feat: implement full bff logic

2026-08-10 09:13:44 +02:00
commit 790d5bc15f
33 changed files with 6296 additions and 0 deletions
@@ -0,0 +1,58 @@
+# yaml-language-server: $schema=../vendor/symfony/dependency-injection/Loader/schema/services.schema.json
+parameters:
+    keycloak.base_url: '%env(KEYCLOAK_BASE_URL)%'
+    keycloak.realm: '%env(KEYCLOAK_REALM)%'
+    keycloak.client_id: '%env(KEYCLOAK_CLIENT_ID)%'
+    keycloak.client_secret: '%env(KEYCLOAK_CLIENT_SECRET)%'
+    keycloak.redirect_uri: '%env(KEYCLOAK_REDIRECT_URI)%'
+    keycloak.post_logout_redirect: '%env(KEYCLOAK_POST_LOGOUT_REDIRECT)%'
+
+    # Allowlist of Appsmith apps this BFF will redirect back to, each with
+    # the Keycloak client role (on the bff client) required to enter it.
+    # Add one entry per app you build. Never accept a return URL from the
+    # request itself — always resolve through this map.
+    appsmith.apps:
+        app-sandbox:
+            url: '%env(APP_SANDBOX_LOGIN_URL)%'
+            role: 'app-sandbox-access'
+
+    # Named backends the proxy can forward to. A request picks one via the
+    # X-Backend header; omitting it uses "default". Add BACKEND_<KEY>_URL to
+    # .env and one entry here per backend. Any app may call any backend key
+    # — the backend is expected to do its own authorization off the roles
+    # claim in the forwarded access token (see README).
+    backends:
+        default:
+            url: '%env(BACKEND_BASE_URL)%'
+
+services:
+    _defaults:
+        autowire: true
+        autoconfigure: true
+        bind:
+            $kcBaseUrl: '%keycloak.base_url%'
+            $kcRealm: '%keycloak.realm%'
+            $kcClientId: '%keycloak.client_id%'
+            $kcClientSecret: '%keycloak.client_secret%'
+            $kcRedirectUri: '%keycloak.redirect_uri%'
+
+    App\:
+        resource: '../src/'
+        exclude:
+            - '../src/Kernel.php'
+
+    App\Session\BffSessionStore:
+        arguments:
+            $cache: '@bff.session_cache'
+
+    App\Security\AppRegistry:
+        arguments:
+            $apps: '%appsmith.apps%'
+
+    App\Security\BackendRegistry:
+        arguments:
+            $backends: '%backends%'
+
+    App\Controller\AuthController:
+        arguments:
+            $postLogoutRedirect: '%keycloak.post_logout_redirect%'