bad2117ea8
Start puts a per-attempt nonce in the returnTo it sends Heimdall and keeps the attempt (provider, member flag, local return path, expiry) in a Data Protection cookie named for that nonce. Heimdall's completion page sends the browser to /auth/heimdall/complete with a code in the URL fragment; the page posts it back, Bifrost redeems it at Heimdall, requires the redeemed returnTo to name the cookie's nonce, verifies the access token for the redeemed account, and signs that browser in. Deleted: the callback route, the wait route, the server-side attempt store, the pending state and the backend_callback handoff. Added: LocalReturnPath for return targets, Heimdall:AppSecret sent as x-heimdall-app-secret (member starts are refused without it), a short timeout on the key fetch, and a key lookup that does not hold the fetch gate for cached keys. Refusals at the completion route all answer one redirect and log a fixed reason. Tests are rewritten against a fake Heimdall with start and redeem routes. Not compile-checked by this commit alone; later commits record the verification. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
52 lines
1.3 KiB
JSON
52 lines
1.3 KiB
JSON
{
|
|
"ConnectionStrings": {
|
|
"Bifrost": "Host=127.0.0.1;Database=bifrost;Username=postgres;Password=postgres"
|
|
},
|
|
"GitHubOAuth": {
|
|
"ClientId": "",
|
|
"ClientSecret": "",
|
|
"CallbackPath": "/signin-github"
|
|
},
|
|
"GitHubApp": {
|
|
"AppId": "",
|
|
"ClientId": "",
|
|
"ClientSecret": "",
|
|
"PrivateKeyPem": "",
|
|
"WebhookSecret": "",
|
|
"EnableWebhookSync": true
|
|
},
|
|
"Bootstrap": {
|
|
"AdminGitHubLogins": [],
|
|
"ApplyMigrationsOnStartup": false
|
|
},
|
|
"Host": {
|
|
"PublicBaseUrl": "https://bifrost.gamecult.org",
|
|
"ExpectedHost": "bifrost.gamecult.org",
|
|
"RequireStrictHostValidation": true
|
|
},
|
|
"Heimdall": {
|
|
"BaseUrl": "https://heimdall.gamecult.org",
|
|
"AppSlug": "bifrost",
|
|
"AppSecret": "",
|
|
"DiscordGuildId": "",
|
|
"DiscordAllowedRoleIds": [],
|
|
"PatreonTierTitle": "Inner Sanctum",
|
|
"PatronSupportIntakeSecret": "",
|
|
"EnablePatronSupportIntake": true
|
|
},
|
|
"Stripe": {
|
|
"EnableCheckout": false,
|
|
"SecretKey": "",
|
|
"WebhookSecret": "",
|
|
"GeneralPatronageGitHubLogin": "",
|
|
"SuccessUrl": "https://velvet.gamecult.org/?patronage=success",
|
|
"CancelUrl": "https://velvet.gamecult.org/?patronage=cancelled"
|
|
},
|
|
"Logging": {
|
|
"LogLevel": {
|
|
"Default": "Information",
|
|
"Microsoft.AspNetCore": "Warning"
|
|
}
|
|
},
|
|
"AllowedHosts": "localhost"
|
|
}
|