The service ID of a custom storage implementation, this precedes any configured "cache_pool". // Default: null
|
||||
* policy?: "fixed_window"|"token_bucket"|"sliding_window"|"compound"|"no_limit"|Param, // The algorithm to be used by this limiter.
|
||||
* limiters?: Param|string|list<scalar|Param|null>,
|
||||
* limit?: int|Param, // The maximum allowed hits in a fixed interval or burst.
|
||||
* interval?: scalar|Param|null, // Configures the fixed interval if "policy" is set to "fixed_window" or "sliding_window". The value must be a number followed by "second", "minute", "hour", "day", "week" or "month" (or their plural equivalent).
|
||||
* rate?: array{ // Configures the fill rate if "policy" is set to "token_bucket".
|
||||
* interval?: scalar|Param|null, // Configures the rate interval. The value must be a number followed by "second", "minute", "hour", "day", "week" or "month" (or their plural equivalent).
|
||||
* amount?: int|Param, // Amount of tokens to add each interval. // Default: 1
|
||||
* },
|
||||
* }>,
|
||||
* },
|
||||
* uid?: bool|array{ // Uid configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* default_uuid_version?: 7|6|4|1|Param, // Default: 7
|
||||
* name_based_uuid_version?: 5|3|Param, // Default: 5
|
||||
* name_based_uuid_namespace?: scalar|Param|null,
|
||||
* time_based_uuid_version?: 7|6|1|Param, // Default: 7
|
||||
* time_based_uuid_node?: scalar|Param|null,
|
||||
* },
|
||||
* html_sanitizer?: bool|array{ // HtmlSanitizer configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* sanitizers?: array<string, array{ // Default: []
|
||||
* allow_safe_elements?: bool|Param, // Allows "safe" elements and attributes. // Default: false
|
||||
* allow_static_elements?: bool|Param, // Allows all static elements and attributes from the W3C Sanitizer API standard. // Default: false
|
||||
* allow_elements?: array<string, mixed>,
|
||||
* block_elements?: Param|string|list<string|Param>,
|
||||
* drop_elements?: Param|string|list<string|Param>,
|
||||
* allow_attributes?: array<string, mixed>,
|
||||
* drop_attributes?: array<string, mixed>,
|
||||
* force_attributes?: array<string, array<string, string|Param>>,
|
||||
* force_https_urls?: bool|Param, // Transforms URLs using the HTTP scheme to use the HTTPS scheme instead. // Default: false
|
||||
* allowed_link_schemes?: Param|string|list<string|Param>,
|
||||
* allowed_link_hosts?: Param|null|string|list<string|Param>,
|
||||
* allow_relative_links?: bool|Param, // Allows relative URLs to be used in links href attributes. // Default: false
|
||||
* allowed_media_schemes?: Param|string|list<string|Param>,
|
||||
* allowed_media_hosts?: Param|null|string|list<string|Param>,
|
||||
* allow_relative_medias?: bool|Param, // Allows relative URLs to be used in media source attributes (img, audio, video, ...). // Default: false
|
||||
* with_attribute_sanitizers?: Param|string|list<string|Param>,
|
||||
* without_attribute_sanitizers?: Param|string|list<string|Param>,
|
||||
* max_input_length?: int|Param, // The maximum length allowed for the sanitized input. // Default: 0
|
||||
* }>,
|
||||
* },
|
||||
* webhook?: bool|array{ // Webhook configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* message_bus?: scalar|Param|null, // The message bus to use. // Default: "messenger.default_bus"
|
||||
* routing?: array<string, array{ // Default: []
|
||||
* service?: scalar|Param|null,
|
||||
* secret?: scalar|Param|null, // Default: ""
|
||||
* }>,
|
||||
* },
|
||||
* remote-event?: bool|array{ // RemoteEvent configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* },
|
||||
* json_streamer?: bool|array{ // JSON streamer configuration
|
||||
* enabled?: bool|Param, // Default: false
|
||||
* },
|
||||
* }
|
||||
* @psalm-type MakerConfig = array{
|
||||
* root_namespace?: scalar|Param|null, // Default: "App"
|
||||
* generate_final_classes?: bool|Param, // Default: true
|
||||
* generate_final_entities?: bool|Param, // Default: false
|
||||
* }
|
||||
* @psalm-type MonologConfig = array{
|
||||
* use_microseconds?: scalar|Param|null, // Default: true
|
||||
* channels?: list<scalar|Param|null>,
|
||||
* handlers?: array<string, array{ // Default: []
|
||||
* type?: scalar|Param|null,
|
||||
* id?: scalar|Param|null,
|
||||
* enabled?: bool|Param, // Default: true
|
||||
* priority?: scalar|Param|null, // Default: 0
|
||||
* level?: scalar|Param|null, // Default: "DEBUG"
|
||||
* bubble?: bool|Param, // Default: true
|
||||
* interactive_only?: bool|Param, // Default: false
|
||||
* app_name?: scalar|Param|null, // Default: null
|
||||
* include_stacktraces?: bool|Param, // Default: false
|
||||
* process_psr_3_messages?: array{
|
||||
* enabled?: bool|Param|null, // Default: null
|
||||
* date_format?: scalar|Param|null,
|
||||
* remove_used_context_fields?: bool|Param,
|
||||
* },
|
||||
* path?: scalar|Param|null, // Default: "%kernel.logs_dir%/%kernel.environment%.log"
|
||||
* file_permission?: scalar|Param|null, // Default: null
|
||||
* use_locking?: bool|Param, // Default: false
|
||||
* filename_format?: scalar|Param|null, // Default: "{filename}-{date}"
|
||||
* date_format?: scalar|Param|null, // Default: "Y-m-d"
|
||||
* ident?: scalar|Param|null, // Default: false
|
||||
* logopts?: scalar|Param|null, // Default: 1
|
||||
* facility?: scalar|Param|null, // Default: "user"
|
||||
* max_files?: scalar|Param|null, // Default: 0
|
||||
* action_level?: scalar|Param|null, // Default: "WARNING"
|
||||
* activation_strategy?: scalar|Param|null, // Default: null
|
||||
* stop_buffering?: bool|Param, // Default: true
|
||||
* passthru_level?: scalar|Param|null, // Default: null
|
||||
* excluded_http_codes?: list<array{ // Default: []
|
||||
* code?: scalar|Param|null,
|
||||
* urls?: list<scalar|Param|null>,
|
||||
* }>,
|
||||
* accepted_levels?: list<scalar|Param|null>,
|
||||
* min_level?: scalar|Param|null, // Default: "DEBUG"
|
||||
* max_level?: scalar|Param|null, // Default: "EMERGENCY"
|
||||
* buffer_size?: scalar|Param|null, // Default: 0
|
||||
* flush_on_overflow?: bool|Param, // Default: false
|
||||
* handler?: scalar|Param|null,
|
||||
* url?: scalar|Param|null,
|
||||
* exchange?: scalar|Param|null,
|
||||
* exchange_name?: scalar|Param|null, // Default: "log"
