serendipty01.dev
forked from
smokesignal.events/smokesignal
The smokesignal.events web application
bug: login destination redirect was not persisted in aip auth flow
Signed-off-by: Nick Gerakines <nick.gerakines@gmail.com>
+3
migrations/20250706165000_add_destination_to_oauth_requests.sql
+3
migrations/20250706165000_add_destination_to_oauth_requests.sql
+22
-5
src/http/handle_oauth_aip_callback.rs
+22
-5
src/http/handle_oauth_aip_callback.rs
···
162
163
let updated_jar = jar.add(cookie);
164
165
-
// let destination = match oauth_request.destination {
166
-
// Some(destination) => destination,
167
-
// None => "/".to_string(),
168
-
// };
169
170
-
Ok((updated_jar, Redirect::to("/")).into_response())
171
}
172
173
#[derive(Clone, Deserialize)]
···
162
163
let updated_jar = jar.add(cookie);
164
165
+
// Retrieve destination from OAuth request before deleting it
166
+
let postgres_storage = crate::storage::atproto::PostgresOAuthRequestStorage::new(
167
+
web_context.pool.clone()
168
+
);
169
+
let destination = match postgres_storage.get_destination(&callback_state).await {
170
+
Ok(Some(dest)) => dest,
171
+
Ok(None) => "/".to_string(),
172
+
Err(err) => {
173
+
tracing::error!(?err, "Failed to get destination");
174
+
"/".to_string()
175
+
}
176
+
};
177
+
178
+
// Delete the OAuth request now that we're done with it
179
+
if let Err(err) = web_context
180
+
.oauth_storage
181
+
.delete_oauth_request_by_state(&callback_state)
182
+
.await
183
+
{
184
+
tracing::error!(error = ?err, "Unable to remove oauth_request");
185
+
}
186
187
+
Ok((updated_jar, Redirect::to(destination.as_str())).into_response())
188
}
189
190
#[derive(Clone, Deserialize)]
+15
-1
src/http/handle_oauth_aip_login.rs
+15
-1
src/http/handle_oauth_aip_login.rs
···
33
#[derive(Deserialize)]
34
pub(crate) struct OAuthLoginForm {
35
handle: Option<String>,
36
}
37
38
-
#[derive(Deserialize)]
39
pub(crate) struct Destination {
40
destination: Option<String>,
41
}
···
241
{
242
tracing::error!(?err, "insert_oauth_request");
243
return contextual_error!(web_context, language, error_template, default_context, err);
244
}
245
246
let oauth_args = [
···
33
#[derive(Deserialize)]
34
pub(crate) struct OAuthLoginForm {
35
handle: Option<String>,
36
+
destination: Option<String>,
37
}
38
39
+
#[derive(Debug, Deserialize)]
40
pub(crate) struct Destination {
41
destination: Option<String>,
42
}
···
242
{
243
tracing::error!(?err, "insert_oauth_request");
244
return contextual_error!(web_context, language, error_template, default_context, err);
245
+
}
246
+
247
+
if let Some(ref dest) = login_form.destination {
248
+
if dest != "/" {
249
+
// Create a direct instance to access the set_destination method
250
+
let postgres_storage = crate::storage::atproto::PostgresOAuthRequestStorage::new(
251
+
web_context.pool.clone()
252
+
);
253
+
if let Err(err) = postgres_storage.set_destination(&state, dest).await {
254
+
tracing::error!(?err, "set_destination");
255
+
// Don't fail the login flow if we can't store the destination
256
+
}
257
+
}
258
}
259
260
let oauth_args = [
+13
-2
src/http/handle_oauth_callback.rs
+13
-2
src/http/handle_oauth_callback.rs
···
163
164
let token_response = token_response.unwrap();
165
166
if let Err(err) = web_context
167
.oauth_storage
168
.delete_oauth_request_by_state(&callback_state)
···
187
cookie.set_same_site(Some(SameSite::Lax));
188
189
let updated_jar = jar.add(cookie);
190
-
191
