Release

.github/workflows/docker-publish-develop.yml

@@ -38,10 +38,9 @@ jobs:
       # https://github.com/sigstore/cosign-installer
       - name: Install cosign
         if: github.event_name != 'pull_request'
-        uses: sigstore/cosign-installer@f3c664df7af409cb4873aa5068053ba9d61a57b6 #v2.6.0
+        uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1
         with:
-          cosign-release: 'v1.13.1'
-
+          cosign-release: 'v2.1.1'
 
       # Workaround: https://github.com/docker/build-push-action/issues/461
       - name: Setup Docker buildx
@@ -88,10 +87,12 @@ jobs:
       - name: Sign the published Docker image
         if: ${{ github.event_name != 'pull_request' }}
         env:
-          COSIGN_EXPERIMENTAL: "true"
+          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+          TAGS: ${{ steps.meta.outputs.tags }}
+          DIGEST: ${{ steps.build-and-push.outputs.digest }}
         # This step uses the identity token to provision an ephemeral certificate
         # against the sigstore community Fulcio instance.
-        run: echo "${{ steps.meta.outputs.tags }}" | xargs -I {} cosign sign {}@${{ steps.build-and-push.outputs.digest }}
+        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
 
       - name: Log into registry ${{ env.DOCKER_REGISTRY }}
         uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9

.github/workflows/docker-publish-master.yml

@@ -38,10 +38,9 @@ jobs:
       # https://github.com/sigstore/cosign-installer
       - name: Install cosign
         if: github.event_name != 'pull_request'
-        uses: sigstore/cosign-installer@f3c664df7af409cb4873aa5068053ba9d61a57b6 #v2.6.0
+        uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1
         with:
-          cosign-release: 'v1.13.1'
-
+          cosign-release: 'v2.1.1'
 
       # Workaround: https://github.com/docker/build-push-action/issues/461
       - name: Setup Docker buildx
@@ -88,10 +87,12 @@ jobs:
       - name: Sign the published Docker image
         if: ${{ github.event_name != 'pull_request' }}
         env:
-          COSIGN_EXPERIMENTAL: "true"
+          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+          TAGS: ${{ steps.meta.outputs.tags }}
+          DIGEST: ${{ steps.build-and-push.outputs.digest }}
         # This step uses the identity token to provision an ephemeral certificate
         # against the sigstore community Fulcio instance.
-        run: echo "${{ steps.meta.outputs.tags }}" | xargs -I {} cosign sign {}@${{ steps.build-and-push.outputs.digest }}
+        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
 
       - name: Log into registry ${{ env.DOCKER_REGISTRY }}
         uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9

src/app/@core/configs/keycloak.config.ts

@@ -1,17 +1,24 @@
 import {KeycloakEvent, KeycloakService} from "keycloak-angular";
 import {environment} from '../../../environments/environment';
+import Keycloak from "keycloak-js";
 
 export function initializeKeycloak(keycloak: KeycloakService) {
   keycloak.keycloakEvents$.subscribe({
     next(event: KeycloakEvent) {
       keycloak.isLoggedIn().then(loggedIn => {
         if (!loggedIn) {
           const expirationDate: Date = new Date(0);
-          document.cookie = `${environment.cookies.token.name}=; expires=${expirationDate.toUTCString()}; path=/; domain=${environment.cookies.token.domain}; SameSite=Stric`;
+          document.cookie = `${environment.cookies.accessToken.name}=; expires=${expirationDate.toUTCString()}; path=/; domain=${environment.cookies.accessToken.domain}; SameSite=Stric`;
+          document.cookie = `${environment.cookies.refreshToken.name}=; expires=${expirationDate.toUTCString()}; path=/; domain=${environment.cookies.refreshToken.domain}; SameSite=Stric`;
         } else {
-          const token: string = keycloak.getKeycloakInstance().token;
-          if (token && token !== '') {
-            document.cookie = `${environment.cookies.token.name}=${token}; expires=Session; path=/; domain=${environment.cookies.token.domain}; SameSite=Strict`;
+          const keycloakInstance: Keycloak = keycloak.getKeycloakInstance();
+          const accessToken: string = keycloakInstance?.token;
+          if (accessToken && accessToken !== '') {
+            document.cookie = `${environment.cookies.accessToken.name}=${accessToken}; expires=Session; path=/; domain=${environment.cookies.accessToken.domain}; SameSite=Strict`;
+          }
+          const refreshToken: string = keycloakInstance?.refreshToken;
+          if (refreshToken && refreshToken !== '') {
+            document.cookie = `${environment.cookies.refreshToken.name}=${refreshToken}; expires=Session; path=/; domain=${environment.cookies.refreshToken.domain}; SameSite=Strict`;
           }
         }
       })