|
||||
* channel?: scalar|Param|null, // Default: null
|
||||
* bot_name?: scalar|Param|null, // Default: "Monolog"
|
||||
* use_attachment?: scalar|Param|null, // Default: true
|
||||
* use_short_attachment?: scalar|Param|null, // Default: false
|
||||
* include_extra?: scalar|Param|null, // Default: false
|
||||
* icon_emoji?: scalar|Param|null, // Default: null
|
||||
* webhook_url?: scalar|Param|null,
|
||||
* exclude_fields?: list<scalar|Param|null>,
|
||||
* token?: scalar|Param|null,
|
||||
* region?: scalar|Param|null,
|
||||
* source?: scalar|Param|null,
|
||||
* use_ssl?: bool|Param, // Default: true
|
||||
* user?: mixed,
|
||||
* title?: scalar|Param|null, // Default: null
|
||||
* host?: scalar|Param|null, // Default: null
|
||||
* port?: scalar|Param|null, // Default: 514
|
||||
* config?: list<scalar|Param|null>,
|
||||
* members?: list<scalar|Param|null>,
|
||||
* connection_string?: scalar|Param|null,
|
||||
* timeout?: scalar|Param|null,
|
||||
* time?: scalar|Param|null, // Default: 60
|
||||
* deduplication_level?: scalar|Param|null, // Default: 400
|
||||
* store?: scalar|Param|null, // Default: null
|
||||
* connection_timeout?: scalar|Param|null,
|
||||
* persistent?: bool|Param,
|
||||
* message_type?: scalar|Param|null, // Default: 0
|
||||
* parse_mode?: scalar|Param|null, // Default: null
|
||||
* disable_webpage_preview?: bool|Param|null, // Default: null
|
||||
* disable_notification?: bool|Param|null, // Default: null
|
||||
* split_long_messages?: bool|Param, // Default: false
|
||||
* delay_between_messages?: bool|Param, // Default: false
|
||||
* topic?: int|Param, // Default: null
|
||||
* factor?: int|Param, // Default: 1
|
||||
* tags?: Param|string|list<scalar|Param|null>,
|
||||
* console_formatter_options?: mixed, // Default: []
|
||||
* formatter?: scalar|Param|null,
|
||||
* nested?: bool|Param, // Default: false
|
||||
* publisher?: Param|string|array{
|
||||
* id?: scalar|Param|null,
|
||||
* hostname?: scalar|Param|null,
|
||||
* port?: scalar|Param|null, // Default: 12201
|
||||
* chunk_size?: scalar|Param|null, // Default: 1420
|
||||
* encoder?: "json"|"compressed_json"|Param,
|
||||
* },
|
||||
* mongodb?: Param|string|array{
|
||||
* id?: scalar|Param|null, // ID of a MongoDB\Client service
|
||||
* uri?: scalar|Param|null,
|
||||
* username?: scalar|Param|null,
|
||||
* password?: scalar|Param|null,
|
||||
* database?: scalar|Param|null, // Default: "monolog"
|
||||
* collection?: scalar|Param|null, // Default: "logs"
|
||||
* },
|
||||
* elasticsearch?: Param|string|array{
|
||||
* id?: scalar|Param|null,
|
||||
* hosts?: list<scalar|Param|null>,
|
||||
* host?: scalar|Param|null,
|
||||
* port?: scalar|Param|null, // Default: 9200
|
||||
* transport?: scalar|Param|null, // Default: "Http"
|
||||
* user?: scalar|Param|null, // Default: null
|
||||
* password?: scalar|Param|null, // Default: null
|
||||
* },
|
||||
* index?: scalar|Param|null, // Default: "monolog"
|
||||
* document_type?: scalar|Param|null, // Default: "logs"
|
||||
* ignore_error?: scalar|Param|null, // Default: false
|
||||
* redis?: Param|string|array{
|
||||
* id?: scalar|Param|null,
|
||||
* host?: scalar|Param|null,
|
||||
* password?: scalar|Param|null, // Default: null
|
||||
* port?: scalar|Param|null, // Default: 6379
|
||||
* database?: scalar|Param|null, // Default: 0
|
||||
* key_name?: scalar|Param|null, // Default: "monolog_redis"
|
||||
* },
|
||||
* predis?: Param|string|array{
|
||||
* id?: scalar|Param|null,
|
||||
* host?: scalar|Param|null,
|
||||
* },
|
||||
* from_email?: scalar|Param|null,
|
||||
* to_email?: Param|string|list<scalar|Param|null>,
|
||||
* subject?: scalar|Param|null,
|
||||
* content_type?: scalar|Param|null, // Default: null
|
||||
* headers?: list<scalar|Param|null>,
|
||||
* mailer?: scalar|Param|null, // Default: null
|
||||
* email_prototype?: Param|string|array{
|
||||
* id?: scalar|Param|null,
|
||||
* method?: scalar|Param|null, // Default: null
|
||||
* },
|
||||
* verbosity_levels?: array{
|
||||
* VERBOSITY_QUIET?: scalar|Param|null, // Default: "ERROR"
|
||||
* VERBOSITY_NORMAL?: scalar|Param|null, // Default: "WARNING"
|
||||
* VERBOSITY_VERBOSE?: scalar|Param|null, // Default: "NOTICE"
|
||||
* VERBOSITY_VERY_VERBOSE?: scalar|Param|null, // Default: "INFO"
|
||||
* VERBOSITY_DEBUG?: scalar|Param|null, // Default: "DEBUG"
|
||||
* },
|
||||
* channels?: Param|string|array{
|
||||
* type?: scalar|Param|null,
|
||||
* elements?: list<scalar|Param|null>,
|
||||
* },
|
||||
* }>,
|
||||
* }
|
||||
* @psalm-type ConfigType = array{
|
||||
* imports?: ImportsConfig,
|
||||
* parameters?: ParametersConfig,
|
||||
* services?: ServicesConfig,
|
||||
* framework?: FrameworkConfig,
|
||||
* monolog?: MonologConfig,
|
||||
* "when@dev"?: array{
|
||||
* imports?: ImportsConfig,
|
||||
* parameters?: ParametersConfig,
|
||||
* services?: ServicesConfig,
|
||||
* framework?: FrameworkConfig,
|
||||
* maker?: MakerConfig,
|
||||
* monolog?: MonologConfig,
|
||||
* },
|
||||
* "when@prod"?: array{
|
||||
* imports?: ImportsConfig,
|
||||
* parameters?: ParametersConfig,
|
||||
* services?: ServicesConfig,
|
||||
* framework?: FrameworkConfig,
|
||||
* monolog?: MonologConfig,
|
||||
* },
|
||||
* "when@test"?: array{
|
||||
* imports?: ImportsConfig,
|
||||
* parameters?: ParametersConfig,
|
||||
* services?: ServicesConfig,
|
||||
* framework?: FrameworkConfig,
|
||||
* monolog?: MonologConfig,
|
||||
* },
|
||||
* ...<string, ExtensionType|array{ // extra keys must follow the when@%env% pattern or match an extension alias
|
||||
* imports?: ImportsConfig,
|
||||
* parameters?: ParametersConfig,
|
||||
* services?: ServicesConfig,
|
||||
* ...<string, ExtensionType>,
|
||||
* }>
|
||||
* }
|
||||
*/
|
||||
final class App
|
||||
{
|
||||
/**
|
||||
* @param ConfigType $config
|
||||
*
|
||||
* @psalm-return ConfigType
|
||||
*/
|
||||
public static function config(array $config): array
|
||||
{
|
||||
/** @var ConfigType $config */
|
||||
$config = AppReference::config($config);
|
||||
|
||||
return $config;
|
||||
}
|
||||
}
|
||||
|
||||
namespace Symfony\Component\Routing\Loader\Configurator;
|
||||
|
||||
/**
|
||||
* This class provides array-shapes for configuring the routes of an application.
