@ibgib/space-gib 0.0.7 → 0.0.9

package/src/server/serve-gib/handlers/api/keystone/sso-link.handler.mts

@@ -3,6 +3,8 @@ import { getIbGibAddr } from '@ibgib/ts-gib/dist/helper.mjs';
 import { loadSsoServerConfig } from '@ibgib/web-gib/dist/identity/sso/sso-config-helper.mjs';
 import { SsoCustodianService } from '@ibgib/web-gib/dist/identity/sso/sso-custodian-service.mjs';
 import { SsoProviderId } from '@ibgib/web-gib/dist/identity/sso/sso-types.mjs';
+import { isSsoProviderLinked } from '@ibgib/web-gib/dist/identity/sso/sso-helpers.mjs';
+import { KeystoneService_V1 } from '@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs';
 
 import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
 import { ServeGibHandlerWithMetaspaceBase } from '../../handler-base.mjs';
@@ -91,15 +93,34 @@ export class SsoLinkHandler extends ServeGibHandlerWithMetaspaceBase<LinkParams,
                 return this.error(500, 'No local user space found in domain metaspace');
             }
 
+            // 0. Fetch target keystone and verify if already linked
+            const keystoneService = new KeystoneService_V1();
+            const targetKeystone = await keystoneService.getLatestKeystone({
+                addr: parentTjpAddr,
+                metaspace: reqCtx.metaspace,
+                space
+            });
+            if (!targetKeystone) {
+                return this.error(400, `Keystone not found for address: ${parentTjpAddr}`);
+            }
+
+            if (isSsoProviderLinked({ keystone: targetKeystone, providerId })) {
+                return this.error(400, `SSO provider "${providerId}" is already linked to this keystone.`);
+            }
+
             // 1. Authenticate with provider and retrieve user info
             const service = getCustodian();
             const userInfo = await service.getOAuthUserInfo(providerId, code, redirectUri);
 
             // 2. Generate the custodian foreign challenge pool
-            const custodianPool = await service.createCustodianChallengePool(
-                userInfo.providerKey,
-                userNonce
-            );
+            const custodianPool = await service.createCustodianChallengePool({
+                providerId,
+                providerKey: userInfo.providerKey,
+                userNonce,
+                keystoneAddr: parentTjpAddr,
+                metaspace: reqCtx.metaspace,
+                space
+            });
 
             console.log(`${lc} created custodian pool for: ${userInfo.providerKey}`);
 

package/src/server/serve-gib/handlers/api/keystone/sso-login.handler.mts

@@ -123,10 +123,11 @@ export class SsoLoginHandler extends ServeGibHandlerWithMetaspaceBase<LoginParam
                 return this.error(404, `Parent identity keystone not found in space for address: ${latestParentAddr}`);
             }
 
-            // 4. Resolve the POOL_ID_CUSTODIAN_MANAGE pool from the parent keystone
-            const custodianPool = parentKeystone.data?.challengePools?.find((p: any) => p.id === POOL_ID_CUSTODIAN_MANAGE);
+            // 4. Resolve the custodian pool from the parent keystone using dynamic poolId
+            const targetPoolId = `custodian-manage-${providerId}`;
+            const custodianPool = parentKeystone.data?.challengePools?.find((p: any) => p.id === targetPoolId);
             if (!custodianPool) {
-                return this.error(401, `Unauthorized: Custodian pool '${POOL_ID_CUSTODIAN_MANAGE}' is not registered in the parent identity keystone.`);
+                return this.error(401, `Unauthorized: Custodian pool '${targetPoolId}' is not registered in the parent identity keystone.`);
             }
 
             // 5. Assert allowed verbs contain KEYSTONE_VERB_MANAGE