DenozordecandCursor
39e4856caa
Таблица audit_log, recordAudit на мутациях, GET /api/v1/audit и dual-write source_app=fw. Co-authored-by: Cursor <cursoragent@cursor.com>
49 lines
1.4 KiB
Markdown
49 lines
1.4 KiB
Markdown
# Интеграция auth-portal ↔ EvoFirewall
|
||
|
||
App id: **`fw`**.
|
||
|
||
## Flow
|
||
|
||
```
|
||
Browser → EvoFirewall UI (нет token)
|
||
→ redirect AUTH_PORTAL_URL/?return_to=…/auth/callback
|
||
→ login
|
||
→ redirect return_to#access_token=…
|
||
→ /auth/callback сохраняет token
|
||
→ API Authorization: Bearer <JWT>
|
||
```
|
||
|
||
## Permissions
|
||
|
||
| Permission | UI |
|
||
|------------|-----|
|
||
| `fw:dashboard:read` | `/` |
|
||
| `fw:agents:read` / `write` | `/agents` |
|
||
| `fw:lists:read` / `write` | `/lists` |
|
||
| `fw:policies:read` / `write` | `/rules`, overrides |
|
||
| `fw:stats:read` | `/stats` |
|
||
| `fw:settings:admin` | `/settings`, install-context |
|
||
| `fw:audit:read` | `GET /api/v1/audit` (локальный журнал) |
|
||
|
||
## Env
|
||
|
||
```env
|
||
AUTH_REQUIRED=true
|
||
AUTH_JWT_SECRET=<тот же JWT_SECRET портала>
|
||
AUTH_ISSUER=https://auth.shnt.top
|
||
AUTH_PORTAL_URL=https://auth.shnt.top
|
||
AUTH_AUDIT_INGEST_SECRET=<AUDIT_INGEST_SECRET портала>
|
||
PUBLIC_BASE_URL=https://fw.example.com
|
||
EVOFW_ENROLL_SEED=<hex/seed>
|
||
```
|
||
|
||
Dual-write: мутации agents/lists/rules/policy пишут в локальный `audit_log` и асинхронно шлют batch в `POST {AUTH_PORTAL_URL}/api/v1/ingest/audit` с `source_app: fw`.
|
||
|
||
```env
|
||
# apps/web/.env.local
|
||
VITE_AUTH_ENABLED=true
|
||
VITE_AUTH_PORTAL_URL=https://auth.shnt.top
|
||
```
|
||
|
||
В portal Admin → Apps выдайте app `fw` и нужные `fw:*`. URL в App Switcher: origin EvoFirewall.
|