|
||||
*
|
||||
* Example:
|
||||
*
|
||||
* ```php
|
||||
* // config/routes.php
|
||||
* namespace Symfony\Component\Routing\Loader\Configurator;
|
||||
*
|
||||
* return Routes::config([
|
||||
* 'controllers' => [
|
||||
* 'resource' => 'routing.controllers',
|
||||
* ],
|
||||
* ]);
|
||||
* ```
|
||||
*
|
||||
* @psalm-type RouteConfig = array{
|
||||
* path: string|array<string,string>,
|
||||
* controller?: string,
|
||||
* methods?: string|list<string>,
|
||||
* requirements?: array<string,string>,
|
||||
* defaults?: array<string,mixed>,
|
||||
* options?: array<string,mixed>,
|
||||
* host?: string|array<string,string>,
|
||||
* schemes?: string|list<string>,
|
||||
* condition?: string,
|
||||
* locale?: string,
|
||||
* format?: string,
|
||||
* utf8?: bool,
|
||||
* stateless?: bool,
|
||||
* }
|
||||
* @psalm-type ImportConfig = array{
|
||||
* resource: string,
|
||||
* type?: string,
|
||||
* exclude?: string|list<string>,
|
||||
* prefix?: string|array<string,string>,
|
||||
* name_prefix?: string,
|
||||
* trailing_slash_on_root?: bool,
|
||||
* controller?: string,
|
||||
* methods?: string|list<string>,
|
||||
* requirements?: array<string,string>,
|
||||
* defaults?: array<string,mixed>,
|
||||
* options?: array<string,mixed>,
|
||||
* host?: string|array<string,string>,
|
||||
* schemes?: string|list<string>,
|
||||
* condition?: string,
|
||||
* locale?: string,
|
||||
* format?: string,
|
||||
* utf8?: bool,
|
||||
* stateless?: bool,
|
||||
* }
|
||||
* @psalm-type AliasConfig = array{
|
||||
* alias: string,
|
||||
* deprecated?: array{package:string, version:string, message?:string},
|
||||
* }
|
||||
* @psalm-type RoutesConfig = array{
|
||||
* "when@dev"?: array<string, RouteConfig|ImportConfig|AliasConfig>,
|
||||
* "when@prod"?: array<string, RouteConfig|ImportConfig|AliasConfig>,
|
||||
* "when@test"?: array<string, RouteConfig|ImportConfig|AliasConfig>,
|
||||
* ...<string, RouteConfig|ImportConfig|AliasConfig>
|
||||
* }
|
||||
*/
|
||||
final class Routes
|
||||
{
|
||||
/**
|
||||
* @param RoutesConfig $config
|
||||
*
|
||||
* @psalm-return RoutesConfig
|
||||
*/
|
||||
public static function config(array $config): array
|
||||
{
|
||||
return $config;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,5 @@
|
||||
controllers:
|
||||
resource:
|
||||
path: ../src/Controller/
|
||||
namespace: App\Controller
|
||||
type: attribute
|
||||
@@ -0,0 +1,5 @@
|
||||
controllers:
|
||||
resource:
|
||||
path: ../../src/Controller/
|
||||
namespace: App\Controller
|
||||
type: attribute
|
||||
@@ -0,0 +1,4 @@
|
||||
when@dev:
|
||||
_errors:
|
||||
resource: '@FrameworkBundle/Resources/config/routing/errors.xml'
|
||||
prefix: /_error
|
||||
@@ -0,0 +1,58 @@
|
||||
# yaml-language-server: $schema=../vendor/symfony/dependency-injection/Loader/schema/services.schema.json
|
||||
parameters:
|
||||
keycloak.base_url: '%env(KEYCLOAK_BASE_URL)%'
|
||||
keycloak.realm: '%env(KEYCLOAK_REALM)%'
|
||||
keycloak.client_id: '%env(KEYCLOAK_CLIENT_ID)%'
|
||||
keycloak.client_secret: '%env(KEYCLOAK_CLIENT_SECRET)%'
|
||||
keycloak.redirect_uri: '%env(KEYCLOAK_REDIRECT_URI)%'
|
||||
keycloak.post_logout_redirect: '%env(KEYCLOAK_POST_LOGOUT_REDIRECT)%'
|
||||
|
||||
# Allowlist of Appsmith apps this BFF will redirect back to, each with
|
||||
# the Keycloak client role (on the bff client) required to enter it.
|
||||
# Add one entry per app you build. Never accept a return URL from the
|
||||
# request itself — always resolve through this map.
|
||||
appsmith.apps:
|
||||
app-sandbox:
|
||||
url: '%env(APP_SANDBOX_LOGIN_URL)%'
|
||||
role: 'app-sandbox-access'
