matt/port-nimara-client-portal
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FEAT: Enhance authentication system with internal API support, Keycloak connectivity diagnostics, and simplified client implementation

Browse Source
This commit is contained in:
Matt
2025-06-17 15:05:41 +02:00
parent 04ed9a094d
commit 8d378f5b53
4 changed files with 143 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

59
docs/502-error-fixes-implementation.md
View File

@@ -219,12 +219,67 @@ If issues occur:
3. **Alerts**: Set up monitoring alerts for circuit breaker
4. **Testing**: Add automated integration tests for auth flow
## Post-Implementation Fixes
After the initial implementation, additional issues were discovered and resolved:
### Issue: Keycloak Client Compatibility
**Problem**: The enhanced keycloak-client.ts with custom headers was incompatible with Nitro/Nuxt $fetch, causing immediate fetch failures.
**Solution**: Simplified the client by removing problematic headers:
- Removed `Connection: keep-alive` and `Keep-Alive` headers
- Removed custom timeout implementation
- Kept retry logic and circuit breaker functionality
### Issue: Background Task Authentication
**Problem**: Background tasks (like `process-sales-emails`) were failing with 401 errors because they don't have user sessions.
**Solution**: Enhanced `server/utils/auth.ts` to support internal authentication:
- Added support for `x-tag: 094ut234` header for system tasks
- Added localhost detection for internal calls
- Added optional `INTERNAL_API_SECRET` environment variable support
### Issue: Network Diagnostics
**Problem**: Difficult to diagnose Docker networking issues with Keycloak connectivity.
**Solution**: Added diagnostic endpoint:
- `/api/debug/test-keycloak-connectivity` - Tests basic connectivity to Keycloak from within container
## Updated Files Summary
**New Files**:
- `server/utils/keycloak-client.ts` - Resilient HTTP client (simplified version)
- `server/api/debug/test-keycloak-connectivity.ts` - Connectivity diagnostic tool
- `docs/502-error-fixes-implementation.md` - This documentation
**Modified Files**:
- `server/api/auth/keycloak/callback.ts` - Uses simplified keycloak client
- `server/api/auth/refresh.ts` - Enhanced with retry logic
- `server/utils/auth.ts` - Added internal authentication support
- `pages/login.vue` - Better error message handling
- `plugins/00.startup-check.server.ts` - Enhanced startup checks
- `server/api/health.ts` - Added circuit breaker monitoring
## Testing the Fixes
### 1. Test Keycloak Connectivity
```bash
curl https://client.portnimara.dev/api/debug/test-keycloak-connectivity
```
### 2. Test Background Task Authentication
The `process-sales-emails` task should now work without 401 errors due to the `x-tag: 094ut234` header being recognized as internal authentication.
### 3. Test User Authentication Flow
Normal login should work without 502 errors, with better retry logic handling temporary network issues.
## Summary
These changes provide a robust, resilient authentication system that can handle:
- Temporary network issues
- Service degradation
- High load scenarios
- Monitoring and debugging
- Background task authentication
- Better monitoring and debugging
The 502 errors during login should now be completely eliminated with proper fallback mechanisms and user feedback.
The 502 errors during login should now be completely eliminated with proper fallback mechanisms and user feedback. Background tasks now have proper authentication bypassing user session requirements.