Fix grammar

.env.sample

@@ -4,14 +4,16 @@ LOG_LEVEL=trace
 KRATOS_URL=http://host.docker.internal:4433
 ORY_ADMIN_URL=http://host.docker.internal:4434 # the administrative one for kazusa (port should not be publically exposed)
 ORY_AUTH_BEARER = none
+JWKS_URL=http://host.docker.internal:4456/.well-known/jwks.json
 
 KRATOS_CONFIG_NAME=kratos-dev.yml
 KETO_CONFIG_NAME=keto-dev.yml
+OATHKEEPER_CONFIG_NAME=oathkeeper-dev.yml
 
 HOST_ADDR=0.0.0.0:4000
-SITE_URL=http://127.0.0.1:4000
+SITE_URL=http://127.0.0.1:4455/
 
-DATABASE_URL=postgresql://vcl:[email protected]/kazusa
+DATABASE_URL=postgresql://vcl:[email protected]:5432/kazusa
 REDIS_URL=redis://host.docker.internal:6379/0
 
 SELFSERVICE_FLOWS_SETTINGS_AFTER_HOOKS_0_CONFIG_URL=http://kazusa:4000/admin/settings-callback

config/kratos/kratos-dev.yml

@@ -47,8 +47,8 @@ selfservice:
         providers:
           - id: discord
             provider: discord
-            client_id: ''
-            client_secret: ''
+            client_id: ""
+            client_secret: ""
             mapper_url: file:///etc/config/kratos/oidc.discord.jsonnet
             scope:
               - email
@@ -153,7 +153,7 @@ identity:
 
 courier:
   smtp:
-    connection_uri: 'smtp://vcl:[email protected]'
+    connection_uri: "smtp://vcl:[email protected]"
     from_address: [email protected]
     from_name: Vietnam Community League
 #  template_override_path: /etc/config/kratos/mail-templates

config/oathkeeper/access-rules-dev.yml

@@ -0,0 +1,75 @@
+- id: "ory:kratos:public"
+  upstream:
+    preserve_host: true
+    url: "http://kratos:4433"
+    strip_path: /.ory/kratos/public
+  match:
+    url: "http://127.0.0.1:4455/.ory/kratos/public/<**>"
+    methods:
+      - GET
+      - POST
+      - PUT
+      - DELETE
+      - PATCH
+  authenticators:
+    - handler: noop
+  authorizer:
+    handler: allow
+  mutators:
+    - handler: noop
+
+- id: "vcl:kazusa:public"
+  upstream:
+    preserve_host: true
+    url: "http://server:4000"
+    strip_path: /.ory/kratos/public
+  match:
+    url: "http://127.0.0.1:4455/<{connections}>/<**>"
+    methods:
+      - GET
+      - POST
+      - PUT
+      - DELETE
+      - PATCH
+  authenticators:
+    - handler: cookie_session
+  authorizer:
+    handler: allow
+  mutators:
+    - handler: id_token
+
+- id: "ory:kratos-selfservice-ui-node:anonymous"
+  upstream:
+    preserve_host: true
+    url: "http://kratos-selfservice-ui-node:4435"
+  match:
+    url: "http://127.0.0.1:4455/<{registration,welcome,recovery,verification,login,error,health/{alive,ready},**.css,**.js,**.png,**.svg,**.woff*}>"
+    methods:
+      - GET
+  authenticators:
+    -
+      handler: anonymous
+  authorizer:
+    handler: allow
+  mutators:
+    -
+      handler: noop
+
+- id: "ory:kratos-selfservice-ui-node:protected"
+  upstream:
+    preserve_host: true
+    url: "http://kratos-selfservice-ui-node:4435"
+  match:
+    url: "http://127.0.0.1:4455/<{sessions,settings}>"
+    methods:
+      - GET
+  authenticators:
+    - handler: cookie_session
+  authorizer:
+    handler: allow
+  mutators:
+    - handler: id_token
+  errors:
+    - handler: redirect
+      config:
+        to: http://127.0.0.1:4455/login