|
||||
|
||||
# Named backends the proxy can forward to. A request picks one via the
|
||||
# X-Backend header; omitting it uses "default". Add BACKEND_<KEY>_URL to
|
||||
# .env and one entry here per backend. Any app may call any backend key
|
||||
# — the backend is expected to do its own authorization off the roles
|
||||
# claim in the forwarded access token (see README).
|
||||
backends:
|
||||
default:
|
||||
url: '%env(BACKEND_BASE_URL)%'
|
||||
|
||||
services:
|
||||
_defaults:
|
||||
autowire: true
|
||||
autoconfigure: true
|
||||
bind:
|
||||
$kcBaseUrl: '%keycloak.base_url%'
|
||||
$kcRealm: '%keycloak.realm%'
|
||||
$kcClientId: '%keycloak.client_id%'
|
||||
$kcClientSecret: '%keycloak.client_secret%'
|
||||
$kcRedirectUri: '%keycloak.redirect_uri%'
|
||||
|
||||
App\:
|
||||
resource: '../src/'
|
||||
exclude:
|
||||
- '../src/Kernel.php'
|
||||
|
||||
App\Session\BffSessionStore:
|
||||
arguments:
|
||||
$cache: '@bff.session_cache'
|
||||
|
||||
App\Security\AppRegistry:
|
||||
arguments:
|
||||
$apps: '%appsmith.apps%'
|
||||
|
||||
App\Security\BackendRegistry:
|
||||
arguments:
|
||||
$backends: '%backends%'
|
||||
|
||||
App\Controller\AuthController:
|
||||
arguments:
|
||||
$postLogoutRedirect: '%keycloak.post_logout_redirect%'
|
||||
+100
@@ -0,0 +1,100 @@
|
||||
<?php
|
||||
|
||||
namespace Deployer;
|
||||
|
||||
require 'contrib/cachetool.php';
|
||||
require 'contrib/rsync.php';
|
||||
require 'recipe/symfony.php';
|
||||
|
||||
add('shared_dirs', [
|
||||
'var/log',
|
||||
'var/sessions',
|
||||
]);
|
||||
|
||||
add('shared_files', [
|
||||
'public/.htaccess',
|
||||
]);
|
||||
|
||||
set('keep_releases', 3);
|
||||
|
||||
// Rsync options, mainly files/dirs to exclude
|
||||
$rsyncOptions = [
|
||||
'exclude' => [
|
||||
'.claude',
|
||||
'.cursor',
|
||||
'.idea',
|
||||
'.vscode',
|
||||
'.DS_Store',
|
||||
'.ddev',
|
||||
'.git',
|
||||
'.github',
|
||||
'.jj',
|
||||
'node_modules',
|
||||
'.editorconfig',
|
||||
'.env.dev.local',
|
||||
'.env.dev.local.php',
|
||||
'.env.test',
|
||||
'.env.test.local',
|
||||
'.gitignore',
|
||||
'.nvmrc',
|
||||
'.php-cs-fixer.cache',
|
||||
'.php-cs-fixer.dist.php',
|
||||
'.phpunit.result.cache',
|
||||
'CLAUDE.md',
|
||||
'cypress*',
|
||||
'deploy.php',
|
||||
'docs',
|
||||
'package.json',
|
||||
'package-lock.json',
|
||||
'*.http',
|
||||
'http-client*.json',
|
||||
'postcss.config.js',
|
||||
'phpunit.xml.dist',
|
||||
'public/.htaccess',
|
||||
'tailwind.config.js',
|
||||
'webpack.config.js',
|
||||
'bin/.phpunit',
|
||||
'temp/',
|
||||
'tests/',
|
||||
'uploads/',
|
||||
'var/',
|
||||
],
|
||||
'exclude-file' => false,
|
||||
'include' => [],
|
||||
'include-file' => false,
|
||||
'filter' => [],
|
||||
'filter-file' => false,
|
||||
'filter-perdir' => false,
|
||||
'flags' => 'rz',
|
||||
'options' => ['delete', 'copy-links', 'chmod=D755,F664'],
|
||||
'timeout' => 300,
|
||||
];
|
||||
|
||||
host('prod')
|
||||
->setHostname('185.243.135.29')
|
||||
->setRemoteUser('p704161')
|
||||
->setForwardAgent(true)
|
||||
->setSshMultiplexing(true)
|
||||
->setDeployPath('/home/www/p704161/html/epbff')
|
||||
->set('writable_mode', 'chmod')
|
||||
->set('http_user', 'p704161')
|
||||
->set('bin/php', '/usr/local/bin/php')
|
||||
->set('rsync_src', __DIR__)
|
||||
->set('rsync', $rsyncOptions)
|
||||
->set('cachetool_args', '--web=SymfonyHttpClient --web-path={{current_path}}/public/ --web-url=https://bff.ep-reisen.net')
|
||||
;
|
||||
|
||||
task('deploy', [
|
||||
'deploy:info',
|
||||
'deploy:setup',
|
||||
'deploy:lock',
|
||||
'deploy:release',
|
||||
'rsync',
|
||||
'deploy:shared',
|
||||
'deploy:writable',
|
||||
'deploy:cache:clear',
|
||||
'cachetool:clear:opcache',
|
||||
'deploy:publish',
|
||||
]);
|
||||
|
||||
after('deploy:failed', 'deploy:unlock');
|
||||
@@ -0,0 +1,70 @@
|
||||
# Use the front controller as index file. It serves as a fallback solution when
|
||||
# every other rewrite/redirect fails (e.g. in an aliased environment without
|
||||
# mod_rewrite). Additionally, this reduces the matching process for the
|
||||
# start page (path "/") because otherwise Apache will apply the rewriting rules
|
||||
# to each configured DirectoryIndex file (e.g. index.php, index.html, index.pl).
|
||||
DirectoryIndex index.php
|
||||
|
||||
# By default, Apache does not evaluate symbolic links if you did not enable this
|
||||
# feature in your server configuration. Uncomment the following line if you
|
||||
# install assets as symlinks or if you experience problems related to symlinks
|
||||
# when compiling LESS/Sass/CoffeScript assets.
|
||||
# Options +SymLinksIfOwnerMatch
|
||||
|
||||
# Disabling MultiViews prevents unwanted negotiation, e.g. "/index" should not resolve
|
||||
# to the front controller "/index.php" but be rewritten to "/index.php/index".
|
||||
<IfModule mod_negotiation.c>
|
||||
Options -MultiViews
|
||||
</IfModule>
|
||||
|
||||
<IfModule mod_rewrite.c>
|
||||
# This Option needs to be enabled for RewriteRule, otherwise it will show an error like
|
||||
# 'Options FollowSymLinks or SymLinksIfOwnerMatch is off which implies that RewriteRule directive is forbidden'
|
||||
Options +SymLinksIfOwnerMatch
|
||||
|
||||
RewriteEngine On
|
||||
|
||||
# Determine the RewriteBase automatically and set it as environment variable.
|
||||
# If you are using Apache aliases to do mass virtual hosting or installed the
|
||||
# project in a subdirectory, the base path will be prepended to allow proper
|
||||
# resolution of the index.php file and to redirect to the correct URI. It will
|
||||
# work in environments without path prefix as well, providing a safe, one-size
|
||||
# fits all solution. But as you do not need it in this case, you can comment
|
||||
# the following 2 lines to eliminate the overhead.
|
||||
RewriteCond %{REQUEST_URI}::$0 ^(/.+)/(.*)::\2$
|
||||
RewriteRule .* - [E=BASE:%1]
|
||||
|
||||
# Sets the HTTP_AUTHORIZATION header removed by Apache
|
||||
RewriteCond %{HTTP:Authorization} .+
|
||||
RewriteRule ^ - [E=HTTP_AUTHORIZATION:%0]
|
||||
|
||||
# Redirect to URI without front controller to prevent duplicate content
|
||||
# (with and without `/index.php`). Only do this redirect on the initial
|
||||
# rewrite by Apache and not on subsequent cycles. Otherwise we would get an
|
||||
# endless redirect loop (request -> rewrite to front controller ->
|
||||
# redirect -> request -> ...).
|
||||
# So in case you get a "too many redirects" error or you always get redirected
|
||||
# to the start page because your Apache does not expose the REDIRECT_STATUS
|
||||
# environment variable, you have 2 choices:
|
||||
# - disable this feature by commenting the following 2 lines or
|
||||
# - use Apache >= 2.3.9 and replace all L flags by END flags and remove the
|
||||
# following RewriteCond (best solution)
|
||||
RewriteCond %{ENV:REDIRECT_STATUS} =""
|
||||
RewriteRule ^index\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
|
||||
|
||||
# If the requested filename exists, simply serve it.
|
||||
# We only want to let Apache serve files and not directories.
|
||||
# Rewrite all other queries to the front controller.
|
||||
RewriteCond %{REQUEST_FILENAME} !-f
|
||||
RewriteRule ^ %{ENV:BASE}/index.php [L]
