Modifiche

backend-node/middleware/auth.keycloak.js

@@ -0,0 +1,67 @@
+const jwksClient = require('jwks-rsa');
+const jwt = require('jsonwebtoken');
+
+const client = jwksClient({
+  jwksUri:
+    process.env.KEYCLOAK_JWKS_URI ||
+    'http://localhost:8080/realms/scommettiapp/protocol/openid-connect/certs',
+  cache: true,
+  rateLimit: true,
+  jwksRequestsPerMinute: 5,
+});
+
+function getKey(header, callback) {
+  client.getSigningKey(header.kid, (err, key) => {
+    if (err) return callback(err);
+    callback(null, key.getPublicKey());
+  });
+}
+
+module.exports = sequelize => {
+  const { User } = sequelize.models;
+
+  return (req, res, next) => {
+    const authHeader = req.headers.authorization;
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+      return res.status(401).json({ success: false, message: 'Token mancante o non valido' });
+    }
+
+    const token = authHeader.slice(7);
+
+    jwt.verify(token, getKey, { algorithms: ['RS256'] }, async (err, decoded) => {
+      if (err) {
+        return res.status(401).json({ success: false, message: 'Token non valido o scaduto' });
+      }
+
+      try {
+        const keycloakId = decoded.sub;
+        const name =
+          decoded.name ||
+          `${decoded.given_name || ''} ${decoded.family_name || ''}`.trim() ||
+          decoded.preferred_username ||
+          'Utente';
+        const email = decoded.email || `${keycloakId.slice(0, 8)}@scommetti.app`;
+        const avatarUrl = `https://picsum.photos/seed/${keycloakId.slice(0, 8)}/200/200`;
+
+        // Prima cerca per keycloakId (caso normale dopo il primo login)
+        let user = await User.findOne({ where: { keycloakId } });
+
+        if (!user) {
+          // Migrazione: l'utente potrebbe esistere già per email
+          // (creato prima che keycloakId fosse aggiunto al modello)
+          user = await User.findOne({ where: { email } });
+          if (user) {
+            await user.update({ keycloakId });
+          } else {
+            user = await User.create({ keycloakId, name, email, avatarUrl, score: 0 });
+          }
+        }
+
+        req.userId = user.id;
+        next();
+      } catch (error) {
+        next(error);
+      }
+    });
+  };
+};