Christophe Vila
099e746119
Now that GENIUSRUN_FRONTEND_URL exists as a separate config value, keeping the backend's own origin named "PublicBaseURL" invited exactly the kind of mixup that caused the OIDC callback 404 in the first place. Renamed consistently: env var, Config.BackendURL, api.SessionConfig.BackendURL. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
108 lines
3.7 KiB
Go
108 lines
3.7 KiB
Go
package api
|
|
|
|
import (
|
|
"log"
|
|
"net/http"
|
|
"time"
|
|
|
|
"geniusrun/backend/internal/auth"
|
|
)
|
|
|
|
// SessionConfig configures how the app-login session cookie is minted and
|
|
// validated. Secure should mirror config.Config.SessionSecure (true once
|
|
// the app is served over HTTPS).
|
|
type SessionConfig struct {
|
|
Secret []byte
|
|
Duration time.Duration
|
|
Secure bool
|
|
// BackendURL is this app's own externally reachable origin (e.g.
|
|
// "https://geniusrun.example.com", no trailing slash), used to build an
|
|
// absolute post_logout_redirect_uri for the identity provider -- some
|
|
// providers, including Keycloak, require this to be an absolute URL
|
|
// matching one registered on the client, not a bare relative path.
|
|
BackendURL string
|
|
// FrontendURL is the origin the browser should land on after the OIDC
|
|
// callback (success or failure) -- see config.Config.FrontendURL for why
|
|
// this can differ from BackendURL in a split-origin deployment.
|
|
FrontendURL string
|
|
}
|
|
|
|
type sessionMeResponse struct {
|
|
Name string `json:"name"`
|
|
Email string `json:"email"`
|
|
HasProfile bool `json:"has_profile"`
|
|
DisplayName string `json:"display_name,omitempty"`
|
|
}
|
|
|
|
func (s *Server) handleSessionLogin(w http.ResponseWriter, r *http.Request) {
|
|
authURL, txn, err := s.Auth.BeginLogin()
|
|
if err != nil {
|
|
writeError(w, http.StatusBadGateway, err.Error())
|
|
return
|
|
}
|
|
cookie, err := auth.MintTxnCookie(txn, s.Session.Secret, s.Session.Secure)
|
|
if err != nil {
|
|
writeError(w, http.StatusInternalServerError, err.Error())
|
|
return
|
|
}
|
|
http.SetCookie(w, cookie)
|
|
http.Redirect(w, r, authURL, http.StatusFound)
|
|
}
|
|
|
|
func (s *Server) handleSessionCallback(w http.ResponseWriter, r *http.Request) {
|
|
txnCookie, err := r.Cookie(auth.TxnCookieName)
|
|
if err != nil {
|
|
log.Printf("session callback: missing txn cookie: %v", err)
|
|
http.Redirect(w, r, s.Session.FrontendURL+"/?auth_error=failed", http.StatusFound)
|
|
return
|
|
}
|
|
http.SetCookie(w, auth.ClearCookie(auth.TxnCookieName, s.Session.Secure))
|
|
|
|
txn, err := auth.ParseTxnCookie(txnCookie, s.Session.Secret)
|
|
if err != nil {
|
|
log.Printf("session callback: failed to parse txn cookie: %v", err)
|
|
http.Redirect(w, r, s.Session.FrontendURL+"/?auth_error=failed", http.StatusFound)
|
|
return
|
|
}
|
|
|
|
result, err := s.Auth.HandleCallback(r.Context(), txn, r.URL.Query())
|
|
if err != nil {
|
|
log.Printf("session callback: HandleCallback failed (state mismatch, code exchange, or ID-token verification): %v", err)
|
|
http.Redirect(w, r, s.Session.FrontendURL+"/?auth_error=failed", http.StatusFound)
|
|
return
|
|
}
|
|
if !result.Authorized {
|
|
http.Redirect(w, r, s.Session.FrontendURL+"/?auth_error=forbidden", http.StatusFound)
|
|
return
|
|
}
|
|
|
|
sessionCookie, err := auth.MintSessionCookie(result.Claims, s.Session.Secret, s.Session.Duration, s.Session.Secure)
|
|
if err != nil {
|
|
writeError(w, http.StatusInternalServerError, err.Error())
|
|
return
|
|
}
|
|
http.SetCookie(w, sessionCookie)
|
|
http.Redirect(w, r, s.Session.FrontendURL+"/", http.StatusFound)
|
|
}
|
|
|
|
func (s *Server) handleSessionLogout(w http.ResponseWriter, r *http.Request) {
|
|
http.SetCookie(w, auth.ClearCookie(auth.SessionCookieName, s.Session.Secure))
|
|
http.Redirect(w, r, s.Auth.EndSessionURL(s.Session.BackendURL+"/"), http.StatusFound)
|
|
}
|
|
|
|
func (s *Server) handleSessionMe(w http.ResponseWriter, r *http.Request) {
|
|
claims, ok := auth.ClaimsFromContext(r.Context())
|
|
if !ok {
|
|
// Unreachable in practice -- RequireSession already 401s before this
|
|
// handler runs -- but fail closed rather than panic if that ever changes.
|
|
writeError(w, http.StatusUnauthorized, "not authenticated")
|
|
return
|
|
}
|
|
resp := sessionMeResponse{Name: claims.Name, Email: claims.Email}
|
|
if u, found := userFromContext(r.Context()); found {
|
|
resp.HasProfile = true
|
|
resp.DisplayName = u.DisplayName
|
|
}
|
|
writeJSON(w, http.StatusOK, resp)
|
|
}
|