Bind share link sessions to the token's own resource

server/routers/badger/exchangeSession.ts

@@ -164,6 +164,14 @@ export async function exchangeSession(
                 )
                 .limit(1);
             if (res) {
+                if (res.resourceId !== resource.resourceId) {
+                    return next(
+                        createHttpError(
+                            HttpCode.UNAUTHORIZED,
+                            "Invalid request token"
+                        )
+                    );
+                }
                 await createResourceSession({
                     token,
                     resourceId: resource.resourceId,

server/routers/badger/verifySession.ts

@@ -821,10 +821,6 @@ export async function verifyResourceSession(
                 }
 
                 if (resourceSession.accessTokenId) {
-                    logger.debug(
-                        "Resource allowed because access token session is valid"
-                    );
-
                     const [tokenItem] = await db
                         .select()
                         .from(resourceAccessToken)
@@ -836,26 +832,37 @@ export async function verifyResourceSession(
                         )
                         .limit(1);
 
-                    const userData = tokenItem
-                        ? await getAccessTokenUserData(
-                              tokenItem,
-                              resource.orgId
-                          )
-                        : undefined;
+                    if (
+                        tokenItem &&
+                        tokenItem.resourceId === resource.resourceId
+                    ) {
+                        logger.debug(
+                            "Resource allowed because access token session is valid"
+                        );
 
-                    logAccessTokenRequestAudit(
-                        {
-                            resourceId: resource.resourceId,
-                            orgId: resource.orgId,
-                            location: ipCC,
-                            accessTokenId: resourceSession.accessTokenId,
-                            tokenTitle: tokenItem?.title ?? null,
-                            userData
-                        },
-                        parsedBody.data
+                        const userData = await getAccessTokenUserData(
+                            tokenItem,
+                            resource.orgId
+                        );
+
+                        logAccessTokenRequestAudit(
+                            {
+                                resourceId: resource.resourceId,
+                                orgId: resource.orgId,
+                                location: ipCC,
+                                accessTokenId: resourceSession.accessTokenId,
+                                tokenTitle: tokenItem.title ?? null,
+                                userData
+                            },
+                            parsedBody.data
+                        );
+
+                        return allowed(res, userData, dontStripSession);
+                    }
+
+                    logger.debug(
+                        "Access token session does not belong to this resource"
                     );
-
-                    return allowed(res, userData, dontStripSession);
                 }
 
                 if (resourceSession.userSessionId && sso) {

server/routers/resource/authWithAccessToken.ts

@@ -1,6 +1,5 @@
 import { generateSessionToken } from "@server/auth/sessions/app";
-import { db } from "@server/db";
-import { Resource, resources, users } from "@server/db";
+import { db, users } from "@server/db";
 import HttpCode from "@server/types/HttpCode";
 import response from "@server/lib/response";
 import { eq } from "drizzle-orm";
@@ -65,82 +64,35 @@ export async function authWithAccessToken(
     const { accessToken, accessTokenId } = parsedBody.data;
 
     try {
-        let valid;
-        let tokenItem;
-        let error;
-        let resource: Resource | undefined;
-
-        if (accessTokenId) {
-            if (!resourceId) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Resource ID is required"
-                    )
-                );
-            }
-
-            const [foundResource] = await db
-                .select()
-                .from(resources)
-                .where(eq(resources.resourceId, resourceId))
-                .limit(1);
-
-            if (!foundResource) {
-                return next(
-                    createHttpError(HttpCode.NOT_FOUND, "Resource not found")
-                );
-            }
-
-            const res = await verifyResourceAccessToken({
+        const { valid, tokenItem, error, resource } =
+            await verifyResourceAccessToken({
+                accessToken,
                 accessTokenId,
-                accessToken
+                resourceId
             });
 
