c7c81fb65c
Bundles the console work from the current branch: the header account control, database-backed roles and permissions, and signing out across the applications that share this sign-in. The account control replaces a separate identity chip and a separate sign-out button, which meant the header carried two controls describing one fact. web/account.js is mounted into every page by a placeholder and owns the keyboard handling, the outside-click behaviour and the sign-out form once. It also fills the trigger's name, which the previous markup left empty. Signing out revokes the hosted-login bearer sessions this installation issued, then redirects to the provider's end_session_endpoint when the discovery document advertises one. Applications that authenticate against this installation therefore lose their session too; one pointed straight at an identity provider is out of its reach and is unchanged. Roles and permissions become rows rather than a closed enum, so a tenant can extend the catalog without a migration, and a role can no longer be granted a capability that is not in it. requireSameOrigin now compares against the origin the request arrived on instead of the configured base URL, which defaulted to http://localhost:8080 and so rejected every write in a deployment that never set it. Two bugs found while verifying in a browser: - A profile picture never rendered. avatarURL built an absolute URL from the configured base URL, and the page's own img-src 'self' blocked it. The console's own pages now take a root-relative path; only /connect/userinfo, read from another origin, needs an absolute one, and it follows the request. - absoluteURL preferred the configuration over the request while its comment claimed the opposite, which also misdirected the logout redirect. Card layout: the footer was one two-column row shared between a label and a forty-character identifier, so the identifier took the width and crushed its label into three stacked words. Each pair is a line now, the value truncates with the full text in the title, and cards align their footers across a row.
91 lines
2.8 KiB
Go
91 lines
2.8 KiB
Go
package server
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"github.com/coreos/go-oidc/v3/oidc"
|
|
"github.com/danyel/go-loose/internal/password"
|
|
"golang.org/x/oauth2"
|
|
)
|
|
|
|
func (s *Server) configureOIDC(ctx context.Context, issuer, clientID, clientSecret, redirectURL string) error {
|
|
provider, err := oidc.NewProvider(ctx, issuer)
|
|
if err != nil {
|
|
return fmt.Errorf("discover OIDC provider: %w", err)
|
|
}
|
|
config := &oauth2.Config{
|
|
ClientID: clientID, ClientSecret: clientSecret,
|
|
Endpoint: provider.Endpoint(), RedirectURL: redirectURL,
|
|
Scopes: []string{oidc.ScopeOpenID, "profile", "email"},
|
|
}
|
|
s.authMu.Lock()
|
|
s.oauth = config
|
|
s.verifier = provider.Verifier(&oidc.Config{ClientID: clientID})
|
|
// The logout endpoint is not part of the OAuth endpoint set, so it is read out
|
|
// of the discovery document separately. A provider that does not advertise one
|
|
// leaves this empty, which is what makes signing out fall back to clearing the
|
|
// local session alone.
|
|
s.endSession = providerLogoutEndpoint(provider)
|
|
s.authMu.Unlock()
|
|
return nil
|
|
}
|
|
|
|
// providerLogoutEndpoint reads end_session_endpoint out of an OIDC discovery
|
|
// document, returning an empty string when the provider does not advertise one.
|
|
func providerLogoutEndpoint(provider *oidc.Provider) string {
|
|
var claims struct {
|
|
EndSessionEndpoint string `json:"end_session_endpoint"`
|
|
}
|
|
if err := provider.Claims(&claims); err != nil {
|
|
return ""
|
|
}
|
|
return claims.EndSessionEndpoint
|
|
}
|
|
|
|
// logoutConfiguration returns what is needed to end a session at the identity
|
|
// provider: the discovered endpoint and the client it would be requested for.
|
|
func (s *Server) logoutConfiguration() (endpoint, clientID string) {
|
|
s.authMu.RLock()
|
|
defer s.authMu.RUnlock()
|
|
if s.oauth != nil {
|
|
clientID = s.oauth.ClientID
|
|
}
|
|
return s.endSession, clientID
|
|
}
|
|
|
|
func (s *Server) oidcConfiguration() (*oauth2.Config, *oidc.IDTokenVerifier) {
|
|
s.authMu.RLock()
|
|
defer s.authMu.RUnlock()
|
|
return s.oauth, s.verifier
|
|
}
|
|
|
|
func (s *Server) hasOIDC() bool {
|
|
config, verifier := s.oidcConfiguration()
|
|
return config != nil && verifier != nil
|
|
}
|
|
|
|
func (s *Server) ensureLocalAdministrator(ctx context.Context) error {
|
|
if !s.cfg.LocalLogin {
|
|
return nil
|
|
}
|
|
dummyHash, err := password.Hash("not-a-real-account-password")
|
|
if err != nil {
|
|
return fmt.Errorf("hash password timing value: %w", err)
|
|
}
|
|
s.loginGuard.dummyHash = dummyHash
|
|
if s.cfg.LocalAdminPassword == "" {
|
|
return nil
|
|
}
|
|
passwordHash, err := password.Hash(s.cfg.LocalAdminPassword)
|
|
if err != nil {
|
|
return fmt.Errorf("hash local administrator password: %w", err)
|
|
}
|
|
if err := s.store.EnsurePasswordUser(
|
|
ctx, s.cfg.LocalAdminEmail, "Local Administrator", passwordHash,
|
|
s.cfg.BootstrapTenant, s.cfg.BootstrapApp,
|
|
); err != nil {
|
|
return fmt.Errorf("bootstrap local administrator: %w", err)
|
|
}
|
|
return nil
|
|
}
|