fix

This reverts commit 5c86afd640.

README.md

@@ -78,6 +78,7 @@ DATABASE_URL="postgresql://user:password@localhost:5432/timetracker"
 # OIDC Configuration
 OIDC_ISSUER_URL="https://your-oidc-provider.com"
 OIDC_CLIENT_ID="your-client-id"
+OIDC_REDIRECT_URI="http://localhost:3001/auth/callback"
 
 # Session
 SESSION_SECRET="your-secure-session-secret-min-32-chars"

backend/src/auth/oidc.ts

@@ -1,6 +1,6 @@
-import { Issuer, generators, Client, TokenSet } from "openid-client";
+import { Issuer, generators, Client, TokenSet } from 'openid-client';
-import { config } from "../config";
+import { config } from '../config';
-import type { AuthenticatedUser } from "../types";
+import type { AuthenticatedUser } from '../types';
 
 let oidcClient: Client | null = null;
 
@@ -10,20 +10,21 @@ export async function initializeOIDC(): Promise<void> {
     
     oidcClient = new issuer.Client({
       client_id: config.oidc.clientId,
-      response_types: ["code"],
+      redirect_uris: [config.oidc.redirectUri],
-      token_endpoint_auth_method: "none", // PKCE flow - no client secret
+      response_types: ['code'],
+      token_endpoint_auth_method: 'none', // PKCE flow - no client secret
     });
     
-    console.log("OIDC client initialized");
+    console.log('OIDC client initialized');
   } catch (error) {
-    console.error("Failed to initialize OIDC client:", error);
+    console.error('Failed to initialize OIDC client:', error);
     throw error;
   }
 }
 
 export function getOIDCClient(): Client {
   if (!oidcClient) {
-    throw new Error("OIDC client not initialized");
+    throw new Error('OIDC client not initialized');
   }
   return oidcClient;
 }
@@ -47,32 +48,34 @@ export function getAuthorizationUrl(session: AuthSession): string {
   const codeChallenge = generators.codeChallenge(session.codeVerifier);
   
   return client.authorizationUrl({
-    scope: "openid profile email",
+    scope: 'openid profile email',
     state: session.state,
     nonce: session.nonce,
     code_challenge: codeChallenge,
-    code_challenge_method: "S256",
+    code_challenge_method: 'S256',
   });
 }
 
 export async function handleCallback(
   params: Record<string, string>,
-  session: AuthSession,
+  session: AuthSession
 ): Promise<TokenSet> {
   const client = getOIDCClient();
   
-  const tokenSet = await client.callback(undefined, params, {
+  const tokenSet = await client.callback(
+    config.oidc.redirectUri,
+    params,
+    {
       code_verifier: session.codeVerifier,
       state: session.state,
       nonce: session.nonce,
-  });
+    }
+  );
   
   return tokenSet;
 }
 
-export async function getUserInfo(
+export async function getUserInfo(tokenSet: TokenSet): Promise<AuthenticatedUser> {
-  tokenSet: TokenSet,
-): Promise<AuthenticatedUser> {
   const client = getOIDCClient();
   
   const claims = tokenSet.claims();
@@ -87,17 +90,12 @@ export async function getUserInfo(
   }
   
   const id = String(claims.sub);
-  const username = String(
+  const username = String(userInfo.preferred_username || claims.preferred_username || claims.name || id);
-    userInfo.preferred_username ||
+  const email = String(userInfo.email || claims.email || '');
-      claims.preferred_username ||
+  const fullName = String(userInfo.name || claims.name || '') || null;
-      claims.name ||
-      id,
-  );
-  const email = String(userInfo.email || claims.email || "");
-  const fullName = String(userInfo.name || claims.name || "") || null;
   
   if (!email) {
-    throw new Error("Email not provided by OIDC provider");
+    throw new Error('Email not provided by OIDC provider');
   }
   
   return {

backend/src/config/index.ts

@@ -14,6 +14,9 @@ export const config = {
   oidc: {
     issuerUrl: process.env.OIDC_ISSUER_URL || "",
     clientId: process.env.OIDC_CLIENT_ID || "",
+    redirectUri:
+      process.env.OIDC_REDIRECT_URI ||
+      "http://localhost:3001/api/auth/callback",
   },
 
   session: {

backend/src/index.ts

@@ -42,7 +42,7 @@ async function main() {
       saveUninitialized: false,
       name: "sessionId",
       cookie: {
-        secure: config.nodeEnv === "production",
+        secure: false,
         httpOnly: true,
         maxAge: config.session.maxAge,
         sameSite: "lax",

docker-compose.yml

@@ -23,6 +23,7 @@ services:
       DATABASE_URL: "postgresql://timetracker:timetracker_password@db:5432/timetracker"
       OIDC_ISSUER_URL: ${OIDC_ISSUER_URL}
       OIDC_CLIENT_ID: ${OIDC_CLIENT_ID}
+      OIDC_REDIRECT_URI: "${API_URL}/auth/callback"
       SESSION_SECRET: ${SESSION_SECRET}
       PORT: 3001
       NODE_ENV: development

timetracker-chart/Chart.yaml

@@ -2,6 +2,6 @@ apiVersion: v2
 name: timetracker
 description: A Helm chart for the TimeTracker application
 type: application
-version: 1.0.4
+version: 1.0.5
 appVersion: "1.0.0"
 dependencies: []

timetracker-chart/templates/backend-deployment.yaml

@@ -54,6 +54,8 @@ spec:
               value: {{ .Values.backend.oidc.issuerUrl | quote }}
             - name: OIDC_CLIENT_ID
               value: {{ .Values.backend.oidc.clientId | quote }}
+            - name: OIDC_REDIRECT_URI
+              value: {{ (index .Values.ingress.hosts 0).host | printf "https://%s/api/auth/callback" | quote }}
             - name: SESSION_SECRET
               value: {{ .Values.backend.session.secret | quote }}
             - name: APP_URL