-            valid = res.valid;
-            tokenItem = res.tokenItem;
-            error = res.error;
-            resource = foundResource;
-        } else {
-            const res = await verifyResourceAccessToken({
-                accessToken
-            });
+        if (!valid || !tokenItem || !resource) {
+            if (resource) {
+                if (config.getRawConfig().app.log_failed_attempts) {
+                    logger.info(
+                        `Resource access token invalid. Resource ID: ${resource.resourceId}. IP: ${req.ip}.`
+                    );
+                }
 
-            valid = res.valid;
-            tokenItem = res.tokenItem;
-            error = res.error;
-            resource = res.resource;
-        }
-
-        if (!tokenItem || !resource) {
-            return next(
-                createHttpError(
-                    HttpCode.UNAUTHORIZED,
-                    "Access token does not exist for resource"
-                )
-            );
-        }
-
-        if (!valid) {
-            if (config.getRawConfig().app.log_failed_attempts) {
-                logger.info(
-                    `Resource access token invalid. Resource ID: ${resource.resourceId}. IP: ${req.ip}.`
-                );
+                logAccessAudit({
+                    orgId: resource.orgId,
+                    resourceId: resource.resourceId,
+                    action: false,
+                    type: "accessToken",
+                    userAgent: req.headers["user-agent"],
+                    requestIp: req.ip
+                });
             }
 
-            logAccessAudit({
-                orgId: resource.orgId,
-                resourceId: resource.resourceId,
-                action: false,
-                type: "accessToken",
-                userAgent: req.headers["user-agent"],
-                requestIp: req.ip
-            });
-
             return next(
                 createHttpError(
                     HttpCode.UNAUTHORIZED,
-                    error || "Invalid access token"
+                    error || "Access token does not exist for resource"
                 )
             );
         }

src/app/auth/resource/[resourceGuid]/page.tsx

@@ -248,10 +248,7 @@ export default async function ResourceAuthPage(props: {
     if (searchParams.token) {
         return (
             <div className="w-full max-w-md">
-                <AccessToken
-                    token={searchParams.token}
-                    resourceId={authInfo.resourceId}
-                />
+                <AccessToken token={searchParams.token} />
             </div>
         );
     }

src/components/AccessToken.tsx

@@ -17,10 +17,9 @@ import { useTranslations } from "next-intl";
 
 type AccessTokenProps = {
     token: string;
-    resourceId?: number;
 };
 
-export default function AccessToken({ token, resourceId }: AccessTokenProps) {
+export default function AccessToken({ token }: AccessTokenProps) {
     const [loading, setLoading] = useState(true);
     const [isValid, setIsValid] = useState(false);
 
@@ -59,13 +58,13 @@ export default function AccessToken({ token, resourceId }: AccessTokenProps) {
             return;
         }
 
-        async function checkSHA256() {
+        async function check() {
             try {
                 const res = await api.post<
                     AxiosResponse<AuthWithAccessTokenResponse>
                 >(`/auth/access-token`, {
                     accessToken,
-                    accessTokenId
+                    accessTokenId: accessTokenId || undefined
                 });
 
                 if (res.data.data.session) {
@@ -82,35 +81,7 @@ export default function AccessToken({ token, resourceId }: AccessTokenProps) {
             }
         }
 
-        async function check() {
-            try {
-                const res = await api.post<
-                    AxiosResponse<AuthWithAccessTokenResponse>
-                >(`/auth/resource/${resourceId}/access-token`, {
-                    accessToken,
-                    accessTokenId
-                });
-
-                if (res.data.data.session) {
-                    setIsValid(true);
-                    window.location.href = appendRequestToken(
-                        res.data.data.redirectUrl!,
-                        res.data.data.session
-                    );
-                }
-            } catch (e) {
-                console.error(t("accessTokenError"), e);
-            } finally {
-                setLoading(false);
-            }
-        }
-
-        if (!accessTokenId) {
-            // no access token id so check the sha256
-            checkSHA256();
-        } else {
-            check();
-        }
+        check();
     }, [token]);
 
     function renderTitle() {