|
||||
</IfModule>
|
||||
|
||||
<IfModule !mod_rewrite.c>
|
||||
<IfModule mod_alias.c>
|
||||
# When mod_rewrite is not available, we instruct a temporary redirect of
|
||||
# the start page to the front controller explicitly so that the website
|
||||
# and the generated links can still be used.
|
||||
RedirectMatch 307 ^/$ /index.php/
|
||||
# RedirectTemp cannot be used instead
|
||||
</IfModule>
|
||||
</IfModule>
|
||||
@@ -0,0 +1,9 @@
|
||||
<?php
|
||||
|
||||
use App\Kernel;
|
||||
|
||||
require_once dirname(__DIR__).'/vendor/autoload_runtime.php';
|
||||
|
||||
return function (array $context) {
|
||||
return new Kernel($context['APP_ENV'], (bool) $context['APP_DEBUG']);
|
||||
};
|
||||
@@ -0,0 +1,223 @@
|
||||
<?php
|
||||
|
||||
namespace App\Controller;
|
||||
|
||||
use App\Security\AppRegistry;
|
||||
use App\Security\IdTokenDecoder;
|
||||
use App\Session\BffSessionStore;
|
||||
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
|
||||
use Symfony\Component\HttpFoundation\JsonResponse;
|
||||
use Symfony\Component\HttpFoundation\RedirectResponse;
|
||||
use Symfony\Component\HttpFoundation\Request;
|
||||
use Symfony\Component\HttpFoundation\Response;
|
||||
use Symfony\Component\Routing\Attribute\Route;
|
||||
use Symfony\Contracts\HttpClient\HttpClientInterface;
|
||||
|
||||
class AuthController extends AbstractController
|
||||
{
|
||||
public function __construct(
|
||||
private readonly HttpClientInterface $client,
|
||||
private readonly BffSessionStore $store,
|
||||
private readonly IdTokenDecoder $idTokenDecoder,
|
||||
private readonly AppRegistry $apps,
|
||||
private readonly string $kcBaseUrl,
|
||||
private readonly string $kcRealm,
|
||||
private readonly string $kcClientId,
|
||||
private readonly string $kcClientSecret,
|
||||
private readonly string $kcRedirectUri,
|
||||
private readonly ?string $postLogoutRedirect = null,
|
||||
) {
|
||||
}
|
||||
|
||||
/**
|
||||
* Entry point every app's login page navigates to (full browser
|
||||
* redirect, e.g. via Appsmith's navigateTo — never a fetch/query,
|
||||
* since Appsmith queries run server-side and can't perform this leg).
|
||||
*/
|
||||
#[Route('/auth/login', methods: ['GET'])]
|
||||
public function login(Request $request): RedirectResponse
|
||||
{
|
||||
$appKey = (string) $request->query->get('app', '');
|
||||
if (!$this->apps->isValidApp($appKey)) {
|
||||
throw $this->createNotFoundException('Unknown or missing app key');
|
||||
}
|
||||
|
||||
$verifier = $this->base64UrlEncode(random_bytes(64));
|
||||
$challenge = $this->base64UrlEncode(hash('sha256', $verifier, true));
|
||||
$state = bin2hex(random_bytes(16));
|
||||
|
||||
// Plain Symfony session cookie, used only for this short
|
||||
// browser <-> Keycloak <-> browser leg. Not the app's session.
|
||||
$session = $request->getSession();
|
||||
$session->set('pkce_verifier', $verifier);
|
||||
$session->set('oauth_state', $state);
|
||||
$session->set('oauth_app', $appKey);
|
||||
|
||||
$params = http_build_query([
|
||||
'client_id' => $this->kcClientId,
|
||||
'response_type' => 'code',
|
||||
'scope' => 'openid profile email',
|
||||
'redirect_uri' => $this->kcRedirectUri,
|
||||
'state' => $state,
|
||||
'code_challenge' => $challenge,
|
||||
'code_challenge_method' => 'S256',
|
||||
]);
|
||||
|
||||
return new RedirectResponse(
|
||||
"{$this->kcBaseUrl}/realms/{$this->kcRealm}/protocol/openid-connect/auth?{$params}"
|
||||
);
|
||||
}
|
||||
|
||||
#[Route('/auth/callback', methods: ['GET'])]
|
||||
public function callback(Request $request): Response
|
||||
{
|
||||
$session = $request->getSession();
|
||||
|
||||
$expectedState = (string) $session->get('oauth_state', '');
|
||||
$givenState = (string) $request->query->get('state', '');
|
||||
if ($expectedState === '' || !hash_equals($expectedState, $givenState)) {
|
||||
return new Response('Invalid or missing state', 401);
|
||||
}
|
||||
|
||||
$appKey = (string) $session->get('oauth_app');
|
||||
$returnUrl = $this->apps->resolveReturnUrl($appKey);
|
||||
$requiredRole = $this->apps->requiredRole($appKey);
|
||||
|
||||
$response = $this->client->request(
|
||||
'POST',
|
||||
"{$this->kcBaseUrl}/realms/{$this->kcRealm}/protocol/openid-connect/token",
|
||||
[
|
||||
'body' => [
|
||||
'grant_type' => 'authorization_code',
|
||||
'client_id' => $this->kcClientId,
|
||||
'client_secret' => $this->kcClientSecret,
|
||||
'code' => $request->query->get('code'),
|
||||
'redirect_uri' => $this->kcRedirectUri,
|
||||
'code_verifier' => $session->get('pkce_verifier'),
|
||||
],
|
||||
]
|
||||
);
|
||||
$tokens = $response->toArray();
|
||||
|
||||
$idClaims = $this->idTokenDecoder->decode($tokens['id_token']);
|
||||
$kcSid = $idClaims['sid'] ?? null;
|
||||
if (!$kcSid) {
|
||||
throw new \RuntimeException('Keycloak did not issue a "sid" claim on the ID token');
|
||||
}
|
||||
|
||||
// Authorization gate: does this user hold the role required for
|
||||
// the app they're trying to enter? Checked against the access
|
||||
// token (not the ID token), since that's where client roles live.
|
||||
// This is the only enforcement point — the proxy trusts any
|
||||
// already-established session, by design, since "may this user
|
||||
// use app X" is a login-time question, not a per-request one.
|
||||
$accessClaims = $this->idTokenDecoder->decode($tokens['access_token']);
|
||||
if (!$this->hasRole($accessClaims, $requiredRole)) {
|
||||
$session->remove('pkce_verifier');
|
||||
$session->remove('oauth_state');
|
||||
$session->remove('oauth_app');
|
||||
|
||||
$separator = str_contains($returnUrl, '?') ? '&' : '?';
|
||||
|
||||
return new RedirectResponse($returnUrl . $separator . http_build_query(['error' => 'access_denied']));
|
||||
}
|
||||
|
||||
$session->remove('pkce_verifier');
|
||||
$session->remove('oauth_state');
|
||||
$session->remove('oauth_app');
|
||||
|
||||
// Same kcSid -> same entry, whichever app is logging in. If another
|
||||
// app already created this session, this simply refreshes it.