-
let destination = "/".to_string(); // Simplified for initial pass
192
193
Ok((updated_jar, Redirect::to(&destination)).into_response())
194
}
···
163
164
let token_response = token_response.unwrap();
165
166
+
// Retrieve destination from OAuth request before deleting it
167
+
let postgres_storage = crate::storage::atproto::PostgresOAuthRequestStorage::new(
168
+
web_context.pool.clone()
169
+
);
170
+
let destination = match postgres_storage.get_destination(&callback_state).await {
171
+
Ok(Some(dest)) => dest,
172
+
Ok(None) => "/".to_string(),
173
+
Err(err) => {
174
+
tracing::error!(?err, "Failed to get destination");
175
+
"/".to_string()
176
+
}
177
+
};
178
+
179
if let Err(err) = web_context
180
.oauth_storage
181
.delete_oauth_request_by_state(&callback_state)
···
200
cookie.set_same_site(Some(SameSite::Lax));
201
202
let updated_jar = jar.add(cookie);
203
204
Ok((updated_jar, Redirect::to(&destination)).into_response())
205
}
+14
src/http/handle_oauth_login.rs
+14
src/http/handle_oauth_login.rs
···
272
return contextual_error!(web_context, language, error_template, default_context, err);
273
}
274
275
+
// Store destination if provided and not "/"
276
+
if let Some(ref dest) = destination.destination {
277
+
if dest != "/" {
278
+
// Create a direct instance to access the set_destination method
279
+
let postgres_storage = crate::storage::atproto::PostgresOAuthRequestStorage::new(
280
+
web_context.pool.clone()
281
+
);
282
+
if let Err(err) = postgres_storage.set_destination(&oauth_request_state.state, dest).await {
283
+
tracing::error!(?err, "set_destination");
284
+
// Don't fail the login flow if we can't store the destination
285
+
}
286
+
}
287
+
}
288
+
289
let oauth_args = [
290
(
291
"request_uri".to_string(),
+4
src/http/handle_view_event.rs
+4
src/http/handle_view_event.rs
···
283
284
let event_url = url_from_aturi(&ctx.web_context.config.external_base, &event.aturi)?;
285
286
// Add Edit button link if the user is the event creator
287
let can_edit = ctx
288
.current_handle
···
464
language => ctx.language.to_string(),
465
identity_has_email,
466
canonical_url => event_url,
467
event => event_with_counts,
468
is_self,
469
can_edit,
···
283
284
let event_url = url_from_aturi(&ctx.web_context.config.external_base, &event.aturi)?;
285
286
+
// Create login URL with destination parameter for this event
287
+
let login_url = format!("/oauth/login?destination={}", urlencoding::encode(&format!("/{}/{}", handle_slug, event_rkey)));
288
+
289
// Add Edit button link if the user is the event creator
290
let can_edit = ctx
291
.current_handle
···
467
language => ctx.language.to_string(),
468
identity_has_email,
469
canonical_url => event_url,
470
+
login_url => login_url,
471
event => event_with_counts,
472
is_self,
473
can_edit,
+1
-20
src/http/middleware_auth.rs
+1
-20
src/http/middleware_auth.rs
···
87
Auth::Unauthenticated => {}
88
}
89
90
-
debug!(
91
-
location,
92
-
"Authentication required, creating signed redirect"
93
-
);
94
-
95
-
let header: Header = config
96
-
.destination_key_data
97
-
.clone()
98
-
.try_into()
99
-
.map_err(AuthMiddlewareError::SigningFailed)?;
100
-
let claims = Claims::new(JoseClaims {
101
-
http_uri: Some(location.to_string()),
102
-
nonce: Some(ulid::Ulid::new().to_string()),
103
-
..Default::default()
104
-
});
105
-
106
-
let destination_token = mint(&config.destination_key_data, &header, &claims)
107
-
