Skip to content

Commit c2ebb47

Browse files
igor-kirichenko-DSRigor-kirichenko-DSR
authored
Heka SSO Service
Added Heka SSO Service that implements OID4VP as SSO approach
1 parent 5bba2bb commit c2ebb47

270 files changed

Lines changed: 37241 additions & 1267 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/heka-sso-service-publish.yml‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
name: Build and publish Heka SSO Service Docker image
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches:
7+
- main
8+
paths:
9+
- 'heka-sso-service/**'
10+
- '!heka-sso-service/docs/**'
11+
- '!heka-sso-service/README.md'
12+
pull_request:
13+
branches:
14+
- main
15+
paths:
16+
- 'heka-sso-service/**'
17+
- '!heka-sso-service/docs/**'
18+
- '!heka-sso-service/README.md'
19+
20+
env:
21+
REGISTRY: ghcr.io
22+
# github.repository as <account>/<repo>
23+
IMAGE_NAME: ${{ github.repository_owner }}/heka-sso-service
24+
25+
permissions:
26+
contents: read
27+
28+
jobs:
29+
build:
30+
defaults:
31+
run:
32+
working-directory: ./heka-sso-service
33+
runs-on: ubuntu-latest
34+
permissions:
35+
contents: read
36+
packages: write
37+
# This is used to complete the identity challenge
38+
# with sigstore/fulcio when running outside of PRs.
39+
id-token: write
40+
41+
steps:
42+
- name: Harden the runner (Audit all outbound calls)
43+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
44+
with:
45+
egress-policy: audit
46+
47+
- name: Checkout repository
48+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
49+
50+
# Extract version from package.json for tagging
51+
- name: Extract version
52+
id: version
53+
run: |
54+
APP_VERSION=$(cat package.json | grep -o '"version": "[^"]*"' | grep -o '[0-9][^"]*')
55+
COMMIT_SHA=$(git rev-parse --short HEAD)
56+
echo "commit_sha=${COMMIT_SHA}" >> $GITHUB_OUTPUT
57+
echo "unique_version=${APP_VERSION}-${COMMIT_SHA}" >> $GITHUB_OUTPUT
58+
echo "Extracted version: ${APP_VERSION}"
59+
echo "Commit SHA: ${COMMIT_SHA}"
60+
echo "Unique version: ${APP_VERSION}-${COMMIT_SHA}"
61+
62+
# Install the cosign tool except on PR
63+
# https://github.com/sigstore/cosign-installer
64+
- name: Install cosign
65+
if: github.event_name != 'pull_request'
66+
uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
67+
with:
68+
cosign-release: 'v2.2.4'
69+
70+
# Set up BuildKit Docker container builder to be able to build
71+
# multi-platform images and export cache
72+
# https://github.com/docker/setup-buildx-action
73+
- name: Set up Docker Buildx
74+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
75+
76+
# Login against a Docker registry except on PR
77+
# https://github.com/docker/login-action
78+
- name: Log into registry ${{ env.REGISTRY }}
79+
if: github.event_name != 'pull_request'
80+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
81+
with:
82+
registry: ${{ env.REGISTRY }}
83+
username: ${{ github.actor }}
84+
password: ${{ secrets.GITHUB_TOKEN }}
85+
86+
# Extract metadata (tags, labels) for Docker
87+
# https://github.com/docker/metadata-action
88+
- name: Extract Docker metadata
89+
id: meta
90+
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
91+
with:
92+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
93+
tags: |
94+
type=ref,event=branch
95+
type=ref,event=pr
96+
type=raw,value=v${{ steps.version.outputs.unique_version }}
97+
type=raw,value=latest,enable={{is_default_branch}}
98+
99+
# Build and push Docker image with Buildx (don't push on PR)
100+
# https://github.com/docker/build-push-action
101+
- name: Build and push Docker image
102+
id: build-and-push
103+
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
104+
with:
105+
context: ./heka-sso-service
106+
push: ${{ github.event_name != 'pull_request' }}