|
||||
$this->store->put($kcSid, [
|
||||
'user_id' => $idClaims['sub'],
|
||||
'access_token' => $tokens['access_token'],
|
||||
'refresh_token' => $tokens['refresh_token'],
|
||||
'id_token' => $tokens['id_token'],
|
||||
'expires_at' => time() + (int) $tokens['expires_in'],
|
||||
'profile' => [
|
||||
'email' => $idClaims['email'] ?? null,
|
||||
'email_verified' => $idClaims['email_verified'] ?? null,
|
||||
'name' => $idClaims['name'] ?? null,
|
||||
'given_name' => $idClaims['given_name'] ?? null,
|
||||
'family_name' => $idClaims['family_name'] ?? null,
|
||||
'preferred_username' => $idClaims['preferred_username'] ?? null,
|
||||
],
|
||||
]);
|
||||
|
||||
$separator = str_contains($returnUrl, '?') ? '&' : '?';
|
||||
|
||||
return new RedirectResponse($returnUrl . $separator . http_build_query(['sid' => $kcSid]));
|
||||
}
|
||||
|
||||
/** @param array<string,mixed> $accessTokenClaims */
|
||||
private function hasRole(array $accessTokenClaims, string $role): bool
|
||||
{
|
||||
$roles = $accessTokenClaims['resource_access'][$this->kcClientId]['roles'] ?? [];
|
||||
|
||||
return in_array($role, $roles, true);
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the logged-in user's profile (email, name, etc). Called by
|
||||
* an app as a normal API query with `Authorization: Bearer <sid>` —
|
||||
* same pattern as /api/*, but served directly by the BFF since this
|
||||
* data comes from the ID token, not the backend.
|
||||
*/
|
||||
#[Route('/auth/me', methods: ['GET'])]
|
||||
public function me(Request $request): JsonResponse
|
||||
{
|
||||
$kcSid = $this->extractBearer($request);
|
||||
if (!$kcSid) {
|
||||
return new JsonResponse(['error' => 'unauthenticated'], 401);
|
||||
}
|
||||
|
||||
$session = $this->store->get($kcSid);
|
||||
if ($session === null) {
|
||||
return new JsonResponse(['error' => 'session expired'], 401);
|
||||
}
|
||||
|
||||
return new JsonResponse($session['profile'] ?? []);
|
||||
}
|
||||
|
||||
/**
|
||||
* Global logout. Called by an app as a normal (server-side-executed)
|
||||
* API query with `Authorization: Bearer <sid>`. Returns a URL rather
|
||||
* than redirecting itself, since the app must perform the actual
|
||||
* browser navigation to kill Keycloak's own SSO cookie.
|
||||
*/
|
||||
#[Route('/auth/logout', methods: ['POST'])]
|
||||
public function logout(Request $request): JsonResponse
|
||||
{
|
||||
$kcSid = $this->extractBearer($request);
|
||||
if (!$kcSid) {
|
||||
return new JsonResponse(['error' => 'missing session'], 401);
|
||||
}
|
||||
|
||||
$data = $this->store->get($kcSid);
|
||||
$idToken = $data['id_token'] ?? null;
|
||||
|
||||
// One delete kills the session for every app that shared it.
|
||||
$this->store->revoke($kcSid);
|
||||
|
||||
$params = http_build_query(array_filter([
|
||||
'id_token_hint' => $idToken,
|
||||
'post_logout_redirect_uri' => $this->postLogoutRedirect,
|
||||
]));
|
||||
|
||||
return new JsonResponse([
|
||||
'logout_url' => "{$this->kcBaseUrl}/realms/{$this->kcRealm}/protocol/openid-connect/logout?{$params}",
|
||||
]);
|
||||
}
|
||||
|
||||
private function extractBearer(Request $request): ?string
|
||||
{
|
||||
$header = $request->headers->get('Authorization', '');
|
||||
|
||||
return str_starts_with($header, 'Bearer ') ? substr($header, 7) : null;
|
||||
}
|
||||
|
||||
private function base64UrlEncode(string $bytes): string
|
||||
{
|
||||
return rtrim(strtr(base64_encode($bytes), '+/', '-_'), '=');
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,18 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace App\Controller;
|
||||
|
||||
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
|
||||
use Symfony\Component\HttpFoundation\Response;
|
||||
use Symfony\Component\Routing\Attribute\Route;
|
||||
|
||||
class IndexController extends AbstractController
|
||||
{
|
||||
#[Route('/')]
|
||||
public function index(): Response
|
||||
{
|
||||
return new Response('¯\_(ツ)_/¯');
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,98 @@
|
||||
<?php
|
||||
|
||||
namespace App\Controller;
|
||||
|
||||
use App\Security\BackendRegistry;
|
||||
use App\Session\TokenRefresher;
|
||||
use Psr\Log\LoggerInterface;
|
||||
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
|
||||
use Symfony\Component\HttpFoundation\Request;
|
||||
use Symfony\Component\HttpFoundation\Response;
|
||||
use Symfony\Component\Routing\Attribute\Route;
|
||||
use Symfony\Contracts\HttpClient\HttpClientInterface;
|
||||
|
||||
class ProxyController extends AbstractController
|
||||
{
|
||||
private const string DEFAULT_BACKEND_KEY = 'default';
|
||||
|
||||
private const array HOP_BY_HOP_HEADERS = [
|
||||
'connection', 'keep-alive', 'transfer-encoding', 'te',
|
||||
'trailer', 'upgrade', 'proxy-authorization', 'proxy-authenticate',
|
||||
'host', 'content-length', 'x-backend',
|
||||
];
|
||||
|
||||
public function __construct(
|
||||
private readonly HttpClientInterface $client,
|
||||
private readonly TokenRefresher $refresher,
|
||||
private readonly BackendRegistry $backends,
|
||||
private readonly LoggerInterface $logger,
|
||||
) {
|
||||
}
|
||||
|
||||
/**
|
||||
* Every Appsmith API query in every app points here, sending
|
||||
* `Authorization: Bearer <sid>` (the value from appsmith.store.sid) —
|
||||
* never the real Keycloak token, which never leaves the BFF.
|
||||
*/
|
||||
#[Route('/api/{path}', requirements: ['path' => '.+'], methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'])]
|
||||
public function proxy(Request $request, string $path): Response
|
||||
{
|
||||
$kcSid = $this->extractBearer($request);
|
||||
if (!$kcSid) {
|
||||
return $this->jsonError('unauthenticated', 401);
|
||||
}
|
||||
|
||||
$accessToken = $this->refresher->ensureFresh($kcSid);
|
||||
if (!$accessToken) {
|
||||
return $this->jsonError('session expired', 401);
|
||||
}
|
||||
|
||||
$backendKey = $request->headers->get('X-Backend', self::DEFAULT_BACKEND_KEY);
|
||||
if (!$this->backends->isValidBackend($backendKey)) {
|
||||
return $this->jsonError('unknown backend', 400);
|
||||
}
|
||||
$backendBaseUrl = $this->backends->resolveBaseUrl($backendKey);
|
||||
|
||||
$forwardHeaders = [];
|
||||
foreach ($request->headers->all() as $name => $values) {
|
||||
$lower = strtolower($name);
|
||||
if (!in_array($lower, self::HOP_BY_HOP_HEADERS, true) && $lower !== 'authorization') {
|
||||
$forwardHeaders[$name] = $values;
|
||||
}
|
||||
}
|
||||
$forwardHeaders['Authorization'] = "Bearer {$accessToken}";
|
||||
|
||||
try {
|
||||
$upstream = $this->client->request($request->getMethod(), "{$backendBaseUrl}/{$path}", [
|
||||
'query' => $request->query->all(),
|
||||
'body' => $request->getContent(),
|
||||
'headers' => $forwardHeaders,
|
||||
]);
|
||||
$status = $upstream->getStatusCode();
|
||||
$body = $upstream->getContent(false);
|
||||
$contentType = $upstream->getHeaders(false)['content-type'][0] ?? 'application/json';
|
||||
} catch (\Throwable $e) {
|
||||
$this->logger->error('Proxy request to backend failed', [
|
||||
'backend' => $backendKey,
|
||||
'path' => $path,
|
||||
'exception' => $e,
|
||||
]);
|
||||
|
||||
return $this->jsonError('upstream unreachable', 502);
|
||||
}
|
||||
|
||||
return new Response($body, $status, ['Content-Type' => $contentType]);
|
||||
}
|
||||
|
||||
private function extractBearer(Request $request): ?string
|
||||
{
|
||||
$header = $request->headers->get('Authorization', '');
|
||||
|
||||
return str_starts_with($header, 'Bearer ') ? substr($header, 7) : null;
|
||||
}
|
||||
|
||||
private function jsonError(string $message, int $status): Response
|
||||
{
|
||||
return $this->json(['error' => $message], $status);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,11 @@
|
||||
<?php
|
||||
|
||||
namespace App;
|
||||
|
||||
use Symfony\Bundle\FrameworkBundle\Kernel\MicroKernelTrait;
|
||||
use Symfony\Component\HttpKernel\Kernel as BaseKernel;
|
||||
|
||||
class Kernel extends BaseKernel
|
||||
{
|
||||
use MicroKernelTrait;
|
||||
}
|
||||
@@ -0,0 +1,43 @@
|
||||
<?php
|
||||
|
||||
namespace App\Security;
|
||||
|
||||
/**
|
||||
* Allowlist of Appsmith apps this BFF will redirect back to after login,
|
||||
* each paired with the Keycloak client role required to access it.
