rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rename redirect-path to continue + handle redirection on forbidden from wrong org assume

Browse Source 
Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-02-11 21:19:15 +04:00
parent 942b6f5144
commit e46c1d4894
15 changed files with 74 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
pkg/server/api/connect/v1/saml_handler.go
View File

@@ -4,6 +4,7 @@ import (
"errors"
"fmt"
"net/http"
"net/url"
"github.com/go-chi/chi/v5"
"go.gearno.de/kit/httpserver"
@@ -11,6 +12,7 @@ import (
"go.probo.inc/probo/pkg/baseurl"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/iam"
"go.probo.inc/probo/pkg/saferedirect"
"go.probo.inc/probo/pkg/securecookie"
"go.probo.inc/probo/pkg/server/api/authn"
)
@@ -20,6 +22,7 @@ type SAMLHandler struct {
sessionCookie *authn.Cookie
baseURL *baseurl.BaseURL
logger *log.Logger
safeRedirect *saferedirect.SafeRedirect
}
func NewSAMLHandler(iam *iam.Service, cookieConfig securecookie.Config, baseURL *baseurl.BaseURL, logger *log.Logger) *SAMLHandler {
@@ -28,10 +31,11 @@ func NewSAMLHandler(iam *iam.Service, cookieConfig securecookie.Config, baseURL
sessionCookie: authn.NewCookie(&cookieConfig),
baseURL: baseURL,
logger: logger,
safeRedirect: &saferedirect.SafeRedirect{AllowedHost: baseURL.Host()},
}
}
func (h *SAMLHandler) renderInternalServerError(w http.ResponseWriter, r *http.Request) {
func (h *SAMLHandler) renderInternalServerError(w http.ResponseWriter) {
httpserver.RenderError(w, http.StatusInternalServerError, errors.New("internal server error"))
}
@@ -63,7 +67,7 @@ func (h *SAMLHandler) ConsumeHandler(w http.ResponseWriter, r *http.Request) {
return
}
configIDStr := relayState[:gid.EncodedGIDSize+1]
configIDStr := relayState[:gid.EncodedGIDSize]
if configIDStr == "" {
httpserver.RenderError(w, http.StatusBadRequest, errors.New("missing config ID"))
return
@@ -75,16 +79,21 @@ func (h *SAMLHandler) ConsumeHandler(w http.ResponseWriter, r *http.Request) {
return
}
redirectPath := relayState[gid.EncodedGIDSize+1:]
user, membership, err := h.iam.SAMLService.HandleAssertion(ctx, samlResponse, configID)
if err != nil {
httpserver.RenderError(w, http.StatusUnauthorized, err)
return
}
if redirectPath == "" {
redirectPath = "/organizations/" + membership.OrganizationID.String()
continueURL := "/organizations/" + membership.OrganizationID.String()
if len(relayState) > gid.EncodedGIDSize {
unescapedContinueURL, err := url.QueryUnescape(relayState[gid.EncodedGIDSize:])
if err != nil {
h.logger.WarnCtx(ctx, "cannot unescape continue URL from RelayState", log.Error(err))
} else {
continueURL = unescapedContinueURL
}
}
rootSession := authn.SessionFromContext(ctx)
@@ -94,21 +103,21 @@ func (h *SAMLHandler) ConsumeHandler(w http.ResponseWriter, r *http.Request) {
rootSession, err = h.iam.AuthService.OpenSessionWithSAML(ctx, user.ID)
if err != nil {
h.logger.ErrorCtx(ctx, "cannot open root session", log.Error(err))
h.renderInternalServerError(w, r)
h.renderInternalServerError(w)
return
}
case rootSession.IdentityID != user.ID:
err = h.iam.SessionService.CloseSession(ctx, rootSession.ID)
if err != nil {
h.logger.ErrorCtx(ctx, "cannot close session", log.Error(err))
h.renderInternalServerError(w, r)
h.renderInternalServerError(w)
return
}
rootSession, err = h.iam.AuthService.OpenSessionWithSAML(ctx, user.ID)
if err != nil {
h.logger.ErrorCtx(ctx, "cannot open root session", log.Error(err))
h.renderInternalServerError(w, r)
h.renderInternalServerError(w)
return
}
}
@@ -116,14 +125,13 @@ func (h *SAMLHandler) ConsumeHandler(w http.ResponseWriter, r *http.Request) {
_, _, err = h.iam.SessionService.OpenSAMLChildSessionForOrganization(ctx, rootSession.ID, membership.OrganizationID)
if err != nil {
h.logger.ErrorCtx(ctx, "cannot open SAML child session", log.Error(err))
h.renderInternalServerError(w, r)
h.renderInternalServerError(w)
return
}
h.sessionCookie.Set(w, rootSession)
redirectURL := h.baseURL.WithPath(redirectPath).MustString()
http.Redirect(w, r, redirectURL, http.StatusFound)
h.safeRedirect.Redirect(w, r, continueURL, "/organizations/"+membership.OrganizationID.String(), http.StatusFound)
}
func (h *SAMLHandler) LoginHandler(w http.ResponseWriter, r *http.Request) {
@@ -135,7 +143,7 @@ func (h *SAMLHandler) LoginHandler(w http.ResponseWriter, r *http.Request) {
return
}
redirectPathQueryParam := r.URL.Query().Get("redirect-path")
continueURLQueryParam := r.URL.Query().Get("continue")
samlConfigID, err := gid.ParseGID(samlConfigIDParam)
if err != nil {
@@ -143,7 +151,7 @@ func (h *SAMLHandler) LoginHandler(w http.ResponseWriter, r *http.Request) {
return
}
url, err := h.iam.SAMLService.InitiateLogin(ctx, samlConfigID, redirectPathQueryParam)
url, err := h.iam.SAMLService.InitiateLogin(ctx, samlConfigID, continueURLQueryParam)
if err != nil {
panic(fmt.Errorf("cannot initiate SAML login: %w", err))
}

