@reflagged/shell 1.3.1 → 1.3.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/src/lib/api/oidc-callback.ts +65 -0
package/package.json
CHANGED
|
@@ -18,6 +18,20 @@ export async function GET(req: Request): Promise<NextResponse> {
|
|
|
18
18
|
if (!env) return NextResponse.json({ error: 'oidc-not-configured' }, { status: 500 })
|
|
19
19
|
|
|
20
20
|
const url = new URL(req.url)
|
|
21
|
+
|
|
22
|
+
// The provider may come back without a code: `error=access_denied` when the
|
|
23
|
+
// account is not a member of this service instance, `error=server_error`
|
|
24
|
+
// when it is unwell. validateAuthResponse() throws on these, and an
|
|
25
|
+
// unhandled throw is a 500 that swallows the one sentence the person
|
|
26
|
+
// needs. Answer it before anything else — no state cookie is required to
|
|
27
|
+
// say "no".
|
|
28
|
+
const providerError = url.searchParams.get('error')
|
|
29
|
+
if (providerError) {
|
|
30
|
+
const res = deniedResponse(providerError, url.searchParams.get('error_description'))
|
|
31
|
+
res.cookies.delete(OIDC_STATE_COOKIE)
|
|
32
|
+
return res
|
|
33
|
+
}
|
|
34
|
+
|
|
21
35
|
const stateCookie = req.headers
|
|
22
36
|
.get('cookie')
|
|
23
37
|
?.split(';')
|
|
@@ -97,3 +111,54 @@ export async function GET(req: Request): Promise<NextResponse> {
|
|
|
97
111
|
res.cookies.delete(OIDC_STATE_COOKIE)
|
|
98
112
|
return res
|
|
99
113
|
}
|
|
114
|
+
|
|
115
|
+
const escapeHtml = (v: string): string =>
|
|
116
|
+
v.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`)
|
|
117
|
+
|
|
118
|
+
/**
|
|
119
|
+
* A readable page for a sign-in the provider refused. 403 for access_denied
|
|
120
|
+
* (the account exists, the instance is not theirs), 400 for anything else.
|
|
121
|
+
* The description is the provider's own sentence and arrives via the URL,
|
|
122
|
+
* so it is escaped — anyone can craft a callback link.
|
|
123
|
+
*/
|
|
124
|
+
export function deniedResponse(error: string, description: string | null): NextResponse {
|
|
125
|
+
const status = error === 'access_denied' ? 403 : 400
|
|
126
|
+
const headline =
|
|
127
|
+
error === 'access_denied' ? 'Kein Zugriff auf diese Anwendung' : 'Anmeldung fehlgeschlagen'
|
|
128
|
+
const detail =
|
|
129
|
+
description?.trim() ||
|
|
130
|
+
(error === 'access_denied'
|
|
131
|
+
? 'Ihr Account ist dieser Anwendung nicht zugeordnet.'
|
|
132
|
+
: `Der Anmeldedienst hat die Anmeldung abgelehnt (${error}).`)
|
|
133
|
+
const html = `<!doctype html>
|
|
134
|
+
<html lang="de">
|
|
135
|
+
<head>
|
|
136
|
+
<meta charset="utf-8">
|
|
137
|
+
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
138
|
+
<title>${escapeHtml(headline)}</title>
|
|
139
|
+
<style>
|
|
140
|
+
body { margin: 0; min-height: 100vh; display: grid; place-items: center;
|
|
141
|
+
font-family: system-ui, -apple-system, sans-serif; background: #f6f5f2; color: #1a1a1a; }
|
|
142
|
+
main { max-width: 32rem; padding: 2rem; }
|
|
143
|
+
h1 { font-size: 1.25rem; margin: 0 0 .75rem; }
|
|
144
|
+
p { margin: 0 0 1rem; line-height: 1.5; }
|
|
145
|
+
small { color: #666; }
|
|
146
|
+
a { color: #8a7648; }
|
|
147
|
+
</style>
|
|
148
|
+
</head>
|
|
149
|
+
<body>
|
|
150
|
+
<main>
|
|
151
|
+
<h1>${escapeHtml(headline)}</h1>
|
|
152
|
+
<p>${escapeHtml(detail)}</p>
|
|
153
|
+
<p>Bitten Sie eine Administratorin oder einen Administrator Ihrer Organisation, Ihren Account für diese Anwendung freizuschalten.</p>
|
|
154
|
+
<p><a href="/">Zur Startseite</a></p>
|
|
155
|
+
<p><small>Fehlercode: ${escapeHtml(error)}</small></p>
|
|
156
|
+
</main>
|
|
157
|
+
</body>
|
|
158
|
+
</html>
|
|
159
|
+
`
|
|
160
|
+
return new NextResponse(html, {
|
|
161
|
+
status,
|
|
162
|
+
headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' },
|
|
163
|
+
})
|
|
164
|
+
}
|