127 lines
4.8 KiB
HTML
127 lines
4.8 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>Restricted API Demo</title>
|
|
<link rel="stylesheet" href="style.css">
|
|
</head>
|
|
<body>
|
|
<div class="container">
|
|
<header>
|
|
<h1>🔐 Restricted API Demo</h1>
|
|
<p class="subtitle">Demonstrates authentication for protected resources</p>
|
|
</header>
|
|
|
|
<div class="content">
|
|
<div class="section">
|
|
<h2>API Mode (iframe)</h2>
|
|
<p>For SPAs and fetch() calls - shows auth in an iframe overlay:</p>
|
|
<button onclick="apiCall('/auth/api/user-info', 'POST')">Get User Info</button>
|
|
<button onclick="apiCall('/auth/api/forward?max_age=10s')">Reauth (max_age=10s)</button>
|
|
<button onclick="apiCall('/auth/api/forward?perm=auth:admin')">Admin Only</button>
|
|
<button onclick="logout()">Logout</button>
|
|
</div>
|
|
|
|
<div class="section">
|
|
<h2>Browser Mode (full page)</h2>
|
|
<p>For traditional apps - redirects to auth page, then back:</p>
|
|
<button onclick="browserNav('/auth/api/forward')">Basic Auth</button>
|
|
<button onclick="browserNav('/auth/api/forward?max_age=10s')">Reauth (max_age=10s)</button>
|
|
<button onclick="browserNav('/auth/api/forward?perm=auth:admin')">Admin Only</button>
|
|
</div>
|
|
|
|
<pre id="output">Click a button to test...</pre>
|
|
</div>
|
|
</div>
|
|
|
|
<script>
|
|
const output = document.getElementById('output');
|
|
let pendingCall = null;
|
|
|
|
// Listen for auth iframe messages
|
|
window.addEventListener('message', (event) => {
|
|
const { type, message } = event.data || {};
|
|
|
|
if (type === 'auth-success') {
|
|
log('✓ Authentication successful, retrying...');
|
|
hideAuthIframe();
|
|
if (pendingCall) {
|
|
const { url, method } = pendingCall;
|
|
pendingCall = null;
|
|
apiCall(url, method);
|
|
}
|
|
} else if (type === 'auth-back' || type === 'auth-error') {
|
|
log(message || 'Authentication cancelled');
|
|
hideAuthIframe();
|
|
pendingCall = null;
|
|
}
|
|
});
|
|
|
|
async function apiCall(url, method = 'GET') {
|
|
log(`${method} ${url}...`);
|
|
|
|
const response = await fetch(url, { method, credentials: 'include' });
|
|
|
|
// If auth required, show the auth iframe
|
|
if (response.status === 401 || response.status === 403) {
|
|
const data = await response.json();
|
|
if (data.auth?.iframe) {
|
|
const mode = data.auth.mode;
|
|
log(`${mode === 'reauth' ? 'Re-authentication' : 'Authentication'} required...`);
|
|
pendingCall = { url, method };
|
|
showAuthIframe(data.auth.iframe);
|
|
return;
|
|
}
|
|
log(`Error: ${response.status} - ${data.detail}`);
|
|
return;
|
|
}
|
|
|
|
if (response.status === 204) {
|
|
log('✓ Success (204 No Content)\nHeaders:\n' +
|
|
[...response.headers].filter(([k]) => k.startsWith('remote-'))
|
|
.map(([k, v]) => ` ${k}: ${v}`).join('\n'));
|
|
return;
|
|
}
|
|
|
|
if (!response.ok) {
|
|
log(`Error: ${response.status} ${response.statusText}`);
|
|
return;
|
|
}
|
|
|
|
const data = await response.json();
|
|
log('✓ Response:\n' + JSON.stringify(data, null, 2));
|
|
}
|
|
|
|
async function logout() {
|
|
await fetch('/auth/api/logout', { method: 'POST', credentials: 'include' });
|
|
log('Logged out');
|
|
}
|
|
|
|
function showAuthIframe(url) {
|
|
hideAuthIframe();
|
|
const iframe = document.createElement('iframe');
|
|
iframe.id = 'auth-iframe';
|
|
iframe.src = url;
|
|
iframe.allow = 'publickey-credentials-get; publickey-credentials-create';
|
|
document.body.appendChild(iframe);
|
|
}
|
|
|
|
function hideAuthIframe() {
|
|
document.getElementById('auth-iframe')?.remove();
|
|
}
|
|
|
|
function log(msg) {
|
|
output.textContent = msg;
|
|
}
|
|
|
|
// Browser mode: navigate directly to the forward endpoint
|
|
// Browser sends Accept: text/html, so it gets a full page instead of JSON
|
|
function browserNav(url) {
|
|
log('Opening in new window...\nIf not authenticated, you\'ll see the login page.\nAfter auth, you\'ll see a 204 response (blank page = success).');
|
|
window.open(url, '_blank');
|
|
}
|
|
</script>
|
|
</body>
|
|
</html>
|