diff --git a/.github/workflows/firebase-hosting-commit-prod.yml b/.github/workflows/firebase-hosting-commit-prod.yml index 997bc1d..1361f72 100644 --- a/.github/workflows/firebase-hosting-commit-prod.yml +++ b/.github/workflows/firebase-hosting-commit-prod.yml @@ -21,7 +21,6 @@ jobs: touch .env echo PUBLIC_COMMIT_HASH=$(git log --format="%h" -n 1) >> .env echo PUBLIC_APP_ENV=production >> .env - echo PUBLIC_GOOGLE_CLIENT_ID=${{ secrets.PUBLIC_GOOGLE_CLIENT_ID_PROD }} >> .env echo PUBLIC_CREATION_DATE=$(git log --format="%cd" --date=format:'%Y-%m-%d' -1) >> .env - run: npm ci && npx svelte-kit sync && npm run build && npm run build:webcomponent env: diff --git a/.github/workflows/firebase-hosting-pull-request-dev.yml b/.github/workflows/firebase-hosting-pull-request-dev.yml index 0fef94b..e4182d8 100644 --- a/.github/workflows/firebase-hosting-pull-request-dev.yml +++ b/.github/workflows/firebase-hosting-pull-request-dev.yml @@ -19,7 +19,6 @@ jobs: touch .env echo PUBLIC_COMMIT_HASH=$(git log --format="%h" -n 1) >> .env echo PUBLIC_APP_ENV=development >> .env - echo PUBLIC_GOOGLE_CLIENT_ID=${{ secrets.PUBLIC_GOOGLE_CLIENT_ID_DEV }} >> .env echo PUBLIC_CREATION_DATE=$(git log --format="%cd" --date=format:'%Y-%m-%d' -1) >> .env - run: npm ci && npx svelte-kit sync && npm run build && npm run build:webcomponent env: diff --git a/.github/workflows/firebase-hosting-tag-prod.yml b/.github/workflows/firebase-hosting-tag-prod.yml index d39ddfb..12cdc0f 100644 --- a/.github/workflows/firebase-hosting-tag-prod.yml +++ b/.github/workflows/firebase-hosting-tag-prod.yml @@ -20,7 +20,6 @@ jobs: touch .env echo PUBLIC_COMMIT_HASH=$(git log --format="%h" -n 1) >> .env echo PUBLIC_APP_ENV=production >> .env - echo PUBLIC_GOOGLE_CLIENT_ID=${{ secrets.PUBLIC_GOOGLE_CLIENT_ID_PROD }} >> .env echo PUBLIC_CREATION_DATE=$(git log --format="%cd" --date=format:'%Y-%m-%d' -1) >> .env - run: npm ci && npx svelte-kit sync && npm run build && npm run build:webcomponent env: diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index f0d24a9..c845e92 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -22,7 +22,6 @@ jobs: touch .env echo PUBLIC_COMMIT_HASH=$(git log --format="%h" -n 1) >> .env echo PUBLIC_APP_ENV=production >> .env - echo PUBLIC_GOOGLE_CLIENT_ID=${{ secrets.PUBLIC_GOOGLE_CLIENT_ID_PROD }} >> .env echo PUBLIC_CREATION_DATE=$(git log --format="%cd" --date=format:'%Y-%m-%d' -1) >> .env - run: npm ci && npx svelte-kit sync && npm run build:webcomponent env: diff --git a/README.md b/README.md index 5c91169..e64794f 100644 --- a/README.md +++ b/README.md @@ -36,3 +36,9 @@ npm run build You can preview the production build with `npm run preview`. > To deploy your app, you may need to install an [adapter](https://kit.svelte.dev/docs/adapters) for your target environment. + +## Authentication + +Profile Cloud has no sign-in UI. The editor posts `{ event, providerId: "oidc", idToken }` into the web component, and `src/lib/stores.ts` signs that token into Firebase through the `oidc.is-auth` (production) or `oidc.is-auth-dev` (development) provider. + +The identity bridge is console-side: those providers point at the identity provider's issuer and the `grid-editor` client id, which keeps every Firebase uid without any code here. The provider is Keycloak (decision 36; this branch was rehearsed against Logto), with the issuer in the form `https:///realms/intech`. See decision 27 in the [authentication rework plan](https://github.com/intechstudio/webapps/blob/main/docs/auth-rework-plan.md). diff --git a/src/app.d.ts b/src/app.d.ts index b236f78..899c7e8 100644 --- a/src/app.d.ts +++ b/src/app.d.ts @@ -9,6 +9,4 @@ declare global { } } -declare var google: any; - export {}; diff --git a/src/lib/components/GoogleAuth.svelte b/src/lib/components/GoogleAuth.svelte deleted file mode 100644 index b141153..0000000 --- a/src/lib/components/GoogleAuth.svelte +++ /dev/null @@ -1,38 +0,0 @@ - - - - - - -
diff --git a/src/lib/stores.ts b/src/lib/stores.ts index 663506a..f5098a7 100644 --- a/src/lib/stores.ts +++ b/src/lib/stores.ts @@ -19,6 +19,8 @@ function createUserAccountService() { }; }); + let signedInIdToken: string | undefined; + async function authenticateUser(credential: { event?: string; providerId?: string; @@ -34,6 +36,10 @@ function createUserAccountService() { signOut(firebaseAuth); return; } + // the editor re-posts the same token on remount; a refreshed one still signs in + if (firebaseAuth.currentUser && credential.idToken === signedInIdToken) { + return; + } const provider = new OAuthProvider( import.meta.env.PUBLIC_APP_ENV === "production" ? "oidc.is-auth" @@ -47,6 +53,7 @@ function createUserAccountService() { return await signInWithCredential(firebaseAuth, cred) .then((user) => { + signedInIdToken = credential.idToken; console.log("authenticated in profile cloud", user); }) .catch((error) => { diff --git a/src/routes/authorize/+page.svelte b/src/routes/authorize/+page.svelte deleted file mode 100644 index 24046a9..0000000 --- a/src/routes/authorize/+page.svelte +++ /dev/null @@ -1,164 +0,0 @@ - - -
-
- {#if authStatus.status == 0} -

authorize your social account

-

- When you login through social accounts, please click on the appropiate - button below to proceed with authorization. -

-
- -
- {:else if authStatus.status == 1} -

authorization successful

-

- Click the button below, and open the application. -

-
- launch desktop app -
-
-
- -
-
Grid Editor for Desktop
-
- {/if} -
-
- -