Merge pull request #32 from thand-io/embed-provider-in-token

Add the provider into the session

Author: hughneale

internal/daemon/auth.go

@@ -160,7 +160,7 @@ func (s *Server) getAuthCallbackPage(c *gin.Context, auth models.AuthWrapper) {
 	state := c.Query("state")
 	code := c.Query("code")
 
-	session, err := provider.GetClient().CreateSession(context.TODO(), &models.AuthorizeUser{
+	session, err := provider.GetClient().CreateSession(c, &models.AuthorizeUser{
 		State:       state,
 		Code:        code,
 		RedirectUri: s.GetConfig().GetAuthCallbackUrl(auth.Provider),
@@ -171,8 +171,14 @@ func (s *Server) getAuthCallbackPage(c *gin.Context, auth models.AuthWrapper) {
 		return
 	}
 
+	exportableSession := &models.ExportableSession{
+		Session:  session,
+		Provider: auth.Provider,
+	}
+
 	// Covert our sensitive session to one we can store on the users local system
-	localSession := session.ToLocalSession(s.Config.GetServices().GetEncryption())
+	localSession := exportableSession.ToLocalSession(
+		s.Config.GetServices().GetEncryption())
 
 	data := AuthCallbackPageData{
 		TemplateData: s.GetTemplateData(c),

internal/daemon/elevate.go

@@ -86,33 +86,26 @@ func (s *Server) postElevateJSON(c *gin.Context) {
 		return
 	}
 
-	// Parse as raw JSON to detect request type
-	var rawData map[string]any
-	if err := json.Unmarshal(body, &rawData); err != nil {
-		s.getErrorPage(c, http.StatusBadRequest, "Invalid JSON payload", err)
+	// This is a standard elevation request
+	var request models.ElevateRequest
+	if err := json.Unmarshal(body, &request); err != nil {
+		s.getErrorPage(c, http.StatusBadRequest, "Invalid standard request payload", err)
 		return
 	}
 
-	// Check if this is a dynamic request (has providers array, permissions array, etc.)
-	if providers, hasProviders := rawData["providers"].([]any); hasProviders && len(providers) > 0 {
-		// This is a dynamic request
-		var dynamicRequest models.ElevateDynamicRequest
-		if err := json.Unmarshal(body, &dynamicRequest); err != nil {
-			s.getErrorPage(c, http.StatusBadRequest, "Invalid dynamic request payload", err)
-			return
-		}
-		s.handleDynamicRequest(c, dynamicRequest)
+	if request.IsValid() {
+		s.elevate(c, request)
 		return
 	}
 
-	// This is a standard elevation request
-	var request models.ElevateRequest
-	if err := json.Unmarshal(body, &request); err != nil {
-		s.getErrorPage(c, http.StatusBadRequest, "Invalid standard request payload", err)
+	// Parse as raw JSON to detect request type
+	var dynamicRequest models.ElevateDynamicRequest
+	if err := json.Unmarshal(body, &dynamicRequest); err != nil {
+		s.getErrorPage(c, http.StatusBadRequest, "Invalid dynamic request payload", err)
 		return
 	}
+	s.handleDynamicRequest(c, dynamicRequest)
 
-	s.elevate(c, request)
 }
 
 func (s *Server) handleDynamicRequest(c *gin.Context, dynamicRequest models.ElevateDynamicRequest) {
@@ -182,27 +175,35 @@ func (s *Server) elevate(c *gin.Context, request models.ElevateRequest) {
 	// lets attach a user session to the request.
 	if s.Config.IsServer() {
 
-		// Get the auth provider from the workflow if set
-		authProvider := []string{}
+		if len(request.Workflow) == 0 {
+			s.getErrorPage(c, http.StatusBadRequest, "No workflow specified for elevation request")
+			return
+		}
 
