mirror/fosrl.pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2025-07-17 17:23:27 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

check resource id on verify access token

Browse source
This commit is contained in:
miloschwartz 2025-04-06 13:08:55 -04:00
parent 5a6a035d30
commit 0e65f8c921
No known key found for this signature in database
4 changed files with 16 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

11
server/auth/verifyResourceAccessToken.ts
View file

@ -13,10 +13,12 @@ import { sha256 } from "@oslojs/crypto/sha2";
export async function verifyResourceAccessToken({
accessToken,
accessTokenId
accessTokenId,
resourceId
}: {
accessToken: string;
accessTokenId?: string;
resourceId?: number; // IF THIS IS NOT SET, THE TOKEN IS VALID FOR ALL RESOURCES
}): Promise<{
valid: boolean;
error?: string;
@ -100,6 +102,13 @@ export async function verifyResourceAccessToken({
};
}
if (resourceId && resource.resourceId !== resourceId) {
return {
valid: false,
error: "Resource ID does not match"
};
}
return {
valid: true,
tokenItem,

6
server/routers/badger/verifySession.ts
View file

@ -209,7 +209,8 @@ export async function verifyResourceSession(
const { valid, error, tokenItem } = await verifyResourceAccessToken(
{
accessToken,
accessTokenId
accessTokenId,
resourceId: resource.resourceId
}
);
@ -244,7 +245,8 @@ export async function verifyResourceSession(
const { valid, error, tokenItem } = await verifyResourceAccessToken(
{
accessToken,
accessTokenId
accessTokenId,
resourceId: resource.resourceId
}
);

6
src/app/auth/resource/[resourceId]/AccessToken.tsx
View file

@ -17,13 +17,11 @@ import { useEffect, useState } from "react";
type AccessTokenProps = {
token: string;
resourceId?: number;
redirectUrl?: string;
};
export default function AccessToken({
token,
resourceId,
redirectUrl
resourceId
}: AccessTokenProps) {
const [loading, setLoading] = useState(true);
const [isValid, setIsValid] = useState(false);
@ -96,7 +94,7 @@ export default function AccessToken({
if (res.data.data.session) {
setIsValid(true);
window.location.href = appendRequestToken(
redirectUrl!,
res.data.data.redirectUrl!,
res.data.data.session
);
}

1
src/app/auth/resource/[resourceId]/page.tsx
View file

@ -123,7 +123,6 @@ export default async function ResourceAuthPage(props: {
<AccessToken
token={searchParams.token}
resourceId={params.resourceId}
redirectUrl={redirectUrl}
/>
</div>
);