@@ -14,6 +14,7 @@ import (
1414 "github.com/gorilla/sessions"
1515 "github.com/markbates/goth"
1616 "github.com/markbates/goth/gothic"
17+ "github.com/openrundev/openrun/internal/system"
1718 "github.com/openrundev/openrun/internal/types"
1819
1920 "github.com/markbates/goth/providers/amazon"
@@ -42,15 +43,16 @@ const (
4243 REDIRECT_URL = "redirect"
4344)
4445
45- type SSOAuth struct {
46+ // OAuthManager manages the OAuth providers and their configurations (also OIDC)
47+ type OAuthManager struct {
4648 * types.Logger
4749 config * types.ServerConfig
4850 cookieStore * sessions.CookieStore
4951 providerConfigs map [string ]* types.AuthConfig
5052}
5153
52- func NewSSOAuth (logger * types.Logger , config * types.ServerConfig ) * SSOAuth {
53- return & SSOAuth {
54+ func NewOAuthManager (logger * types.Logger , config * types.ServerConfig ) * OAuthManager {
55+ return & OAuthManager {
5456 Logger : logger ,
5557 config : config ,
5658 }
@@ -77,7 +79,7 @@ func generateRandomKey(length int) (string, error) {
7779 return string (key ), nil
7880}
7981
80- func (s * SSOAuth ) Setup () error {
82+ func (s * OAuthManager ) Setup () error {
8183 var err error
8284 sessionKey := s .config .Security .SessionSecret
8385 if sessionKey == "" {
@@ -167,14 +169,14 @@ func (s *SSOAuth) Setup() error {
167169 }
168170
169171 if len (providers ) != 0 && s .config .Security .CallbackUrl == "" {
170- return fmt .Errorf ("security.callback_url must be set for enabling SSO auth " )
172+ return fmt .Errorf ("security.callback_url must be set for enabling OAuth " )
171173 }
172174
173175 goth .UseProviders (providers ... ) // Register the providers with goth
174176 return nil
175177}
176178
177- func (s * SSOAuth ) RegisterRoutes (mux * chi.Mux ) {
179+ func (s * OAuthManager ) RegisterRoutes (mux * chi.Mux ) {
178180 mux .Get (types .INTERNAL_URL_PREFIX + "/auth/{provider}/callback" , func (w http.ResponseWriter , r * http.Request ) {
179181 user , err := gothic .CompleteUserAuth (w , r )
180182 if err != nil {
@@ -308,7 +310,7 @@ func (s *SSOAuth) RegisterRoutes(mux *chi.Mux) {
308310 })
309311}
310312
311- func (s * SSOAuth ) validateResponse (providerName string , user goth.User ) error {
313+ func (s * OAuthManager ) validateResponse (providerName string , user goth.User ) error {
312314 providerConfig := s .providerConfigs [providerName ]
313315 if providerConfig == nil {
314316 return fmt .Errorf ("provider %s not configured" , providerName )
@@ -326,11 +328,11 @@ func (s *SSOAuth) validateResponse(providerName string, user goth.User) error {
326328 return nil
327329}
328330
329- func (s * SSOAuth ) ValidateProviderName (provider string ) bool {
331+ func (s * OAuthManager ) ValidateProviderName (provider string ) bool {
330332 return s .providerConfigs [provider ] != nil
331333}
332334
333- func (s * SSOAuth ) ValidateAuthType (authType string ) bool {
335+ func (s * OAuthManager ) ValidateAuthType (authType string ) bool {
334336 authType = strings .TrimPrefix (authType , RBAC_AUTH_PREFIX )
335337 switch authType {
336338 case string (types .AppAuthnDefault ), string (types .AppAuthnSystem ), string (types .AppAuthnNone ):
@@ -344,7 +346,7 @@ func (s *SSOAuth) ValidateAuthType(authType string) bool {
344346 }
345347}
346348
347- func (s * SSOAuth ) CheckAuth (w http.ResponseWriter , r * http.Request , appProvider string , updateRedirect bool ) (string , []string , error ) {
349+ func (s * OAuthManager ) CheckAuth (w http.ResponseWriter , r * http.Request , appProvider string , updateRedirect bool ) (string , []string , error ) {
348350 cookieName := genCookieName (appProvider )
349351 session , err := s .cookieStore .Get (r , cookieName )
350352 if err != nil {
@@ -355,16 +357,16 @@ func (s *SSOAuth) CheckAuth(w http.ResponseWriter, r *http.Request, appProvider
355357 s .cookieStore .Save (r , w , session ) //nolint:errcheck
356358 }
357359 if r .Header .Get ("HX-Request" ) == "true" {
358- w .Header ().Set ("HX-Redirect" , r . RequestURI )
360+ w .Header ().Set ("HX-Redirect" , system . GetRequestUrl ( r ) )
359361 } else {
360- http .Redirect (w , r , r . RequestURI , http .StatusTemporaryRedirect )
362+ http .Redirect (w , r , system . GetRequestUrl ( r ) , http .StatusTemporaryRedirect )
361363 }
362364 return "" , nil , err
363365 }
364366 if auth , ok := session .Values [AUTH_KEY ].(bool ); ! ok || ! auth {
365367 // Store the target URL before redirecting to login
366368 if updateRedirect {
367- session .Values [REDIRECT_URL ] = r . RequestURI
369+ session .Values [REDIRECT_URL ] = system . GetRequestUrl ( r )
368370 err = session .Save (r , w )
369371 if err != nil {
370372 s .Warn ().Err (err ).Msg ("failed to save session" )
@@ -373,25 +375,25 @@ func (s *SSOAuth) CheckAuth(w http.ResponseWriter, r *http.Request, appProvider
373375 }
374376 s .Warn ().Err (err ).Msg ("no auth, redirecting to login" )
375377 if r .Header .Get ("HX-Request" ) == "true" {
376- w .Header ().Set ("HX-Redirect" , types .INTERNAL_URL_PREFIX + "/auth/" + appProvider )
378+ w .Header ().Set ("HX-Redirect" , s . config . Security . CallbackUrl + types .INTERNAL_URL_PREFIX + "/auth/" + appProvider )
377379 } else {
378- http .Redirect (w , r , types .INTERNAL_URL_PREFIX + "/auth/" + appProvider , http .StatusTemporaryRedirect )
380+ http .Redirect (w , r , s . config . Security . CallbackUrl + types .INTERNAL_URL_PREFIX + "/auth/" + appProvider , http .StatusTemporaryRedirect )
379381 }
380382 return "" , nil , nil
381383 }
382384
383385 // Check if provider name matches the one in the session
384386 if providerName , ok := session .Values [PROVIDER_NAME_KEY ].(string ); ! ok || providerName != appProvider {
385387 if updateRedirect {
386- session .Values [REDIRECT_URL ] = r . RequestURI
388+ session .Values [REDIRECT_URL ] = system . GetRequestUrl ( r )
387389 err = session .Save (r , w )
388390 if err != nil {
389391 s .Warn ().Err (err ).Msg ("failed to save session" )
390392 return "" , nil , err
391393 }
392394 }
393395 s .Warn ().Err (err ).Msg ("provider mismatch, redirecting to login" )
394- http .Redirect (w , r , types .INTERNAL_URL_PREFIX + "/auth/" + appProvider , http .StatusTemporaryRedirect )
396+ http .Redirect (w , r , s . config . Security . CallbackUrl + types .INTERNAL_URL_PREFIX + "/auth/" + appProvider , http .StatusTemporaryRedirect )
395397 return "" , nil , nil
396398 }
397399
0 commit comments