.map_err(AuthMiddlewareError::SigningFailed)?;
108
-
109
-
Err(MiddlewareAuthError::AccessDenied(destination_token))
110
}
111
112
/// Simpler authentication check that just redirects to root path
+72
-1
src/storage/atproto.rs
+72
-1
src/storage/atproto.rs
···
20
pub dpop_private_key: String,
21
pub created_at: DateTime<Utc>,
22
pub expires_at: DateTime<Utc>,
23
}
24
25
/// Postgres implementation of DidDocumentStorage trait
···
122
pub fn new_arc(pool: StoragePool) -> Arc<dyn OAuthRequestStorage> {
123
Arc::new(Self::new(pool))
124
}
125
}
126
127
#[async_trait]
···
163
164
let result = sqlx::query_as::<_, OAuthRequestRow>(
165
"SELECT oauth_state, issuer, did, nonce, pkce_verifier,
166
-
signing_public_key, dpop_private_key, created_at, expires_at
167
FROM atproto_oauth_requests
168
WHERE oauth_state = $1 AND expires_at > NOW()",
169
)
···
20
pub dpop_private_key: String,
21
pub created_at: DateTime<Utc>,
22
pub expires_at: DateTime<Utc>,
23
+
pub destination: Option<String>,
24
}
25
26
/// Postgres implementation of DidDocumentStorage trait
···
123
pub fn new_arc(pool: StoragePool) -> Arc<dyn OAuthRequestStorage> {
124
Arc::new(Self::new(pool))
125
}
126
+
127
+
/// Set the destination for an OAuth request
128
+
pub async fn set_destination(
129
+
&self,
130
+
oauth_state: &str,
131
+
destination: &str,
132
+
) -> Result<(), StorageError> {
133
+
if oauth_state.trim().is_empty() {
134
+
return Err(StorageError::UnableToExecuteQuery(
135
+
sqlx::Error::Protocol("OAuth state cannot be empty".to_string()),
136
+
));
137
+
}
138
+
139
+
let mut tx = self
140
+
.pool
141
+
.begin()
142
+
.await
143
+
.map_err(StorageError::CannotBeginDatabaseTransaction)?;
144
+
145
+
sqlx::query(
146
+
"UPDATE atproto_oauth_requests
147
+
SET destination = $1
148
+
WHERE oauth_state = $2",
149
+
)
150
+
.bind(destination)
151
+
.bind(oauth_state)
152
+
.execute(tx.as_mut())
153
+
.await
154
+
.map_err(StorageError::UnableToExecuteQuery)?;
155
+
156
+
tx.commit()
157
+
.await
158
+
.map_err(StorageError::CannotCommitDatabaseTransaction)?;
159
+
160
+
Ok(())
161
+
}
162
+
163
+
/// Get the destination for an OAuth request
164
+
pub async fn get_destination(
165
+
&self,
166
+
oauth_state: &str,
167
+
) -> Result<Option<String>, StorageError> {
168
+
if oauth_state.trim().is_empty() {
169
+
return Err(StorageError::UnableToExecuteQuery(
170
+
sqlx::Error::Protocol("OAuth state cannot be empty".to_string()),
171
+
));
172
+
}
173
+
174
+
let mut tx = self
175
+
.pool
176
+
.begin()
177
+
.await
178
+
.map_err(StorageError::CannotBeginDatabaseTransaction)?;
179
+
180
+
let result = sqlx::query_scalar::<_, Option<String>>(
181
+
"SELECT destination
182
+
FROM atproto_oauth_requests
183
+
WHERE oauth_state = $1 AND expires_at > NOW()",
184
+
)
185
+
.bind(oauth_state)
186
+
.fetch_optional(tx.as_mut())
187
+
.await
188
+
.map_err(StorageError::UnableToExecuteQuery)?;
189
+
190
+
tx.commit()
191
+
.await
192
+
.map_err(StorageError::CannotCommitDatabaseTransaction)?;
193
+
194
+
Ok(result.flatten())
195
+
}
196
}
197
198
#[async_trait]
···
234
235
let result = sqlx::query_as::<_, OAuthRequestRow>(
236
"SELECT oauth_state, issuer, did, nonce, pkce_verifier,
237
+
signing_public_key, dpop_private_key, created_at, expires_at, destination
238
FROM atproto_oauth_requests
239
WHERE oauth_state = $1 AND expires_at > NOW()",
240
)
+1
-1
templates/view_event.en-us.common.html
+1
-1
templates/view_event.en-us.common.html