Class XadmLoginController

java.lang.Object

br.com.xadm.comum.seguranca.XadmLoginController

@Controller
@Secured("isAnonymous()")
@Requires(property="auth.firebase-project-id",notEquals="") @Requires(property="auth.session-secret",notEquals="")
public class XadmLoginController
extends Object

Fluxo de login Google (Firebase) das views X-Adm, COMPARTILHADO — restrito a emails do domínio configurado (spec 006). Promovido de 5 cópias por app para a lib xadm-seguranca (ADR/spec 007). Um app que dependa desta lib herda estas rotas automaticamente; o app só fornece o template views/login.html (branding) e a config auth.*.

• GET /login — renderiza a página com o Firebase JS SDK; grava o cookie CSRF double-submit xadm_login_csrf.
• POST /login/callback — valida CSRF + Firebase ID token + domínio e emite o cookie de sessão xadm_session. Erros em RFC-7807 (ProblemDetail).
• POST /logout — expira o cookie de sessão, 303 para /login.

Bean condicional: só instanciado quando auth.firebase-project-id E auth.session-secret estão configurados — em dev/test sem envs a política de view do app fica em bypass e estas rotas não existem.

Migração (spec 007, L6): ao adotar a lib 0.5.0+, o app DEVE remover seu LoginController local no mesmo PR — dois @Controller("/") com /login colidem no boot.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	XadmLoginController.CallbackBody	Body do POST /login/callback.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	CSRF_COOKIE

Constructor Summary

Constructors

Constructor	Description
XadmLoginController(AuthSettings settings, FirebaseIdTokenValidator validator, SessionTokenService sessionTokens)

Method Summary

Modifier and Type	Method	Description
io.micronaut.http.HttpResponse<?>	getLogin(io.micronaut.http.HttpRequest<?> request, String from)
io.micronaut.http.HttpResponse<?>	postCallback(io.micronaut.http.HttpRequest<?> request, XadmLoginController.CallbackBody body)
io.micronaut.http.HttpResponse<?>	postLogout()

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

CSRF_COOKIE

public static final String CSRF_COOKIE

See Also:

• Constant Field Values

Constructor Details

XadmLoginController

public XadmLoginController(AuthSettings settings,
 FirebaseIdTokenValidator validator,
 SessionTokenService sessionTokens)

Method Details

getLogin

@Get("/login")
@Produces("text/html")
@View("login")
public io.micronaut.http.HttpResponse<?> getLogin(io.micronaut.http.HttpRequest<?> request,
 @Nullable @QueryValue("from")
 String from)

postCallback

@Post(value="/login/callback",
      consumes="application/json",
      produces="application/json")
public io.micronaut.http.HttpResponse<?> postCallback(io.micronaut.http.HttpRequest<?> request,
 @Body @Nullable
 XadmLoginController.CallbackBody body)

postLogout

@Post(value="/logout",
      consumes="application/x-www-form-urlencoded")
public io.micronaut.http.HttpResponse<?> postLogout()