calvin.erfmann/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-08-18 18:23:18 +02:00
Code Issues Packages Projects Releases Wiki Activity

Bind share link sessions to the token's own resource

Browse Source
This commit is contained in:
miloschwartz
2026-08-17 14:24:21 -04:00
parent c05d2aeafb
commit 0a8b5e46ca
5 changed files with 63 additions and 128 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/routers/badger/verifySession.ts
+29 -22
View File
@@ -821,10 +821,6 @@ export async function verifyResourceSession(
}
if (resourceSession.accessTokenId) {
logger.debug(
"Resource allowed because access token session is valid"
);
const [tokenItem] = await db
.select()
.from(resourceAccessToken)
@@ -836,26 +832,37 @@ export async function verifyResourceSession(
)
.limit(1);
const userData = tokenItem
? await getAccessTokenUserData(
tokenItem,
resource.orgId
)
: undefined;
if (
tokenItem &&
tokenItem.resourceId === resource.resourceId
) {
logger.debug(
"Resource allowed because access token session is valid"
);
logAccessTokenRequestAudit(
{
resourceId: resource.resourceId,
orgId: resource.orgId,
location: ipCC,
accessTokenId: resourceSession.accessTokenId,
tokenTitle: tokenItem?.title ?? null,
userData
},
parsedBody.data
const userData = await getAccessTokenUserData(
tokenItem,
resource.orgId
);
logAccessTokenRequestAudit(
{
resourceId: resource.resourceId,
orgId: resource.orgId,
location: ipCC,
accessTokenId: resourceSession.accessTokenId,
tokenTitle: tokenItem.title ?? null,
userData
},
parsedBody.data
);
return allowed(res, userData, dontStripSession);
}
logger.debug(
"Access token session does not belong to this resource"
);
return allowed(res, userData, dontStripSession);
}
if (resourceSession.userSessionId && sso) {