|
||||
*
|
||||
* Never redirect to an arbitrary caller-supplied URL — always resolve
|
||||
* through this registry to prevent open-redirect abuse.
|
||||
*/
|
||||
class AppRegistry
|
||||
{
|
||||
/** @param array<string,array{url:string,role:string}> $apps app key => ['url' => ..., 'role' => ...] */
|
||||
public function __construct(private readonly array $apps)
|
||||
{
|
||||
}
|
||||
|
||||
public function isValidApp(string $appKey): bool
|
||||
{
|
||||
return isset($this->apps[$appKey]);
|
||||
}
|
||||
|
||||
public function resolveReturnUrl(string $appKey): string
|
||||
{
|
||||
return $this->requireApp($appKey)['url'];
|
||||
}
|
||||
|
||||
public function requiredRole(string $appKey): string
|
||||
{
|
||||
return $this->requireApp($appKey)['role'];
|
||||
}
|
||||
|
||||
/** @return array{url:string,role:string} */
|
||||
private function requireApp(string $appKey): array
|
||||
{
|
||||
if (!isset($this->apps[$appKey])) {
|
||||
throw new \InvalidArgumentException("Unknown app key: {$appKey}");
|
||||
}
|
||||
|
||||
return $this->apps[$appKey];
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,32 @@
|
||||
<?php
|
||||
|
||||
namespace App\Security;
|
||||
|
||||
/**
|
||||
* Allowlist of backends the proxy may forward to, keyed by a name a
|
||||
* request selects via the X-Backend header (see ProxyController).
|
||||
*
|
||||
* Never forward to a caller-supplied URL — always resolve through this
|
||||
* registry, same principle as AppRegistry's redirect-target allowlist.
|
||||
*/
|
||||
class BackendRegistry
|
||||
{
|
||||
/** @param array<string,array{url:string}> $backends backend key => ['url' => ...] */
|
||||
public function __construct(private readonly array $backends)
|
||||
{
|
||||
}
|
||||
|
||||
public function isValidBackend(string $key): bool
|
||||
{
|
||||
return isset($this->backends[$key]);
|
||||
}
|
||||
|
||||
public function resolveBaseUrl(string $key): string
|
||||
{
|
||||
if (!isset($this->backends[$key])) {
|
||||
throw new \InvalidArgumentException("Unknown backend key: {$key}");
|
||||
}
|
||||
|
||||
return $this->backends[$key]['url'];
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,50 @@
|
||||
<?php
|
||||
|
||||
namespace App\Security;
|
||||
|
||||
use Firebase\JWT\JWK;
|
||||
use Firebase\JWT\JWT;
|
||||
use Psr\Cache\InvalidArgumentException;
|
||||
use Symfony\Contracts\Cache\CacheInterface;
|
||||
use Symfony\Contracts\Cache\ItemInterface;
|
||||
use Symfony\Contracts\HttpClient\HttpClientInterface;
|
||||
|
||||
/**
|
||||
* Verifies the ID token signature against Keycloak's published JWKS before
|
||||
* trusting any claims from it (in particular the "sid" and "sub" claims we
|
||||
* key sessions on). Requires firebase/php-jwt.
|
||||
*/
|
||||
class IdTokenDecoder
|
||||
{
|
||||
public function __construct(
|
||||
private readonly HttpClientInterface $client,
|
||||
private readonly CacheInterface $cache,
|
||||
private readonly string $kcBaseUrl,
|
||||
private readonly string $kcRealm,
|
||||
) {
|
||||
}
|
||||
|
||||
/** @return array<string,mixed>
|
||||
* @throws InvalidArgumentException
|
||||
*/
|
||||
public function decode(string $idToken): array
|
||||
{
|
||||
$jwks = $this->cache->get('keycloak_jwks_' . $this->kcRealm, function (ItemInterface $item) {
|
||||
$item->expiresAfter(3600);
|
||||
$response = $this->client->request(
|
||||
'GET',
|
||||
"{$this->kcBaseUrl}/realms/{$this->kcRealm}/protocol/openid-connect/certs"
|
||||
);
|
||||
|
||||
return $response->toArray();
|
||||
});
|
||||
|
||||
$keys = JWK::parseKeySet($jwks);
|
||||
$claims = JWT::decode($idToken, $keys);
|
||||
|
||||
/** @var array<string,mixed> $decoded */
|
||||
$decoded = json_decode((string) json_encode($claims), true);
|
||||
|
||||
return $decoded;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,63 @@
|
||||
<?php
|
||||
|
||||
namespace App\Session;
|
||||
|
||||
use Psr\Cache\CacheItemPoolInterface;
|
||||
use Psr\Cache\InvalidArgumentException;
|
||||
|
||||
/**
|
||||
* Stores real Keycloak tokens server-side, keyed by Keycloak's own session
|
||||
* id (the "sid" ID token claim) rather than a per-login random id.
|
||||
*
|
||||
* Because Keycloak issues the same "sid" to every client (app) that
|
||||
* authenticates within one browser SSO session, every Appsmith app the
|
||||
* user logs into within that window resolves to this same entry. Global
|
||||
* logout is therefore a single delete, not a fan-out over many sessions.
|
||||
*
|
||||
* Backed by a PSR-6 cache pool (see config/packages/cache.yaml). Defaults
|
||||
* to the filesystem adapter, which is safe across concurrent PHP-FPM
|
||||
* workers on a single host and needs no extra service to run. If you ever
|
||||
* run more than one BFF instance, switch that pool's adapter to
|
||||
* cache.adapter.redis — nothing in this class needs to change.