107+
tags: ${{ steps.meta.outputs.tags }}
108+
labels: ${{ steps.meta.outputs.labels }}
109+
cache-from: type=gha
110+
cache-to: type=gha,mode=max
111+
platforms: linux/amd64,linux/arm64
112+
113+
# Output the image tags for easy copying
114+
- name: Output image tags
115+
if: github.event_name != 'pull_request'
116+
run: |
117+
echo "🐳 Docker image built and pushed!"
118+
echo "📋 Image tags:"
119+
echo "${{ steps.meta.outputs.tags }}" | while read -r tag; do
120+
echo " 📌 $tag"
121+
done
122+
echo ""
123+
echo "🏷️ Versioned tag:"
124+
echo " 📌 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:v${{ steps.version.outputs.unique_version }}"
125+
126+
# Sign the resulting Docker image digest except on PRs.
127+
# This will only write to the public Rekor transparency log when the Docker
128+
# repository is public to avoid leaking data. If you would like to publish
129+
# transparency data even for private images, pass --force to cosign below.
130+
# https://github.com/sigstore/cosign
131+
- name: Sign the published Docker image
132+
if: ${{ github.event_name != 'pull_request' }}
133+
env:
134+
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
135+
TAGS: ${{ steps.meta.outputs.tags }}
136+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
137+
# This step uses the identity token to provision an ephemeral certificate
138+
# against the sigstore community Fulcio instance.
139+
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎.github/workflows/heka-sso-service-verify.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: Verify Heka SSO Service changes
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
paths:
8+
- 'heka-sso-service/**'
9+
- '.github/workflows/heka-sso-service-verify.yml'
10+
11+
# This allows a subsequently queued workflow run to interrupt previous runs
12+
concurrency:
13+
group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
14+
cancel-in-progress: true
15+
16+
jobs:
17+
verify:
18+
defaults:
19+
run:
20+
working-directory: ./heka-sso-service
21+
name: Build and check
22+
runs-on: ubuntu-latest
23+
24+
services:
25+
postgres:
26+
image: postgres:15
27+
env:
28+
POSTGRES_DB: heka-sso-service
29+
POSTGRES_USER: heka
30+
POSTGRES_PASSWORD: heka1
31+
ports:
32+
- 5432:5432
33+
options: >-
34+
--health-cmd pg_isready
35+
--health-interval 10s
36+
--health-timeout 5s
37+
--health-retries 5
38+
39+
steps:
40+
- name: Harden the runner (Audit all outbound calls)
41+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
42+
with:
43+
egress-policy: audit
44+
45+
- name: Prepare Github Runner
46+
uses: pandaswhocode/initialize-github-job@ffb7446339e8e6007b942312ac95457d1a20b6cf # v1.0.4
47+
with:
48+
checkout: 'true'
49+
checkout-ref: '${{ github.ref }}'
50+
checkout-token: '${{ secrets.GITHUB_TOKEN }}'
51+
setup-node: 'true'
52+
node-version: '22'
53+
54+
- name: Enable Corepack
55+
run: corepack enable
56+
57+
- name: Install dependencies
58+
run: yarn install --immutable
59+
shell: bash
60+
61+
# the login page is a built artifact — the service tests serve
62+
# and assert it, so it must exist before `yarn test`
63+
- name: Build login page UI
64+
run: yarn ui:build
65+
66+
- name: Run typecheck
67+
run: yarn check-types
68+
69+
- name: Run ESLint
70+
run: yarn lint-check
71+
72+
- name: Run tests
73+
run: env FORCE_COLOR=1 yarn test

‎.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,3 +56,7 @@ node_modules/
5656
# Yarn Berry (regenerated on install; keep .yarn/releases & .yarn/plugins tracked)
5757
**/.yarn/cache
5858
**/.yarn/install-state.gz
59+
60+
# Auth0 CLI session metadata — lands here when the CLI runs with HOME unset
61+
# (its config path $HOME/.config then resolves against the cwd)
62+
.config/

