source: Klonkt/package.json@ 32cc601

main
Last change on this file since 32cc601 was 32cc601, checked in by roboburr <roboburr@…>, 3 months ago

auth: route Google login via central Klonkt broker (no credentials per instance)

The instance no longer talks directly to Google but delegates to the central
broker (license.klonkt.com): it performs the OAuth dance with one Google client
and returns a signed, audience-bound identity token, which we verify offline
against the broker's pubkey. This way no self-hoster needs to create their own
Google client.

  • config/google.js: broker client (brokerStartUrl + verifyIdentityToken against /pubkey: issuer + EdDSA + audience==SITE_ORIGIN + typ; consumeJti against replay).
  • routes/auth.js: /auth/google sets state in session -> broker; callback checks state (CSRF) + token + replay, finds-or-creates user on email.
  • god only via ADMIN_EMAIL; the "first user becomes god" bootstrap only applies when NO ADMIN_EMAIL is set (otherwise a stranger on a fresh install could become owner).
  • Reject login if the email address is already linked to a different google_sub.
  • jose added to dependencies (verifier; otherwise npm ci crashes the app).
  • .env: KLONKT_BROKER_URL + SITE_ORIGIN instead of GOOGLE_CLIENT_ID/SECRET.

Co-Authored-By: Claude <noreply@…>
  • Property mode set to 100644
File size: 968 bytes
Line 
1{
2 "name": "prutfolio",
3 "version": "1.0.0-alpha.1",
4 "description": "PrutFolio v1 — persoonlijk multi-site platform met community, realtime, en (later) E2EE DMs. Forked van PrutCMS v9 (PHP) naar Node + SQLite + htmx.",
5 "type": "module",
6 "main": "src/server.js",
7 "scripts": {
8 "start": "node src/server.js",
9 "dev": "node --watch src/server.js",
10 "migrate": "node src/db/migrate.js"
11 },
12 "dependencies": {
13 "bcryptjs": "^2.4.3",
14 "better-sqlite3": "^11.3.0",
15 "body-parser": "^1.20.2",
16 "dotenv": "^16.3.1",
17 "ejs": "^3.1.9",
18 "express": "^4.18.2",
19 "express-rate-limit": "^7.4.1",
20 "express-session": "^1.17.3",
21 "ffmpeg-static": "^5.2.0",
22 "fluent-ffmpeg": "^2.1.3",
23 "helmet": "^7.1.0",
24 "htmx.org": "1.9.12",
25 "jose": "^5.10.0",
26 "marked": "^11.1.1",
27 "multer": "^1.4.5-lts.1",
28 "sanitize-html": "^2.17.3",
29 "uuid": "^9.0.1",
30 "ws": "^8.18.0"
31 },
32 "engines": {
33 "node": ">=20"
34 }
35}
Note: See TracBrowser for help on using the repository browser.