calvin.erfmann/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-08-18 18:23:18 +02:00
Code Issues Packages Projects Releases Wiki Activity

Bind share link sessions to the token's own resource

Browse Source
This commit is contained in:
miloschwartz
2026-08-17 14:24:21 -04:00
parent c05d2aeafb
commit 0a8b5e46ca
5 changed files with 63 additions and 128 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/routers/badger/exchangeSession.ts
+8
View File
@@ -164,6 +164,14 @@ export async function exchangeSession(
)
.limit(1);
if (res) {
if (res.resourceId !== resource.resourceId) {
return next(
createHttpError(
HttpCode.UNAUTHORIZED,
"Invalid request token"
)
);
}
await createResourceSession({
token,
resourceId: resource.resourceId,
server/routers/badger/verifySession.ts
+29 -22
View File
@@ -821,10 +821,6 @@ export async function verifyResourceSession(
}
if (resourceSession.accessTokenId) {
logger.debug(
"Resource allowed because access token session is valid"
);
const [tokenItem] = await db
.select()
.from(resourceAccessToken)
@@ -836,26 +832,37 @@ export async function verifyResourceSession(
)
.limit(1);
const userData = tokenItem
? await getAccessTokenUserData(
tokenItem,
resource.orgId
)
: undefined;
if (
tokenItem &&
tokenItem.resourceId === resource.resourceId
) {
logger.debug(
"Resource allowed because access token session is valid"
);
logAccessTokenRequestAudit(
{
resourceId: resource.resourceId,
orgId: resource.orgId,
location: ipCC,
accessTokenId: resourceSession.accessTokenId,
tokenTitle: tokenItem?.title ?? null,
userData
},
parsedBody.data
const userData = await getAccessTokenUserData(
tokenItem,
resource.orgId
);
logAccessTokenRequestAudit(
{
resourceId: resource.resourceId,
orgId: resource.orgId,
location: ipCC,
accessTokenId: resourceSession.accessTokenId,
tokenTitle: tokenItem.title ?? null,
userData
},
parsedBody.data
);
return allowed(res, userData, dontStripSession);
}
logger.debug(
"Access token session does not belong to this resource"
);
return allowed(res, userData, dontStripSession);
}
if (resourceSession.userSessionId && sso) {