-		if len(request.Workflow) > 0 {
-			workflowDef, err := s.Config.GetWorkflowByName(request.Workflow)
-			if err != nil {
-				s.getErrorPage(c, http.StatusBadRequest, "Invalid workflow specified", err)
-				return
-			}
-			authProvider = []string{workflowDef.GetAuthentication()}
+		workflowDef, err := s.Config.GetWorkflowByName(request.Workflow)
+
+		if err != nil {
+			s.getErrorPage(c, http.StatusBadRequest, "Invalid workflow specified", err)
+			return
 		}
 
-		foundUser, err := s.getUser(c, authProvider...)
+		authProvider := workflowDef.GetAuthentication()
+
+		foundUser, err := s.getUser(c, authProvider)
 
 		if err != nil {
 			s.getErrorPage(c, http.StatusUnauthorized, "Unauthorized: unable to get user for list of available roles", err)
 			return
 		}
 
 		if foundUser != nil {
-			request.Session = foundUser.ToLocalSession(s.Config.GetServices().GetEncryption())
+
+			exportableSession := &models.ExportableSession{
+				Session:  foundUser,
+				Provider: authProvider,
+			}
+
+			request.Session = exportableSession.ToLocalSession(s.Config.GetServices().GetEncryption())
 		}
 
 	}
@@ -323,7 +324,8 @@ func (s *Server) getElevateAuthOAuth2(c *gin.Context) {
 	})
 
 	if err != nil {
-		s.getErrorPage(c, http.StatusInternalServerError, "Failed to create session for elevation request", err)
+		s.getErrorPage(c, http.StatusInternalServerError,
+			"Failed to create session for elevation request", err)
 		return
 	}
 
@@ -332,7 +334,13 @@ func (s *Server) getElevateAuthOAuth2(c *gin.Context) {
 
 	workflowTask.SetUser(session.User)
 
-	localSession := session.ToLocalSession(s.Config.GetServices().GetEncryption())
+	exportableSession := &models.ExportableSession{
+		Session:  session,
+		Provider: authProvider,
+	}
+
+	localSession := exportableSession.ToLocalSession(
+		s.Config.GetServices().GetEncryption())
 
 	if err := s.setAuthCookie(c, authProvider, localSession); err != nil {
 		s.getErrorPage(c, http.StatusInternalServerError, "Failed to set auth cookie", err)

internal/daemon/middleware.go

@@ -48,7 +48,11 @@ func (s *Server) AuthMiddleware() gin.HandlerFunc {
 }
 
 // processProviderCookies extracts sessions from provider cookies
-func (s *Server) processProviderCookies(cookie sessions.Session, encryptionServer models.EncryptionImpl, foundSessions map[string]*models.Session) {
+func (s *Server) processProviderCookies(
+	cookie sessions.Session,
+	encryptionServer models.EncryptionImpl,
+	foundSessions map[string]*models.Session,
+) {
 	allProviders := s.Config.GetProvidersByCapability(models.ProviderCapabilityAuthorizor)
 
 	for providerName := range allProviders {
@@ -65,12 +69,16 @@ func (s *Server) processProviderCookies(cookie sessions.Session, encryptionServe
 			continue
 		}
 
-		foundSessions[providerName] = decodedSession
+		foundSessions[providerName] = decodedSession.Session
 	}
 }
 
 // processBearerToken extracts session from Authorization Bearer token
-func (s *Server) processBearerToken(c *gin.Context, encryptionServer models.EncryptionImpl, foundSessions map[string]*models.Session) {
+func (s *Server) processBearerToken(
+	c *gin.Context,
+	encryptionServer models.EncryptionImpl,
+	foundSessions map[string]*models.Session,
+) {
 	authHeader := c.GetHeader("Authorization")
 	if len(authHeader) == 0 || !strings.HasPrefix(authHeader, "Bearer ") {
 		return
@@ -83,11 +91,20 @@ func (s *Server) processBearerToken(c *gin.Context, encryptionServer models.Encr
 		return
 	}
 