2
pkg/server/api/connect/v1/schema.graphql
View File

@@ -669,7 +669,7 @@ input ChangeEmailInput {
input AssumeOrganizationSessionInput {
organizationId: ID!
redirectPath: String!
continue: String!
}
input RevokeSessionInput {

14
pkg/server/api/connect/v1/schema/schema.go
View File

@@ -246,7 +246,7 @@ type ComplexityRoot struct {
UpdateMembership func(childComplexity int, input types.UpdateMembershipInput) int
UpdateOrganization func(childComplexity int, input types.UpdateOrganizationInput) int
UpdateSAMLConfiguration func(childComplexity int, input types.UpdateSAMLConfigurationInput) int
UpdateSCIMBridge func(childComplexity int, input types.UpdateSCIMBridgeInput) int
UpdateSCIMBridge func(childComplexity int, input types.UpdateSCIMBridgeInput) int
VerifyEmail func(childComplexity int, input types.VerifyEmailInput) int
}
@@ -380,7 +380,7 @@ type ComplexityRoot struct {
SCIMBridge struct {
Connector func(childComplexity int) int
CreatedAt func(childComplexity int) int
ExcludedUserNames func(childComplexity int) int
ExcludedUserNames func(childComplexity int) int
ID func(childComplexity int) int
Permission func(childComplexity int, action string) int
ScimConfiguration func(childComplexity int) int
@@ -3111,7 +3111,7 @@ input ChangeEmailInput {
input AssumeOrganizationSessionInput {
organizationId: ID!
redirectPath: String!
continue: String!
}
input RevokeSessionInput {
@@ -14931,7 +14931,7 @@ func (ec *executionContext) unmarshalInputAssumeOrganizationSessionInput(ctx con
asMap[k] = v
}
fieldsInOrder := [...]string{"organizationId", "redirectPath"}
fieldsInOrder := [...]string{"organizationId", "continue"}
for _, k := range fieldsInOrder {
v, ok := asMap[k]
if !ok {
@@ -14945,13 +14945,13 @@ func (ec *executionContext) unmarshalInputAssumeOrganizationSessionInput(ctx con
return it, err
}
it.OrganizationID = data
case "redirectPath":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("redirectPath"))
case "continue":
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("continue"))
data, err := ec.unmarshalNString2string(ctx, v)
if err != nil {
return it, err
}
it.RedirectPath = data
it.Continue = data
}
}

