roleypoly/v3
1
0
Fork 0
mirror of https://github.com/roleypoly/roleypoly.git synced 2025-06-17 01:59:08 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

chore: temporarily loosen CORS, add OAuth state info for backend bouncing

Browse source
This commit is contained in:
41666 2021-03-13 15:49:36 -05:00
parent ed82a67594
commit 6edfe7455f
8 changed files with 72 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

23
packages/api/handlers/login-callback.ts
View file

@ -1,9 +1,17 @@
import { AuthTokenResponse, DiscordUser, GuildSlug, SessionData } from '@roleypoly/types';
import {
AuthTokenResponse,
DiscordUser,
GuildSlug,
SessionData,
StateSession,
} from '@roleypoly/types';
import KSUID from 'ksuid';
import {
AuthType,
discordFetch,
formData,
getStateSession,
isAllowedCallbackHost,
parsePermissions,
resolveFailures,
userAgent,
@ -21,8 +29,9 @@ const AuthErrorResponse = (extra?: string) =>
export const LoginCallback = resolveFailures(
AuthErrorResponse,
async (request: Request): Promise<Response> => {
const query = new URL(request.url).searchParams;
let bounceBaseUrl = uiPublicURI;
const query = new URL(request.url).searchParams;
const stateValue = query.get('state');
if (stateValue === null) {
@ -37,6 +46,14 @@ export const LoginCallback = resolveFailures(
if (currentTime > stateExpiry) {
return AuthErrorResponse('state expired');
}
const stateSession = await getStateSession<StateSession>(state.string);
if (
stateSession?.callbackHost &&
isAllowedCallbackHost(stateSession.callbackHost)
) {
bounceBaseUrl = stateSession.callbackHost;
}
} catch (e) {
return AuthErrorResponse('state invalid');
}
@ -90,7 +107,7 @@ export const LoginCallback = resolveFailures(
await Sessions.put(sessionID.string, sessionData, 60 * 60 * 6);
return Bounce(
uiPublicURI + '/machinery/new-session?session_id=' + sessionID.string
bounceBaseUrl + '/machinery/new-session?session_id=' + sessionID.string
);
}
);