calvin.erfmann/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-08-18 10:12:55 +02:00
Code Issues Packages Projects Releases Wiki Activity

Bind share link sessions to the token's own resource

Browse Source
This commit is contained in:
miloschwartz
2026-08-17 14:24:21 -04:00
parent c05d2aeafb
commit 0a8b5e46ca
5 changed files with 63 additions and 128 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/routers/badger/exchangeSession.ts
+8
View File
@@ -164,6 +164,14 @@ export async function exchangeSession(
)
.limit(1);
if (res) {
if (res.resourceId !== resource.resourceId) {
return next(
createHttpError(
HttpCode.UNAUTHORIZED,
"Invalid request token"
)
);
}
await createResourceSession({
token,
resourceId: resource.resourceId,
server/routers/badger/verifySession.ts
+29 -22
View File
@@ -821,10 +821,6 @@ export async function verifyResourceSession(
}
if (resourceSession.accessTokenId) {
logger.debug(
"Resource allowed because access token session is valid"
);
const [tokenItem] = await db
.select()
.from(resourceAccessToken)
@@ -836,26 +832,37 @@ export async function verifyResourceSession(
)
.limit(1);
const userData = tokenItem
? await getAccessTokenUserData(
tokenItem,
resource.orgId
)
: undefined;
if (
tokenItem &&
tokenItem.resourceId === resource.resourceId
) {
logger.debug(
"Resource allowed because access token session is valid"
);
logAccessTokenRequestAudit(
{
resourceId: resource.resourceId,
orgId: resource.orgId,
location: ipCC,
accessTokenId: resourceSession.accessTokenId,
tokenTitle: tokenItem?.title ?? null,
userData
},
parsedBody.data
const userData = await getAccessTokenUserData(
tokenItem,
resource.orgId
);
logAccessTokenRequestAudit(
{
resourceId: resource.resourceId,
orgId: resource.orgId,
location: ipCC,
accessTokenId: resourceSession.accessTokenId,
tokenTitle: tokenItem.title ?? null,
userData
},
parsedBody.data
);
return allowed(res, userData, dontStripSession);
}
logger.debug(
"Access token session does not belong to this resource"
);
return allowed(res, userData, dontStripSession);
}
if (resourceSession.userSessionId && sso) {
server/routers/resource/authWithAccessToken.ts
+21 -69
View File
@@ -1,6 +1,5 @@
import { generateSessionToken } from "@server/auth/sessions/app";
import { db } from "@server/db";
import { Resource, resources, users } from "@server/db";
import { db, users } from "@server/db";
import HttpCode from "@server/types/HttpCode";
import response from "@server/lib/response";
import { eq } from "drizzle-orm";
@@ -65,82 +64,35 @@ export async function authWithAccessToken(
const { accessToken, accessTokenId } = parsedBody.data;
try {
let valid;
let tokenItem;
let error;
let resource: Resource | undefined;
if (accessTokenId) {
if (!resourceId) {
return next(
createHttpError(
HttpCode.BAD_REQUEST,
"Resource ID is required"
)
);
}
const [foundResource] = await db
.select()
.from(resources)
.where(eq(resources.resourceId, resourceId))
.limit(1);
if (!foundResource) {
return next(
createHttpError(HttpCode.NOT_FOUND, "Resource not found")
);
}
const res = await verifyResourceAccessToken({
const { valid, tokenItem, error, resource } =
await verifyResourceAccessToken({
accessToken,
accessTokenId,
accessToken
resourceId
});
valid = res.valid;
tokenItem = res.tokenItem;
error = res.error;
resource = foundResource;
} else {
const res = await verifyResourceAccessToken({
accessToken
});
if (!valid || !tokenItem || !resource) {
if (resource) {
if (config.getRawConfig().app.log_failed_attempts) {
logger.info(
`Resource access token invalid. Resource ID: ${resource.resourceId}. IP: ${req.ip}.`
);
}
valid = res.valid;
tokenItem = res.tokenItem;
error = res.error;
resource = res.resource;
}
if (!tokenItem || !resource) {
return next(
createHttpError(
HttpCode.UNAUTHORIZED,
"Access token does not exist for resource"
)
);
}
if (!valid) {
if (config.getRawConfig().app.log_failed_attempts) {
logger.info(
`Resource access token invalid. Resource ID: ${resource.resourceId}. IP: ${req.ip}.`
);
logAccessAudit({
orgId: resource.orgId,
resourceId: resource.resourceId,
action: false,
type: "accessToken",
userAgent: req.headers["user-agent"],
requestIp: req.ip
});
}
logAccessAudit({
orgId: resource.orgId,
resourceId: resource.resourceId,
action: false,
type: "accessToken",
userAgent: req.headers["user-agent"],
requestIp: req.ip
});
return next(
createHttpError(
HttpCode.UNAUTHORIZED,
error || "Invalid access token"
error || "Access token does not exist for resource"
)
);
}