fix: register API resource in Logto for JWT access tokens
All checks were successful
CI / build (push) Successful in 38s
CI / docker (push) Successful in 39s

Logto returns opaque access tokens when no resource is specified.
Added API resource creation to bootstrap, included resource indicator
in /api/config, and SPA now passes resource parameter in auth request.
Also fixed issuer-uri to match Logto's public endpoint.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
hsiegeln
2026-04-05 01:01:32 +02:00
parent 6764f981d2
commit 84667170f1
5 changed files with 39 additions and 10 deletions

View File

@@ -27,13 +27,17 @@ public class PublicConfigController {
@GetMapping("/api/config")
public Map<String, String> config() {
String clientId = spaClientId;
JsonNode bootstrap = readBootstrapFile();
// Fall back to bootstrap file if env var not set
String clientId = spaClientId;
if (clientId == null || clientId.isEmpty()) {
clientId = readBootstrapClientId();
clientId = bootstrap != null && bootstrap.has("spaClientId")
? bootstrap.get("spaClientId").asText() : "";
}
String apiResource = bootstrap != null && bootstrap.has("apiResourceIndicator")
? bootstrap.get("apiResourceIndicator").asText() : "";
// Use public endpoint for browser redirects (not Docker-internal URL)
String endpoint = logtoPublicEndpoint;
if (endpoint == null || endpoint.isEmpty()) {
@@ -42,20 +46,20 @@ public class PublicConfigController {
return Map.of(
"logtoEndpoint", endpoint,
"logtoClientId", clientId != null ? clientId : ""
"logtoClientId", clientId != null ? clientId : "",
"logtoResource", apiResource
);
}
private String readBootstrapClientId() {
private JsonNode readBootstrapFile() {
try {
File file = new File(BOOTSTRAP_FILE);
if (file.exists()) {
JsonNode node = objectMapper.readTree(file);
return node.has("spaClientId") ? node.get("spaClientId").asText() : "";
return objectMapper.readTree(file);
}
} catch (Exception e) {
log.warn("Failed to read bootstrap config: {}", e.getMessage());
}
return "";
return null;
}
}