Josep Piguillem
ec4f687ca8
Under the e-mail and password form, a button takes the redirect flow (Authorization Code + PKCE), so the password is only ever typed at the identity server. The routes for it were already there; the page had no way to reach them. A Pireon client allows one grant type and the panel's is a password client, so the redirect flow can use its own: PIREON_REDIRECT_CLIENT_ID and PIREON_REDIRECT_CLIENT_SECRET (the main client when they are empty). The button shows up once that client is set, or with PIREON_REDIRECT_LOGIN=true. Each session renews its token with the client that issued it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
63 lines
2.1 KiB
PHP
63 lines
2.1 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Http\Controllers\Auth\PireonAuthController;
|
|
use App\Http\Controllers\DocsController;
|
|
use App\Http\Controllers\LocaleController;
|
|
use Illuminate\Support\Facades\Route;
|
|
|
|
Route::redirect('/', '/admin');
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Authentication — Pireon OAuth2 (Authorization Code + PKCE)
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| `login` is the page Filament bounces guests to: an e-mail and password form
|
|
| (password grant) with «Entrar con Pireon» under it, which starts this flow at
|
|
| `auth.redirect`.
|
|
|
|
|
*/
|
|
|
|
// Laravel's own "unauthenticated" redirect targets a route named `login`;
|
|
// point it at the panel's login page so both agree on one screen.
|
|
Route::redirect('/login', '/admin/login')->name('login');
|
|
|
|
Route::middleware('guest')->group(function () {
|
|
Route::get('/auth/redirect', [PireonAuthController::class, 'redirect'])
|
|
->name('auth.redirect');
|
|
|
|
Route::get('/auth/callback', [PireonAuthController::class, 'callback'])
|
|
->name('auth.callback');
|
|
});
|
|
|
|
Route::post('/logout', [PireonAuthController::class, 'logout'])
|
|
->middleware('auth')
|
|
->name('logout');
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Locale switching
|
|
|--------------------------------------------------------------------------
|
|
*/
|
|
|
|
Route::get('/locale/{locale}', LocaleController::class)->name('locale.switch');
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| API documentation
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Browsable docs for both APIs, rendered from public/openapi.yaml. Readable
|
|
| without signing in on purpose: the people who need it most are writing the
|
|
| public frontend and have no reason to hold a panel account, and the
|
|
| specification describes endpoints rather than secrets.
|
|
|
|
|
| To keep it to the collective instead, wrap this route in the `auth`
|
|
| middleware and move openapi.yaml out of public/.
|
|
|
|
|
*/
|
|
|
|
Route::get('/docs/api', DocsController::class)->name('docs.api');
|