letro/letro-authentication-service
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Check validity of token owner

Browse Source
This commit is contained in:
Olivier 'reivilibre
2025-10-22 13:04:39 +01:00
parent ee25c53978
commit 8470dc43ac
1 changed files with 19 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
crates/handlers/src/admin/call_context.rs
View File

@@ -17,7 +17,8 @@ use headers::{Authorization, authorization::Bearer};
use hyper::StatusCode;
use mas_axum_utils::record_error;
use mas_data_model::{
BoxClock, Session, TokenFormatError, TokenType, User, personal::session::PersonalSession,
BoxClock, Session, TokenFormatError, TokenType, User,
personal::session::{PersonalSession, PersonalSessionOwner},
};
use mas_storage::{BoxRepository, RepositoryError};
use oauth2_types::scope::Scope;
@@ -222,6 +223,23 @@ where
return Err(Rejection::TokenExpired);
}
// Check the validity of the owner of the personal session
match session.owner {
PersonalSessionOwner::User(owner_user_id) => {
let owner_user = repo
.user()
.lookup(owner_user_id)
.await?
.ok_or_else(|| Rejection::LoadUser(owner_user_id))?;
if !owner_user.is_valid() {
return Err(Rejection::UserLocked);
}
}
PersonalSessionOwner::OAuth2Client(_) => {
// nop: Client owners are always valid
}
}
// Record the activity on the session
activity_tracker
.record_personal_session(&clock, &session)