1f349/lavender
4
0
Fork 0
mirror of https://github.com/1f349/lavender.git synced 2024-12-22 07:34:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Check if email address can be used, and display perms in the test client

Browse Source
This commit is contained in:
Melon 2023-10-10 18:06:06 +01:00
parent c839fb1746
commit 340f1f9439
Signed by: melon
GPG Key ID: 6C9D970C50D26A25
2 changed files with 101 additions and 49 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
server/flow.go
View File

@ -14,6 +14,7 @@ import (
"github.com/julienschmidt/httprouter"
"golang.org/x/oauth2"
"net/http"
"net/mail"
"strings"
"time"
)
@ -45,6 +46,9 @@ func (h *HttpServer) flowPopupPost(rw http.ResponseWriter, req *http.Request, _
http.Error(rw, "No login service defined for this username", http.StatusBadRequest)
return
}
// the @ must exist if the service is defined
n := strings.IndexByte(loginName, '@')
loginUn := loginName[:n]
targetOrigin := req.PostFormValue("origin")
if _, found := h.services[targetOrigin]; !found {
@ -62,7 +66,7 @@ func (h *HttpServer) flowPopupPost(rw http.ResponseWriter, req *http.Request, _
// generate oauth2 config and redirect to authorize URL
oa2conf := login.OAuth2Config
oa2conf.RedirectURL = h.conf.BaseUrl + "/callback"
nextUrl := oa2conf.AuthCodeURL(state, oauth2.SetAuthURLParam("login_name", loginName))
nextUrl := oa2conf.AuthCodeURL(state, oauth2.SetAuthURLParam("login_name", loginUn))
http.Redirect(rw, req, nextUrl, http.StatusFound)
}
@ -125,6 +129,26 @@ func (h *HttpServer) flowCallback(rw http.ResponseWriter, req *http.Request, _ h
}
ps := claims.NewPermStorage()
if verified, ok := v3["email_verified"].(bool); ok && verified {
if mailAddress, ok := v3["email"].(string); ok {
address, err := mail.ParseAddress(mailAddress)
if err != nil {
http.Error(rw, "Invalid email in userinfo", http.StatusInternalServerError)
return
}
n := strings.IndexByte(address.Address, '@')
if n == -1 {
goto noEmailSupport
}
if address.Address[n+1:] != v.sso.Config.Namespace {
goto noEmailSupport
}
ps.Set("mail-client")
}
}
noEmailSupport:
nsSub := sub + "@" + v.sso.Config.Namespace
ati := uuidNewStringAti()
accessToken, err := h.signer.GenerateJwt(nsSub, ati, jwt.ClaimStrings{aud}, 15*time.Minute, auth.AccessTokenClaims{

66
test-client/index.html
View File

@ -3,30 +3,52 @@
<head>
<title>Test Client</title>
<script>
var currentLoginPopup = null;
let currentLoginPopup = null;
window.addEventListener("message", function (event) {
window.addEventListener("message", function (event) {
if (event.origin !== "http:\/\/localhost:9090") return;
if (isObject(event.data)) {
document.getElementById("someTextArea").textContent = JSON.stringify(event.data, null, 2);
if(currentLoginPopup) currentLoginPopup.close();
let perms = document.getElementById("somePerms");
perms.childNodes.forEach(function (x) {
x.clear();
});
let jwt = parseJwt(event.data.tokens.access);
if (jwt.per != null) {
jwt.per.forEach(function (x) {
let a = document.createElement("li");
a.textContent = x;
perms.appendChild(a);
});
}
if (currentLoginPopup) currentLoginPopup.close();
return;
}
alert("Failed to log user in: the login data was probably corrupted");
});
});
function isObject(obj) {
function parseJwt(token) {
const base64Url = token.split('.')[1];
const base64 = base64Url.replace(/-/g, '+').replace(/_/g, '/');
const jsonPayload = decodeURIComponent(window.atob(base64).split('').map(function (c) {
return '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2);
}).join(''));
return JSON.parse(jsonPayload);
}
function isObject(obj) {
return obj != null && obj.constructor.name === "Object"
}
}
function popupCenterScreen(url, title, w, h, focus) {
function popupCenterScreen(url, title, w, h, focus) {
const top = (screen.availHeight - h) / 4, left = (screen.availWidth - w) / 2;
const popup = openWindow(url, title, `scrollbars=yes,width=${w},height=${h},top=${top},left=${left}`);
if (focus === true && window.focus) popup.focus();
return popup;
}
}
function openWindow(url, winnm, options) {
function openWindow(url, winnm, options) {
var wTop = firstAvailableValue([window.screen.availTop, window.screenY, window.screenTop, 0]);
var wLeft = firstAvailableValue([window.screen.availLeft, window.screenX, window.screenLeft, 0]);
var top = 0, left = 0;
@ -39,24 +61,24 @@ function openWindow(url, winnm, options) {
w = window.open(url, winnm, options);
} else w = window.open(url, winnm);
return w;
}
}
function firstAvailableValue(arr) {
function firstAvailableValue(arr) {
for (var i = 0; i < arr.length; i++)
if (typeof arr[i] != 'undefined')
return arr[i];
}
}
function doThisThing() {
if(currentLoginPopup) currentLoginPopup.close();
currentLoginPopup = popupCenterScreen('http://localhost:9090/popup?origin='+encodeURIComponent("http://localhost:2020"), 'Login with Lavender', 500, 500, false);
}
function doThisThing() {
if (currentLoginPopup) currentLoginPopup.close();
currentLoginPopup = popupCenterScreen('http://localhost:9090/popup?origin=' + encodeURIComponent("http://localhost:2020"), 'Login with Lavender', 500, 500, false);
}
</script>
<style>
#someTextArea {
#someTextArea {
width: 400px;
height: 400px;
}
}
</style>
</head>
<body>
@ -67,8 +89,14 @@ function doThisThing() {
<div>
<button onclick="doThisThing();">Login</button>
</div>
<div style="display:flex; gap: 2em;">
<div>
<textarea id="someTextArea"></textarea>
<label for="someTextArea"></label><textarea id="someTextArea"></textarea>
</div>
<div>
<p>Permissions:</p>
<ul id="somePerms"></ul>
</div>
</div>
</main>
</body>