mono
63e0457886
Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.
61 lines
2.1 KiB
Go
61 lines
2.1 KiB
Go
// Modified in the independent hardening fork; see docs/hardening.
|
|
|
|
package api
|
|
|
|
import (
|
|
"time"
|
|
|
|
"agent-desk/internal/pkg/config"
|
|
"agent-desk/internal/pkg/dto/response"
|
|
"agent-desk/internal/pkg/enums"
|
|
"agent-desk/internal/pkg/httpx"
|
|
"agent-desk/internal/pkg/openidentity"
|
|
"agent-desk/internal/services"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
func CustomerPostSession_exchange(ctx *gin.Context) {
|
|
channel := services.ChannelService.GetEnabledChannel(ctx)
|
|
if channel == nil {
|
|
httpx.WriteJSON(ctx, httpx.JsonErrorMsg(ctx, "error.e0209"))
|
|
return
|
|
}
|
|
identity := config.Current().Identity
|
|
externalUser, err := openidentity.GetExternalUser(ctx, openidentity.Secrets{
|
|
UserToken: services.ChannelService.GetUserTokenSecret(channel),
|
|
IdentityHMAC: identity.Secret,
|
|
IdentityMaxAge: identity.MaxAge(),
|
|
ChannelID: channel.ChannelID,
|
|
RequireSignedIdentity: services.ChannelService.RequiresSignedIdentity(channel),
|
|
})
|
|
if err != nil {
|
|
httpx.WriteJSON(ctx, err)
|
|
return
|
|
}
|
|
resp, err := services.CustomerSessionService.Exchange(channel, *externalUser)
|
|
if err != nil {
|
|
httpx.WriteJSON(ctx, err)
|
|
return
|
|
}
|
|
httpx.WriteJSON(ctx, resp)
|
|
}
|
|
|
|
// Refresh requires possession of the still-valid customer credential; unlike
|
|
// unsigned session exchange it never creates or changes an anonymous identity.
|
|
func CustomerPostSession_refresh(ctx *gin.Context) {
|
|
channel := services.ChannelService.GetEnabledChannel(ctx)
|
|
if channel == nil { httpx.WriteJSON(ctx, httpx.JsonErrorMsg(ctx, "error.e0209")); return }
|
|
result, err := services.CustomerSessionService.VerifyRequest(ctx, channel)
|
|
if err != nil { httpx.WriteJSON(ctx, err); return }
|
|
services.CustomerSessionService.SetRefreshHeaders(ctx, result)
|
|
source := "guest:"
|
|
if result.ExternalUser.ExternalSource == enums.ExternalSourceUser { source = "user:" }
|
|
httpx.WriteJSON(ctx, &response.CustomerSessionExchangeResponse{
|
|
CustomerSessionToken: result.Token,
|
|
ExpiresAt: result.ExpiresAt.UTC().Format(time.RFC3339),
|
|
IdentityKey: source + result.ExternalUser.ExternalID,
|
|
Customer: response.CustomerSessionCustomerResponse{ID: result.CustomerID, Name: result.ExternalUser.ExternalName},
|
|
})
|
|
}
|