mirror of
https://github.com/btouchard/ackify-ce.git
synced 2026-02-11 16:29:13 -06:00
68426bc882
- Implement PKCE (Proof Key for Code Exchange) with S256 method - Add crypto/pkce module with code verifier and challenge generation - Modify OAuth flow to include code_challenge in authorization requests - Update HandleCallback to validate code_verifier during token exchange - Extend session lifetime from 7 to 30 days - Add comprehensive unit tests for PKCE functions - Maintain backward compatibility with fallback for non-PKCE sessions - Add detailed logging for OAuth flow with PKCE tracking PKCE enhances security by preventing authorization code interception attacks, as recommended by OAuth 2.1 and OIDC standards. feat: add encrypted refresh token storage with automatic cleanup - Add oauth_sessions table for storing encrypted refresh tokens - Implement AES-256-GCM encryption for refresh tokens using cookie secret - Create OAuth session repository with full CRUD operations - Add SessionWorker for automatic cleanup of expired sessions - Configure cleanup to run every 24h for sessions older than 37 days - Modify OAuth flow to store refresh tokens after successful authentication - Track client IP and user agent for session security validation - Link OAuth sessions to user sessions via session ID - Add comprehensive encryption tests with security validations - Integrate SessionWorker into server lifecycle with graceful shutdown This enables persistent OAuth sessions with secure token storage, reducing the need for frequent re-authentication from 7 to 30 days.
64 lines
1.9 KiB
Docker
64 lines
1.9 KiB
Docker
FROM node:22-alpine AS spa-builder
|
|
|
|
WORKDIR /app/webapp
|
|
COPY webapp/package*.json ./
|
|
RUN npm ci
|
|
COPY webapp/ ./
|
|
RUN npm run build
|
|
|
|
FROM golang:alpine AS builder
|
|
|
|
RUN apk update && apk add --no-cache ca-certificates git curl && rm -rf /var/cache/apk/*
|
|
RUN adduser -D -g '' ackuser
|
|
|
|
WORKDIR /app
|
|
COPY go.mod go.sum ./
|
|
ENV GOTOOLCHAIN=auto
|
|
RUN go mod download && go mod verify
|
|
COPY backend/ ./backend/
|
|
|
|
RUN mkdir -p backend/cmd/community/web/dist
|
|
COPY --from=spa-builder /app/webapp/dist ./backend/cmd/community/web/dist
|
|
|
|
ARG VERSION="dev"
|
|
ARG COMMIT="unknown"
|
|
ARG BUILD_DATE="unknown"
|
|
|
|
RUN CGO_ENABLED=0 GOOS=linux go build \
|
|
-a -installsuffix cgo \
|
|
-ldflags="-w -s -X main.Version=${VERSION} -X main.Commit=${COMMIT} -X main.BuildDate=${BUILD_DATE}" \
|
|
-o ackify ./backend/cmd/community
|
|
|
|
RUN CGO_ENABLED=0 GOOS=linux go build \
|
|
-a -installsuffix cgo \
|
|
-ldflags="-w -s" \
|
|
-o migrate ./backend/cmd/migrate
|
|
|
|
FROM gcr.io/distroless/static-debian12:nonroot
|
|
|
|
ARG VERSION="dev"
|
|
|
|
LABEL maintainer="Benjamin TOUCHARD"
|
|
LABEL version="${VERSION}"
|
|
LABEL description="Ackify - Document signature validation platform"
|
|
LABEL org.opencontainers.image.source="https://github.com/btouchard/ackify-ce"
|
|
LABEL org.opencontainers.image.description="Professional solution for validating and tracking document reading"
|
|
LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
|
|
|
|
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
|
|
|
|
WORKDIR /app
|
|
COPY --from=builder /app/ackify /app/ackify
|
|
COPY --from=builder /app/migrate /app/migrate
|
|
COPY --from=builder /app/backend/migrations /app/migrations
|
|
COPY --from=builder /app/backend/locales /app/locales
|
|
COPY --from=builder /app/backend/templates /app/templates
|
|
COPY --from=builder /app/backend/openapi.yaml /app/openapi.yaml
|
|
|
|
ENV ACKIFY_TEMPLATES_DIR=/app/templates
|
|
ENV ACKIFY_LOCALES_DIR=/app/locales
|
|
|
|
EXPOSE 8080
|
|
|
|
ENTRYPOINT ["/app/ackify"]
|