some changes

This commit is contained in:
Evert Prants 2022-09-09 18:28:54 +03:00
parent 3b3fa2a7de
commit 6e05c990d1
Signed by: evert
GPG Key ID: 1688DA83D222D0B5
3 changed files with 17 additions and 2 deletions

View File

@ -15,6 +15,7 @@ export class CSRFMiddleware implements NestMiddleware {
res.cookie('XSRF', secretToken, { res.cookie('XSRF', secretToken, {
maxAge: 60 * 60 * 1000, maxAge: 60 * 60 * 1000,
secure: !DEV, secure: !DEV,
httpOnly: true,
sameSite: 'strict', sameSite: 'strict',
}); });
} }

View File

@ -8,3 +8,13 @@ export class Privilege {
@Column({ type: 'text', nullable: false }) @Column({ type: 'text', nullable: false })
name: string; name: string;
} }
/*
Initial entries:
admin
admin:user
admin:user:privilege
admin:document
admin:oauth2
self: oauth2
*/

View File

@ -16,10 +16,14 @@ export class OAuth2RouterModule implements NestModule {
constructor(private _service: OAuth2Service) {} constructor(private _service: OAuth2Service) {}
configure(consumer: MiddlewareConsumer) { configure(consumer: MiddlewareConsumer) {
consumer.apply(CSRFMiddleware, UserMiddleware).forRoutes(OAuth2Controller);
consumer.apply(this._service.oauth.express()).forRoutes('oauth2/*'); consumer.apply(this._service.oauth.express()).forRoutes('oauth2/*');
consumer consumer
.apply(AuthMiddleware, ValidateCSRFMiddleware) .apply(
CSRFMiddleware,
UserMiddleware,
AuthMiddleware,
ValidateCSRFMiddleware,
)
.forRoutes('oauth2/authorize'); .forRoutes('oauth2/authorize');
} }
} }