LeoVasanko
68dccc1378
Allows Paskia to authenticate the user to a client site. - User friendly client registration flow on the admin app - Redirect-based authentication flow (per spec) - Backchannel logout both ways to keep sessions synchronized - Groups integrated with Paskia's permission system - Adds email, preferred username and telephone fields on user profile - All new user basic info layout to show the new information, better looks - API and DB structures redesigned - Various unrelated fixes to theming and layout
92 lines
2.4 KiB
Vue
92 lines
2.4 KiB
Vue
<template>
|
|
<RestrictedAuth
|
|
:mode="authMode"
|
|
:remote-auth-token="remoteAuthToken"
|
|
:oidc-query-string="oidcQueryString"
|
|
@authenticated="handleAuthenticated"
|
|
@back="handleBack"
|
|
/>
|
|
</template>
|
|
|
|
<script setup>
|
|
import { onMounted, ref } from 'vue'
|
|
import RestrictedAuth from '@/components/RestrictedAuth.vue'
|
|
|
|
// Check if this is a remote auth URL: /auth/{token}
|
|
// The token is a 5-word passphrase like "word1.word2.word3.word4.word5"
|
|
const remoteAuthToken = ref(null)
|
|
|
|
// For OIDC flow, pass the raw query string to preserve exact param values
|
|
const oidcQueryString = window.location.search.includes('client_id=') ? window.location.search : null
|
|
|
|
function extractRemoteToken() {
|
|
const path = window.location.pathname
|
|
// Match /auth/{token} where token is a passphrase with dots
|
|
const match = path.match(/\/auth\/([^/]+)$/)
|
|
if (match) {
|
|
const token = match[1]
|
|
// Validate it looks like a 5-word passphrase
|
|
const parts = token.split('.')
|
|
if (parts.length === 5 && parts.every(p => p.length > 0)) {
|
|
return token
|
|
}
|
|
}
|
|
return null
|
|
}
|
|
|
|
// Parse URL hash fragment
|
|
const hashParams = new URLSearchParams(window.location.hash.slice(1))
|
|
|
|
// Determine auth mode based on URL path
|
|
// - /auth/restricted/oidc: OIDC flow, no session dependency
|
|
// - /auth/restricted/iframe: iframe embedding, mode from hash params
|
|
// - Other paths: forward auth, mode from hash params
|
|
let authMode
|
|
if (window.location.pathname === '/auth/restricted/oidc') {
|
|
authMode = 'oidc'
|
|
} else {
|
|
// Both iframe and forward auth use hash params for mode (forbidden/login/reauth)
|
|
authMode = ['reauth', 'forbidden'].includes(hashParams.get('mode')) ? hashParams.get('mode') : 'login'
|
|
}
|
|
|
|
function postToParent(message) {
|
|
if (window.parent && window.parent !== window) {
|
|
window.parent.postMessage(message, '*')
|
|
}
|
|
}
|
|
|
|
function handleAuthenticated(result) {
|
|
if (result.redirect_url) {
|
|
// OIDC flow: redirect to client with auth code
|
|
window.location.href = result.redirect_url
|
|
return
|
|
}
|
|
postToParent({
|
|
type: 'auth-success',
|
|
authenticated: true,
|
|
exchangeCode: result.exchange_code
|
|
})
|
|
}
|
|
|
|
function handleBack() {
|
|
postToParent({
|
|
type: 'auth-back'
|
|
})
|
|
}
|
|
|
|
onMounted(() => {
|
|
// Check for remote auth token in URL
|
|
remoteAuthToken.value = extractRemoteToken()
|
|
|
|
postToParent({
|
|
type: 'auth-ready'
|
|
})
|
|
|
|
window.addEventListener('keydown', (event) => {
|
|
if (event.key === 'Escape') {
|
|
handleBack()
|
|
}
|
|
})
|
|
})
|
|
</script>
|