|
||||
*/
|
||||
class BffSessionStore
|
||||
{
|
||||
public function __construct(
|
||||
private readonly CacheItemPoolInterface $cache,
|
||||
private readonly int $ttlSeconds = 3600,
|
||||
) {
|
||||
}
|
||||
|
||||
/** @param array<string,mixed> $data
|
||||
* @throws InvalidArgumentException
|
||||
*/
|
||||
public function put(string $kcSid, array $data): void
|
||||
{
|
||||
$item = $this->cache->getItem($this->key($kcSid));
|
||||
$item->set($data);
|
||||
$item->expiresAfter($this->ttlSeconds);
|
||||
$this->cache->save($item);
|
||||
}
|
||||
|
||||
/** @return array<string,mixed>|null
|
||||
* @throws InvalidArgumentException
|
||||
*/
|
||||
public function get(string $kcSid): ?array
|
||||
{
|
||||
$item = $this->cache->getItem($this->key($kcSid));
|
||||
|
||||
return $item->isHit() ? $item->get() : null;
|
||||
}
|
||||
|
||||
public function revoke(string $kcSid): void
|
||||
{
|
||||
$this->cache->deleteItem($this->key($kcSid));
|
||||
}
|
||||
|
||||
private function key(string $kcSid): string
|
||||
{
|
||||
// PSR-6 keys disallow {}()/\@: — hash to stay safe regardless of
|
||||
// what Keycloak's sid claim looks like.
|
||||
return 'bff_session_' . hash('sha256', $kcSid);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,71 @@
|
||||
<?php
|
||||
|
||||
namespace App\Session;
|
||||
|
||||
use Psr\Log\LoggerInterface;
|
||||
use Symfony\Contracts\HttpClient\HttpClientInterface;
|
||||
|
||||
class TokenRefresher
|
||||
{
|
||||
private const int EXPIRY_LEEWAY_SECONDS = 30;
|
||||
|
||||
public function __construct(
|
||||
private readonly HttpClientInterface $client,
|
||||
private readonly BffSessionStore $store,
|
||||
private readonly LoggerInterface $logger,
|
||||
private readonly string $kcBaseUrl,
|
||||
private readonly string $kcRealm,
|
||||
private readonly string $kcClientId,
|
||||
private readonly string $kcClientSecret,
|
||||
) {
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns a currently-valid access token for this Keycloak session,
|
||||
* refreshing server-side if it's near expiry. Returns null if the
|
||||
* session doesn't exist or the refresh grant failed (caller should
|
||||
* respond 401 so the app bounces back to login).
|
||||
*/
|
||||
public function ensureFresh(string $kcSid): ?string
|
||||
{
|
||||
$session = $this->store->get($kcSid);
|
||||
if ($session === null) {
|
||||
return null;
|
||||
}
|
||||
|
||||
if (time() < ($session['expires_at'] - self::EXPIRY_LEEWAY_SECONDS)) {
|
||||
return $session['access_token'];
|
||||
}
|
||||
|
||||
try {
|
||||
$response = $this->client->request(
|
||||
'POST',
|
||||
"{$this->kcBaseUrl}/realms/{$this->kcRealm}/protocol/openid-connect/token",
|
||||
[
|
||||
'body' => [
|
||||
'grant_type' => 'refresh_token',
|
||||
'client_id' => $this->kcClientId,
|
||||
'client_secret' => $this->kcClientSecret,
|
||||
'refresh_token' => $session['refresh_token'],
|
||||
],
|
||||
]
|
||||
);
|
||||
$tokens = $response->toArray();
|
||||
} catch (\Throwable $e) {
|
||||
// Refresh token expired/revoked (e.g. Keycloak-side admin logout) — kill the session.
|
||||
$this->logger->warning('Keycloak token refresh failed, revoking session', [
|
||||
'exception' => $e,
|
||||
]);
|
||||
$this->store->revoke($kcSid);
|
||||
return null;
|
||||
}
|
||||
|
||||
$session['access_token'] = $tokens['access_token'];
|
||||
$session['refresh_token'] = $tokens['refresh_token'] ?? $session['refresh_token'];
|
||||
$session['expires_at'] = time() + $tokens['expires_in'];
|
||||
|
||||
$this->store->put($kcSid, $session);
|
||||
|
||||
return $session['access_token'];
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,80 @@
|
||||
{
|
||||
"symfony/console": {
|
||||
"version": "6.4",
|
||||
"recipe": {
|
||||
"repo": "github.com/symfony/recipes",
|
||||
"branch": "main",
|
||||
"version": "5.3",
|
||||
"ref": "1781ff40d8a17d87cf53f8d4cf0c8346ed2bb461"
|
||||
},
|
||||
"files": [
|
||||
"bin/console"
|
||||
]
|
||||
},
|
||||
"symfony/flex": {
|
||||
"version": "2.11",
|
||||
"recipe": {
|
||||
"repo": "github.com/symfony/recipes",
|
||||
"branch": "main",
|
||||
"version": "2.4",
|
||||
"ref": "52e9754527a15e2b79d9a610f98185a1fe46622a"
|
||||
},
|
||||
"files": [
|
||||
".env",
|
||||
".env.dev"
|
||||
]
|
||||
},
|
||||
"symfony/framework-bundle": {
|
||||
"version": "6.4",
|
||||
"recipe": {
|
||||
"repo": "github.com/symfony/recipes",
|
||||
"branch": "main",
|
||||
"version": "6.4",
|
||||
"ref": "08c492c28925bf921d98bc26fd815ae8a38b33d9"
|
||||
},
|
||||
"files": [
|
||||
"config/packages/cache.yaml",
|
||||
"config/packages/framework.yaml",
|
||||
"config/preload.php",
|
||||
"config/routes/framework.yaml",
|
||||
"config/services.yaml",
|
||||
"public/index.php",
|
||||
"src/Controller/.gitignore",
|
||||
"src/Kernel.php"
|
||||
]
|
||||
},
|
||||
"symfony/maker-bundle": {
|
||||
"version": "1.67",
|
||||
"recipe": {
|
||||
"repo": "github.com/symfony/recipes",
|
||||
"branch": "main",
|
||||
"version": "1.0",
|
||||
"ref": "fadbfe33303a76e25cb63401050439aa9b1a9c7f"
|
||||
}
|
||||
},
|
||||
"symfony/monolog-bundle": {
|
||||
"version": "4.0",
|
||||
"recipe": {
|
||||
"repo": "github.com/symfony/recipes",
|
||||
"branch": "main",
|
||||
"version": "3.7",
|
||||
"ref": "1b9efb10c54cb51c713a9391c9300ff8bceda459"
|
||||
},
|
||||
"files": [
|
||||
"config/packages/monolog.yaml"
|
||||
]
|
||||
},
|
||||
"symfony/routing": {
|
||||
"version": "6.4",
|
||||
"recipe": {
|
||||
"repo": "github.com/symfony/recipes",
|
||||
"branch": "main",
|
||||
"version": "6.2",
|
||||
"ref": "e0a11b4ccb8c9e70b574ff5ad3dfdcd41dec5aa6"
|
||||
},
|
||||
"files": [
|
||||
"config/packages/routing.yaml",
|
||||
"config/routes.yaml"
|
||||
]
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user