125 lines
5.1 KiB
Markdown
125 lines
5.1 KiB
Markdown
# ToDo
|
|
* Public page with instructions
|
|
|
|
# Authentication
|
|
Authentication consists of the following parts:
|
|
* `next-auth` boilerplate
|
|
* `middleware.ts` = hooks-up `next-auth` into the page processing pipeline - user session is checked before any page is rendered
|
|
* `auth.ts` = defines how the authentication is done, and how session is checked (used by middleware)
|
|
* `/app/api/[...nextauth]/route.ts` = defines route which shows an authentication form
|
|
|
|
Source:
|
|
* [How to Implement Google Authentication in a Next.js App Using NextAuth](https://www.telerik.com/blogs/how-to-implement-google-authentication-nextjs-app-using-nextauth)
|
|
* [Next Js 14 Authentication on Edge Runtime](https://www.youtube.com/watch?v=rEopVx0FKGI)
|
|
|
|
# Multi-User Support
|
|
Each location record is marked with a user ID.
|
|
|
|
All the actions user `withUser` to fetch user ID, which is then used in all the DB operations.
|
|
|
|
# Deploying
|
|
The deployment is done via Docker:
|
|
* build docker image
|
|
* deploy Docker service
|
|
|
|
## Building Docker image
|
|
Run the following command:
|
|
```bash
|
|
docker build . -t utility-bills-tracker:1.0.0
|
|
```
|
|
The image will be stored in the local Docker instance.
|
|
|
|
## Deploying Docker service
|
|
Run the following command:
|
|
```bash
|
|
docker stack deploy \
|
|
-c docker-compose-deploy.yml \
|
|
utility-bills-tracker
|
|
```
|
|
|
|
# Implementation details
|
|
## Issues with HOSTNAME
|
|
When deplyed via docker and published via Cloudflare there's an issue with `HOSTNAME` env variable:
|
|
* if left unset, the server will use IP address assigned to container by Docker (i.e. 10.0.20.3) and **will not accept connections from outside**
|
|
```
|
|
▲ Next.js 14.0.2
|
|
- Local: http://68db6c9ebafe:80
|
|
- Network: http://10.0.20.3:80
|
|
```
|
|
* if set to "0.0.0.0" the server will serve static pages, but will *reject API calls when submitting form*
|
|
```
|
|
▲ Next.js 14.0.2
|
|
- Local: http://localhost:80
|
|
- Network: http://0.0.0.0:80
|
|
|
|
utility-bills-tracker_web-app.1.Error: Invalid Server Actions request.
|
|
|
|
`x-forwarded-host` header with value `0.0.0.0:80` does not match `origin` header with value `rezije.app` from a forwarded Server Actions request. Aborting the action.
|
|
```
|
|
* if set to "rezije.app" the server will not start since the IP address it resolves with the given FQDN does not match any of the IP addresses assigned to the container
|
|
```
|
|
▲ Next.js 14.0.2
|
|
- Local: http://localhost:80
|
|
- Network: http://0.0.0.0:80
|
|
|
|
utility-bills-tracker_web-app.1.Error: Invalid Server Actions request.
|
|
|
|
`x-forwarded-host` header with value `rezije.app:80` does not match `origin` header with value `rezije.app` from a forwarded Server Actions request. Aborting the action.
|
|
```
|
|
|
|
So there are the following issues:
|
|
* server will not accept external request - can be fixed by setting `HOSTNAME` to `0.0.0.0`
|
|
* server rejects API requests - can be fixed by adding `serverActions.allowedOrigins` option to `nextjs.config.js` file
|
|
|
|
So these are the fixes which were implemented in order to be able to run server in production.
|
|
|
|
This is a hack indicating that I don't understand how the damn thing should be configured!
|
|
|
|
Even when this hack is emplyed the server still logs the followig error:
|
|
```
|
|
failed to get redirect response TypeError: fetch failed
|
|
at Object.fetch (node:internal/deps/undici/undici:11730:11)
|
|
at process.processTicksAndRejections (node:internal/process/task_queues:95:5) {
|
|
cause: Error: connect ECONNREFUSED 0.0.0.0:443
|
|
at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1555:16)
|
|
at TCPConnectWrap.callbackTrampoline (node:internal/async_hooks:128:17) {
|
|
errno: -111,
|
|
code: 'ECONNREFUSED',
|
|
syscall: 'connect',
|
|
address: '0.0.0.0',
|
|
port: 443
|
|
}
|
|
}
|
|
```
|
|
|
|
## Mongo DB & AVX Instructions
|
|
The MongoDB server v > 5.0 will not run on and old machine such as Acer Revo due to it's CPU.
|
|
|
|
This issue was solved by using an older Mongo DB Version 4.4.27
|
|
|
|
# OAuth verification video transcript
|
|
|
|
This is Rezije app demonstration for Google OAuth login process for the users of our app.
|
|
The video shows that our usage of OAuth scopes complies with Google API services user data policy.
|
|
|
|
Our app does not use any of the sensitive and restricted scopes.
|
|
|
|
User's can access Terms of service and Privacy policy by clicking links in footer of the page.
|
|
|
|
Let's first click on the "Terms of service" link. Here we can see our terms of service.
|
|
|
|
Now let's click on the Privacy policy link. Here We can see our privacy policy.
|
|
|
|
Links to these pages are assigned in the apropriate fields in the Google's Cloud Console and are listed in the Google's OAuth window.
|
|
|
|
From our homepage you can login by clicking on the "Sign in with Google" button.
|
|
|
|
Here in the address bar you can see that the client ID is present in the URL.
|
|
|
|
Select the account with which you would like to sign-in with and you will be logged in into the app.
|
|
|
|
We are using two scopes:
|
|
1. OAuth ID, which is used to assign ownership to the application specific data when it's is stored and retrieved from our database.
|
|
2. user's e-mail address, which is stored in our database so that we can contact our users in case such action is needed.
|
|
|
|
For any questions regarding the use of the Google API service please feel free to reach out at support@rezije.app |