mono
2f7a491666
Source-only publication of reviewed commit 64e96a7f423673dc29ad56485be9fc79bce8af1c.
Passed in isolation: focused frontend/backend tests, race checks, TypeScript typecheck, lint, Go compilation, Flowgram build, and deterministic SDK build/tests.
Not accepted as a production release: Next.js export/native assembly remains blocked by environment memory limits; browser interaction and MySQL staging acceptance remain unverified. No production server, database/schema, runtime configuration, deployment, release tag, or workflow execution was performed.
Expected source tree: 0a4a7528e9.
69 lines
2.2 KiB
Go
69 lines
2.2 KiB
Go
// Modified in the independent hardening fork; see docs/hardening.
|
|
|
|
package api
|
|
|
|
import (
|
|
"time"
|
|
|
|
"agent-desk/internal/pkg/config"
|
|
"agent-desk/internal/pkg/dto/response"
|
|
"agent-desk/internal/pkg/enums"
|
|
"agent-desk/internal/pkg/httpx"
|
|
"agent-desk/internal/pkg/openidentity"
|
|
"agent-desk/internal/services"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
func CustomerPostSession_exchange(ctx *gin.Context) {
|
|
channel := services.ChannelService.GetEnabledChannel(ctx)
|
|
if channel == nil {
|
|
httpx.WriteJSON(ctx, httpx.JsonErrorMsg(ctx, "error.e0209"))
|
|
return
|
|
}
|
|
identity := config.Current().Identity
|
|
externalUser, err := openidentity.GetExternalUser(ctx, openidentity.Secrets{
|
|
UserToken: services.ChannelService.GetUserTokenSecret(channel),
|
|
IdentityHMAC: identity.Secret,
|
|
IdentityMaxAge: identity.MaxAge(),
|
|
ChannelID: channel.ChannelID,
|
|
RequireSignedIdentity: services.ChannelService.RequiresSignedIdentity(channel),
|
|
})
|
|
if err != nil {
|
|
httpx.WriteJSON(ctx, err)
|
|
return
|
|
}
|
|
resp, err := services.CustomerSessionService.Exchange(channel, *externalUser)
|
|
if err != nil {
|
|
httpx.WriteJSON(ctx, err)
|
|
return
|
|
}
|
|
httpx.WriteJSON(ctx, resp)
|
|
}
|
|
|
|
// Refresh requires possession of the still-valid customer credential; unlike
|
|
// unsigned session exchange it never creates or changes an anonymous identity.
|
|
func CustomerPostSession_refresh(ctx *gin.Context) {
|
|
channel := services.ChannelService.GetEnabledChannel(ctx)
|
|
if channel == nil {
|
|
httpx.WriteJSON(ctx, httpx.JsonErrorMsg(ctx, "error.e0209"))
|
|
return
|
|
}
|
|
result, err := services.CustomerSessionService.VerifyRequest(ctx, channel)
|
|
if err != nil {
|
|
httpx.WriteJSON(ctx, err)
|
|
return
|
|
}
|
|
services.CustomerSessionService.SetRefreshHeaders(ctx, result)
|
|
source := "guest:"
|
|
if result.ExternalUser.ExternalSource == enums.ExternalSourceUser {
|
|
source = "user:"
|
|
}
|
|
httpx.WriteJSON(ctx, &response.CustomerSessionExchangeResponse{
|
|
CustomerSessionToken: result.Token,
|
|
ExpiresAt: result.ExpiresAt.UTC().Format(time.RFC3339),
|
|
IdentityKey: source + result.ExternalUser.ExternalID,
|
|
Customer: response.CustomerSessionCustomerResponse{ID: result.CustomerID, Name: result.ExternalUser.ExternalName},
|
|
})
|
|
}
|