dev_agentandClaude Opus 5.5
f9f10c3a53
The callback now starts a session only when the verified groups claim
contains a group from MEALQUEST_OIDC_ALLOWED_GROUPS. When the ID token has
no groups claim, groups come from the userinfo endpoint, whose subject must
match the ID token. A refused sign-in gets a 403 HTML page ("This kitchen is
for the household only") with a sign-out button, and no session. The check
runs on every login, so an account removed from the group is refused at its
next one. auth.New requires at least one allowed group and a discovered
userinfo endpoint that passes the endpoint rule.
The RequireSession middleware wraps the /api/v1 and /media subrouters: no
live session gets 401 {"error":{"code":"unauthenticated",...}}, a lookup
failure 500, and a live session reaches the handler with the actor in the
context. It wraps the subrouters instead of using chi's Use because chi
skips middleware on a subrouter with no routes. /health, /auth and the web
build stay public.
auth.WithActor and auth.ActorFrom are the one way to read the signed-in
household member; handlers record Actor.Subject as updated_by.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
38 lines
1.0 KiB
Go
38 lines
1.0 KiB
Go
package auth
|
|
|
|
import (
|
|
"io"
|
|
"net/http"
|
|
)
|
|
|
|
// refusedPage is shown when a sign-in succeeds at the provider but the
|
|
// account is not in the household's group. Signing out ends the provider
|
|
// session too, so another account can sign in.
|
|
const refusedPage = `<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<title>MealQuest</title>
|
|
</head>
|
|
<body>
|
|
<main>
|
|
<h1>This kitchen is for the household only</h1>
|
|
<p>The account you signed in with is not part of our kitchen.</p>
|
|
<form method="post" action="` + LogoutPath + `">
|
|
<button type="submit">Sign out</button>
|
|
</form>
|
|
</main>
|
|
</body>
|
|
</html>
|
|
`
|
|
|
|
// refuse writes the refused-sign-in page with 403.
|
|
func (a *Auth) refuse(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
|
w.WriteHeader(http.StatusForbidden)
|
|
if _, err := io.WriteString(w, refusedPage); err != nil {
|
|
a.logger.WarnContext(r.Context(), "write refused sign-in page", "error", err)
|
|
}
|
|
}
|