@ofidj/generator-fidj 3.9.2 → 3.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -651,6 +651,29 @@ function render() {
|
|
|
651
651
|
} catch (error) {
|
|
652
652
|
throw new Error(signInErrorMessage(error));
|
|
653
653
|
}
|
|
654
|
+
// Fidj collects the credential on its own page rather than sending itself
|
|
655
|
+
// through its own door, and that sign-in created no session the provider
|
|
656
|
+
// could see: the first app opened afterwards asked for the password again,
|
|
657
|
+
// by the account provider itself. This turns the sign-in the API has just
|
|
658
|
+
// verified into the session every other app is recognised by. Only Fidj
|
|
659
|
+
// asks — the API refuses any other app, because a session that speaks for
|
|
660
|
+
// every app must not be mintable by one that collects its own passwords.
|
|
661
|
+
if (isFidjItself) {
|
|
662
|
+
try {
|
|
663
|
+
await sdk.sendOnEndpoint({
|
|
664
|
+
verb: "POST",
|
|
665
|
+
key: "me",
|
|
666
|
+
relativePath: "oidc/session",
|
|
667
|
+
// The whole point of the call is the cookie it comes back with, and
|
|
668
|
+
// a cross-origin response's Set-Cookie is dropped without this.
|
|
669
|
+
withCredentials: true,
|
|
670
|
+
});
|
|
671
|
+
} catch {
|
|
672
|
+
// Being signed in here still worked. The person is inside Fidj; what
|
|
673
|
+
// they lose is being recognised by the next app without typing again,
|
|
674
|
+
// and that is not worth refusing them the console over.
|
|
675
|
+
}
|
|
676
|
+
}
|
|
654
677
|
await refresh();
|
|
655
678
|
anonymous = false;
|
|
656
679
|
// A new account belongs where a returning one lands: inside the app.
|