Merge pull request #426 from Worklenz/development

Development

Author: chamikaJ

.gitignore

@@ -23,6 +23,10 @@ out/
 !.env.example
 !.env.template
 
+# Locally generated TLS certificates and private keys
+nginx/ssl/*.pem
+!nginx/ssl/.gitkeep
+
 # Logs
 logs
 *.log
@@ -82,4 +86,4 @@ $RECYCLE.BIN/
 CLAUDE.md
 
 graphify-out
-.playwright-mcp
+.playwright-mcp

docker-compose.yml

@@ -1,8 +1,6 @@
 services:
   frontend:
-    build:
-      context: ./worklenz-frontend
-      dockerfile: Dockerfile
+    image: chamikajaycey/worklenz-frontend:3.1.0-beta
     container_name: worklenz_frontend
     ports:
       - "5000:5000"
@@ -15,9 +13,7 @@ services:
       - worklenz
 
   backend:
-    build:
-      context: ./worklenz-backend
-      dockerfile: Dockerfile
+    image: chamikajaycey/worklenz-backend:3.1.0-beta
     container_name: worklenz_backend
     ports:
       - "3000:3000"
@@ -32,15 +28,16 @@ services:
     environment:
       DB_HOST: db
       DB_PORT: 5432
+      # Allows the current published image to start when Google OAuth is not configured.
+      # Replace these defaults with real credentials in .env to enable Google sign-in.
+      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-disabled}
+      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-disabled}
+      GOOGLE_CALLBACK_URL: ${GOOGLE_CALLBACK_URL:-https://localhost/api/auth/google/verify}
     networks:
       - worklenz
 
   client-portal:
-    build:
-      context: ./worklenz-client-portal
-      dockerfile: Dockerfile
-      args:
-        VITE_API_BASE_URL: ${CLIENT_PORTAL_API_BASE_URL:-http://backend:3000/api/client-portal}
+    image: chamikajaycey/worklenz-client-portal:latest
     container_name: worklenz_client_portal
     ports:
       - "5174:5174"
@@ -50,6 +47,23 @@ services:
     networks:
       - worklenz
 
+  nginx:
+    image: nginx:alpine
+    container_name: worklenz_nginx
+    ports:
+      - "80:80"
+      - "443:443"
+    depends_on:
+      - frontend
+      - backend
+    restart: unless-stopped
+    volumes:
+      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
+      - ./nginx/conf.d:/etc/nginx/conf.d:ro
+      - ./nginx/ssl:/etc/nginx/ssl:ro
+    networks:
+      - worklenz
+
   minio:
     image: minio/minio:latest
     container_name: worklenz_minio

manage.sh

@@ -0,0 +1 @@
+

nginx/ssl/.gitkeep

@@ -17,7 +17,9 @@ import LocalSignup from "./passport-strategies/passport-local-signup";
 export default (passport: PassportStatic) => {
   passport.use("local-login", LocalLogin);
   passport.use("local-signup", LocalSignup);
-  passport.use(GoogleLogin);
+  if (GoogleLogin) {
+    passport.use(GoogleLogin);
+  }
   passport.use("google-mobile", GoogleMobileLogin);
   passport.use("apple-mobile", AppleMobileLogin);
 

nginx/ssl/cert.pem

@@ -98,10 +98,26 @@ async function handleGoogleLogin(req: Request, _accessToken: string, _refreshTok
  * Passport strategy for authenticate with google
  * http://www.passportjs.org/packages/passport-google-oauth20/
  */
-export default new GoogleStrategy.Strategy({
-  clientID: process.env.GOOGLE_CLIENT_ID as string,
-  clientSecret: process.env.GOOGLE_CLIENT_SECRET as string,
-  callbackURL: process.env.GOOGLE_CALLBACK_URL as string,
-  passReqToCallback: true
-},
-  (req, _accessToken, _refreshToken, profile, done) => void handleGoogleLogin(req, _accessToken, _refreshToken, profile, done));
+const googleClientId = process.env.GOOGLE_CLIENT_ID;
+const googleClientSecret = process.env.GOOGLE_CLIENT_SECRET;
+const googleCallbackUrl = process.env.GOOGLE_CALLBACK_URL;
+
+const GoogleLogin =
+  googleClientId &&
+  googleClientId !== "disabled" &&
+  googleClientSecret &&
+  googleClientSecret !== "disabled" &&
+  googleCallbackUrl
+  ? new GoogleStrategy.Strategy(
+      {
+        clientID: googleClientId,
+        clientSecret: googleClientSecret,
+        callbackURL: googleCallbackUrl,
+        passReqToCallback: true
+      },
+      (req, _accessToken, _refreshToken, profile, done) =>
+        void handleGoogleLogin(req, _accessToken, _refreshToken, profile, done)
+    )
+  : null;
+
+export default GoogleLogin;

nginx/ssl/key.pem

@@ -14,6 +14,12 @@ import { resetPasswordLimiter, updatePasswordLimiter } from "../../middlewares/r
 
 const authRouter = express.Router();
 
+const isGoogleOAuthConfigured = Boolean(
+  process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_ID !== "disabled" &&
+    process.env.GOOGLE_CLIENT_SECRET && process.env.GOOGLE_CLIENT_SECRET !== "disabled" &&
+    process.env.GOOGLE_CALLBACK_URL
+);
+
 // Local authentication
 const options = (key: string): passport.AuthenticateOptions => ({
   failureRedirect: `/secure/verify?strategy=${key}`,
@@ -33,6 +39,10 @@ authRouter.post("/verify-captcha", safeControllerFunction(AuthController.verifyC
 
 // Google authentication
 authRouter.get("/google", (req, res, next) => {
+  if (!isGoogleOAuthConfigured) {
+    return res.status(503).json({ message: "Google sign-in is not configured" });
+  }
+
   return passport.authenticate("google", {
     scope: ["email", "profile"],
     state: JSON.stringify({
@@ -45,6 +55,10 @@ authRouter.get("/google", (req, res, next) => {
 });
 
 authRouter.get("/google/verify", (req, res, next) => {
+  if (!isGoogleOAuthConfigured) {
+    return res.status(503).json({ message: "Google sign-in is not configured" });
+  }
+
   let sessionError = "";
   if ((req.session as any).error) {
     sessionError = `?error=${encodeURIComponent((req.session as any).error as string)}`;