‎demo/heka-keycloak-theme/.gitignore‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# Logs
2+
logs
3+
*.log
4+
npm-debug.log*
5+
6+
# Runtime data
7+
pids
8+
*.pid
9+
*.seed
10+
11+
# Directory for instrumented libs generated by jscoverage/JSCover
12+
lib-cov
13+
14+
# Coverage directory used by tools like istanbul
15+
coverage
16+
17+
# nyc test coverage
18+
.nyc_output
19+
20+
# Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files)
21+
.grunt
22+
23+
# node-waf configuration
24+
.lock-wscript
25+
26+
# Compiled binary addons (http://nodejs.org/api/addons.html)
27+
build/Release
28+
29+
# Dependency directories
30+
node_modules
31+
jspm_packages
32+
33+
# Optional npm cache directory
34+
.npm
35+
36+
# yarn cache directory
37+
.pnp.*
38+
.yarn/*
39+
!.yarn/patches
40+
!.yarn/plugins
41+
!.yarn/releases
42+
!.yarn/sdks
43+
!.yarn/versions
44+
45+
46+
# Optional REPL history
47+
.node_repl_history
48+
49+
.vscode
50+
51+
.DS_Store
52+
53+
/dist
54+
55+
/dist_keycloak
56+
/build
57+
/storybook-static
58+
59+
# build output of `jsx-email`
60+
/.rendered

‎demo/heka-keycloak-theme/.prettierignore‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
node_modules/
2+
/src/kc.gen.tsx
3+
/dist/
4+
/dist_keycloak/
5+
/public/keycloakify-dev-resources/
6+
/.vscode/
7+
/.yarn_home/

‎demo/heka-keycloak-theme/.prettierrc.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"trailingComma": "es5",
3+
"tabWidth": 2,
4+
"semi": false,
5+
"singleQuote": true,
6+
"endOfLine": "lf",
7+
"printWidth": 140
8+
}

‎demo/heka-keycloak-theme/.storybook/main.ts‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
import type { StorybookConfig } from '@storybook/react-vite'
2+
3+
const config: StorybookConfig = {
4+
stories: ['../src/**/*.mdx', '../src/**/*.stories.@(js|jsx|mjs|ts|tsx)'],
5+
addons: [],
6+
framework: {
7+
name: '@storybook/react-vite',
8+
options: {},
9+
},
10+
staticDirs: ['../public'],
11+
}
12+
export default config

‎demo/heka-keycloak-theme/.storybook/preview-head.html‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<style>
2+
body.sb-show-main.sb-main-padded {
3+
padding: 0;
4+
}
5+
6+
/* Following styles are just meant to avoid white flash when switching from one story to another */
7+
@keyframes fadeToTransparent {
8+
from {
9+
background-color: #393939;
10+
}
11+
12+
to {
13+
background-color: transparent;
14+
}
15+
}
16+
html {
17+
animation: fadeToTransparent 500ms forwards ease-in;
18+
}
19+
body > .sb-preparing-docs {
20+
visibility: hidden;
21+
}
22+
body > .sb-preparing-story {
23+
visibility: hidden;
24+
}
25+
</style>

‎demo/heka-keycloak-theme/.storybook/preview.ts‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
import type { Preview } from '@storybook/react'
2+
3+
const preview: Preview = {
4+
parameters: {
5+
controls: {
6+
matchers: {
7+
color: /(background|color)$/i,
8+
date: /Date$/i,
9+
},
10+
},
11+
},
12+
}
13+
14+
export default preview

‎demo/heka-keycloak-theme/.yarnrc.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
enableScripts: true
2+
3+
nodeLinker: node-modules
4+
5+
npmMinimalAgeGate: 0

0 commit comments

Comments
 (0)