10
pkg/server/api/connect/v1/types/types.go
View File

@@ -36,7 +36,7 @@ type AcceptInvitationPayload struct {
type AssumeOrganizationSessionInput struct {
OrganizationID gid.GID `json:"organizationId"`
RedirectPath string `json:"redirectPath"`
Continue string `json:"continue"`
}
type AssumeOrganizationSessionPayload struct {
@@ -416,7 +416,7 @@ type SCIMBridge struct {
ScimConfiguration *SCIMConfiguration `json:"scimConfiguration,omitempty"`
Connector *Connector `json:"connector,omitempty"`
Type coredata.SCIMBridgeType `json:"type"`
ExcludedUserNames []string `json:"excludedUserNames"`
ExcludedUserNames []string `json:"excludedUserNames"`
CreatedAt time.Time `json:"createdAt"`
UpdatedAt time.Time `json:"updatedAt"`
Permission bool `json:"permission"`
@@ -561,9 +561,9 @@ type UpdateSAMLConfigurationPayload struct {
}
type UpdateSCIMBridgeInput struct {
OrganizationID gid.GID `json:"organizationId"`
ScimBridgeID gid.GID `json:"scimBridgeId"`
ExcludedUserNames []string `json:"excludedUserNames"`
OrganizationID gid.GID `json:"organizationId"`
ScimBridgeID gid.GID `json:"scimBridgeId"`
ExcludedUserNames []string `json:"excludedUserNames"`
}
type UpdateSCIMBridgePayload struct {

10
pkg/server/api/connect/v1/v1_resolver.go
View File

@@ -406,6 +406,9 @@ func (r *mutationResolver) SignIn(ctx context.Context, input types.SignInInput)
}
}
w := gqlutils.HTTPResponseWriterFromContext(ctx)
r.sessionCookie.Set(w, session)
if input.OrganizationID != nil {
var err error
_, _, err = r.iam.SessionService.OpenPasswordChildSessionForOrganization(ctx, session.ID, *input.OrganizationID)
@@ -415,7 +418,7 @@ func (r *mutationResolver) SignIn(ctx context.Context, input types.SignInInput)
var errMembershipInactive *iam.ErrMembershipInactive
if errors.As(err, &errMembershipNotFound) || errors.As(err, &errMembershipInactive) {
return nil, gqlutils.Forbidden(ctx, err)
return nil, gqlutils.Forbiddenf(ctx, "forbidden")
}
r.logger.ErrorCtx(ctx, "cannot assume organization", log.Error(err))
@@ -423,9 +426,6 @@ func (r *mutationResolver) SignIn(ctx context.Context, input types.SignInInput)
}
}
w := gqlutils.HTTPResponseWriterFromContext(ctx)
r.sessionCookie.Set(w, session)
return &types.SignInPayload{
Identity: types.NewIdentity(identity),
Session: types.NewSession(session),
@@ -680,7 +680,7 @@ func (r *mutationResolver) ChangeEmail(ctx context.Context, input types.ChangeEm
func (r *mutationResolver) AssumeOrganizationSession(ctx context.Context, input types.AssumeOrganizationSessionInput) (*types.AssumeOrganizationSessionPayload, error) {
rootSession := authn.SessionFromContext(ctx)
childSession, membership, err := r.iam.SessionService.AssumeOrganizationSession(ctx, rootSession.ID, input.OrganizationID, input.RedirectPath)
childSession, membership, err := r.iam.SessionService.AssumeOrganizationSession(ctx, rootSession.ID, input.OrganizationID, input.Continue)
if err != nil {
var (
errMembershipNotFound *iam.ErrMembershipNotFound