config/oathkeeper/id_token.jwks.json

@@ -0,0 +1,18 @@
+{
+    "keys": [
+        {
+            "use": "sig",
+            "kty": "RSA",
+            "kid": "a2aa9739-d753-4a0d-87ee-61f101050277",
+            "alg": "RS256",
+            "n": "zpjSl0ySsdk_YC4ZJYYV-cSznWkzndTo0lyvkYmeBkW60YHuHzXaviHqonY_DjFBdnZC0Vs_QTWmBlZvPzTp4Oni-eOetP-Ce3-B8jkGWpKFOjTLw7uwR3b3jm_mFNiz1dV_utWiweqx62Se0SyYaAXrgStU8-3P2Us7_kz5NnBVL1E7aEP40aB7nytLvPhXau-YhFmUfgykAcov0QrnNY0DH0eTcwL19UysvlKx6Uiu6mnbaFE1qx8X2m2xuLpErfiqj6wLCdCYMWdRTHiVsQMtTzSwuPuXfH7J06GTo3I1cEWN8Mb-RJxlosJA_q7hEd43yYisCO-8szX0lgCasw",
+            "e": "AQAB",
+            "d": "x3dfY_rna1UQTmFToBoMn6Edte47irhkra4VSNPwwaeTTvI-oN2TO51td7vo91_xD1nw-0c5FFGi4V2UfRcudBv9LD1rHt_O8EPUh7QtAUeT3_XXgjx1Xxpqu5goMZpkTyGZ-B6JzOY3L8lvWQ_Qeia1EXpvxC-oTOjJnKZeuwIPlcoNKMRU-mIYOnkRFfnUvrDm7N9UZEp3PfI3vhE9AquP1PEvz5KTUYkubsfmupqqR6FmMUm6ulGT7guhBw9A3vxIYbYGKvXLdBvn68mENrEYxXrwmu6ITMh_y208M5rC-hgEHIAIvMu1aVW6jNgyQTunsGST3UyrSbwjI0K9UQ",
+            "p": "77fDvnfHRFEgyi7mh0c6fAdtMEMJ05W8NwTG_D-cSwfWipfTwJJrroWoRwEgdAg5AWGq-MNUzrubTVXoJdC2T4g1o-VRZkKKYoMvav3CvOIMzCBxBs9I_GAKr5NCSk7maksMqiCTMhmkoZ5RPuMYMY_YzxKNAbjBd9qFLfaVAqs",
+            "q": "3KEmPA2XQkf7dvtpY1Xkp1IfMV_UBdmYk7J6dB5BYqzviQWdEFvWaSATJ_7qV1dw0JDZynOgipp8gvoL-RepfjtArhPz41wB3J2xmBYrBr1sJ-x5eqAvMkQk2bd5KTor44e79TRIkmkFYAIdUQ5JdVXPA13S8WUZfb_bAbwaCBk",
+            "dp": "5uyy32AJkNFKchqeLsE6INMSp0RdSftbtfCfM86fZFQno5lA_qjOnO_avJPkTILDT4ZjqoKYxxJJOEXCffNCPPltGvbE5GrDXsUbP8k2-LgWNeoml7XFjIGEqcCFQoohQ1IK4DTDN6cmRh76C0e_Pbdh15D6TydJEIlsdGuu_kM",
+            "dq": "aegFNYCEojFxeTzX6vIZL2RRSt8oJKK-Be__reu0EUzYMtr5-RdMhev6phFMph54LfXKRc9ZOg9MQ4cJ5klAeDKzKpyzTukkj6U20b2aa8LTvxpZec6YuTVSxxu2Ul71IGRQijTNvVIiXWLGddk409Ub6Q7JqkyQfvdwhpWnnUk",
+            "qi": "P68-EwgcRy9ce_PZ75c909cU7dzCiaGcTX1psJiXmQAFBcG0msWfsyHGbllOZG27pKde78ORGJDYDNk1FqTwsogZyCP87EiBmOoqXWnMvKYfJ1DOx7x42LMAGwMD3bgQj9jgRACxFJG4n3NI6uFlFruyl_CLQzwW_rQFHshLK7Q"
+        }
+    ]
+}

config/oathkeeper/oathkeeper-dev.yml

@@ -0,0 +1,87 @@
+log:
+  level: debug
+  format: json
+
+serve:
+  proxy:
+    cors:
+      enabled: true
+      allowed_origins:
+        - "*"
+      allowed_methods:
+        - POST
+        - GET
+        - PUT
+        - PATCH
+        - DELETE
+      allowed_headers:
+        - Authorization
+        - Content-Type
+      exposed_headers:
+        - Content-Type
+      allow_credentials: true
+      debug: true
+
+errors:
+  fallback:
+    - json
+
+  handlers:
+    redirect:
+      enabled: true
+      config:
+        to: http://127.0.0.1:4455/login
+        when:
+          - error:
+              - unauthorized
+              - forbidden
+            request:
+              header:
+                accept:
+                  - text/html
+    json:
+      enabled: true
+      config:
+        verbose: true
+
+access_rules:
+  matching_strategy: glob
+  repositories:
+    - file:///etc/config/oathkeeper/access-rules-dev.yml
+
+authenticators:
+  anonymous:
+    enabled: true
+    config:
+      subject: guest
+
+  cookie_session:
+    enabled: true
+    config:
+      check_session_url: http://kratos:4433/sessions/whoami
+      preserve_path: true
+      extra_from: "@this"
+      subject_from: "identity.id"
+      only:
+        - ory_kratos_session
+
+  noop:
+    enabled: true
+
+authorizers:
+  allow:
+    enabled: true
+
+mutators:
+  noop:
+    enabled: true
+
+  id_token:
+    enabled: true
+    config:
+      issuer_url: http://127.0.0.1:4455/
+      jwks_url: file:///etc/config/oathkeeper/id_token.jwks.json
+      claims: |
+        {
+          "session": {{ .Extra | toJson }}
+        }

connection/connection.go

@@ -6,19 +6,15 @@ import (
 	"github.com/google/uuid"
 )
 
-type Connections struct {
-	ID uuid.UUID `json:"id" gorm:"primaryKey;type:uuid"`
-
-	Osu Connection `json:"osu" gorm:"type:bytes;serializer:gob"`
-
-	CreatedAt time.Time `json:"-"`
-	UpdatedAt time.Time `json:"-"`
-}
-
 type Connection struct {
-	Id        uint32 `json:"id"`
+	ID       uint64    `json:"id"`
+	UserId   uuid.UUID `json:"user_id" gorm:"type:uuid"`
+	Provider string    `json:"provider"`
+
+	ConnId    string `json:"conn_id"`
 	Username  string `json:"username"`
 	AvatarUrl string `json:"avatar_url"`
 
-	Country string `json:"country"`
+	CreatedAt time.Time `json:"-"`
+	UpdatedAt time.Time `json:"-"`
 }