src/app/features/home/home.component.html

@@ -14,7 +14,6 @@
                     [link]="getIdentityApiLink()"
                     class="w-full h-full items-center"
             ></app-button>
-            -->
             <app-button
                     label="Ades"
                     [leftIcon]="faLink"

src/app/features/main-layout/main-layout.component.html

@@ -1,4 +1,4 @@
-<div class="bg-primary-black flex flex-col h-screen justify-between overflow-x-hidden">
+<div class="bg-primary-black flex flex-col justify-between overflow-x-hidden">
     <header class="bg-primary-black">
         <app-navbar
                 (login)="onLogin()"

src/environments/environment.demo.ts

@@ -20,9 +20,13 @@ export const environment = {
     dummyService: "https://identity.dummy-service.demo.eoepca.org",
   },
   cookies: {
-    token: {
+    accessToken: {
       name: 'auth_user_id',
       domain: '.demo.eoepca.org'
+    },
+    refreshToken: {
+      name: 'auth_refresh_token',
+      domain: '.demo.eoepca.org'
     }
   }
 };

src/environments/environment.develop.ts

@@ -20,9 +20,13 @@ export const environment = {
     dummyService: "https://identity.dummy-service.develop.eoepca.org",
   },
   cookies: {
-    token: {
+    accessToken: {
       name: 'auth_user_id',
       domain: '.develop.eoepca.org'
+    },
+    refreshToken: {
+      name: 'auth_refresh_token',
+      domain: '.develop.eoepca.org'
     }
   }
 };

src/environments/environment.production.ts

@@ -21,9 +21,13 @@ export const environment = {
     dummyService: "https://identity.dummy-service.eoepca.org",
   },
   cookies: {
-    token: {
+    accessToken: {
       name: 'auth_user_id',
       domain: '.eoepca.org'
+    },
+    refreshToken: {
+      name: 'auth_refresh_token',
+      domain: '.eoepca.org'
     }
   }
 };

src/environments/environment.staging.ts

@@ -21,9 +21,13 @@ export const environment = {
     dummyService: "https://identity.dummy-service.staging.eoepca.org",
   },
   cookies: {
-    token: {
+    accessToken: {
       name: 'auth_user_id',
       domain: '.staging.eoepca.org'
+    },
+    refreshToken: {
+      name: 'auth_refresh_token',
+      domain: '.staging.eoepca.org'
     }
   }
 };

src/environments/environment.ts

@@ -20,9 +20,13 @@ export const environment = {
     dummyService: "https://identity.dummy-service.develop.eoepca.org",
   },
   cookies: {
-    token: {
+    accessToken: {
       name: 'auth_user_id',
       domain: 'localhost'
+    },
+    refreshToken: {
+      name: 'auth_refresh_token',
+      domain: 'localhost'
     }
   }
 };

src/index.html

@@ -7,7 +7,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <link rel="icon" type="image/x-icon" href="favicon.ico">
 </head>
-<body>
+<body class="bg-primary-black">
 <app-root></app-root>
 </body>
 </html>