-	foundSessions["todo"] = decodedSession
+	if len(decodedSession.Provider) == 0 {
+		logrus.Warnln("Decoded session from bearer token has no provider information")
+		return
+	}
+
+	foundSessions[decodedSession.Provider] = decodedSession.Session
 }
 
 // processAPIKey extracts session from X-API-Key header
-func (s *Server) processAPIKey(c *gin.Context, encryptionServer models.EncryptionImpl, foundSessions map[string]*models.Session) {
+func (s *Server) processAPIKey(
+	c *gin.Context,
+	encryptionServer models.EncryptionImpl,
+	foundSessions map[string]*models.Session,
+) {
 	apiHeader := c.GetHeader("X-API-Key")
 	if len(apiHeader) == 0 {
 		return
@@ -99,7 +116,12 @@ func (s *Server) processAPIKey(c *gin.Context, encryptionServer models.Encryptio
 		return
 	}
 
-	foundSessions["todo"] = decodedSession
+	if len(decodedSession.Provider) == 0 {
+		logrus.Warnln("Decoded session from API key has no provider information")
+		return
+	}
+
+	foundSessions[decodedSession.Provider] = decodedSession.Session
 }
 
 // handleAgentMode processes sessions for agent/client mode
@@ -126,7 +148,7 @@ func (s *Server) handleAgentMode(c *gin.Context, cookie sessions.Session) {
 	c.Redirect(http.StatusTemporaryRedirect, c.Request.RequestURI)
 }
 
-func getDecodedSession(encryptor models.EncryptionImpl, session string) (*models.Session, error) {
+func getDecodedSession(encryptor models.EncryptionImpl, session string) (*models.ExportableSession, error) {
 
 	localSession, err := models.DecodedLocalSession(session)
 

internal/daemon/static/user.html

@@ -28,7 +28,7 @@ <h3>Account Summary</h3>
                     </div>
                     <div class="info-item">
                         <span class="form-label">Provider</span>
-                        <span class="info-value">{{if .User}}{{.User.Provider}}{{else}}N/A{{end}}</span>
+                        <span class="info-value">{{if .User}}{{.User.Source}}{{else}}N/A{{end}}</span>
                     </div>
                     <div class="info-item">
                         <span class="form-label">Verified</span>
@@ -295,9 +295,8 @@ <h1>User Profile</h1>
         async function logout() {
             if (confirm('Are you sure you want to logout?')) {
                 try {
-                    const response = await fetch('/api/v1/auth/logout', {
-                        method: 'POST',
-                        credentials: 'include'
+                    const response = await fetch('{{.Config.GetApiBasePath}}/auth/logout', {
+                        method: 'GET',
                     });
 
                     if (response.ok) {

internal/models/common.go

@@ -15,8 +15,9 @@ var ENCODED_SESSION = "session"
 var ENCODED_SESSION_LOCAL = "session_local"
 
 type EncodingWrapper struct {
-	Type string `json:"type"`
-	Data any    `json:"data"`
+	Type       string `json:"type"`
+	Identifier string `json:"identifier,omitempty"`
+	Data       any    `json:"data"`
 }
 
 func (e EncodingWrapper) EncodeAndEncrypt(encryptor EncryptionImpl) string {

internal/models/session.go

@@ -25,15 +25,20 @@ type Session struct {
 	Expiry       time.Time `json:"expiry"`
 }
 
+type ExportableSession struct {
+	*Session
+	Provider string `json:"provider"`
+}
+
 // Encode the remote session from the local session
-func (s *Session) GetEncodedSession(encryptor EncryptionImpl) string {
+func (s *ExportableSession) GetEncodedSession(encryptor EncryptionImpl) string {
 	return EncodingWrapper{
 		Type: ENCODED_SESSION,
 		Data: s,
 	}.EncodeAndEncrypt(encryptor)
 }
 
-func (s *Session) ToLocalSession(encryptor EncryptionImpl) *LocalSession {
+func (s *ExportableSession) ToLocalSession(encryptor EncryptionImpl) *LocalSession {
 	return &LocalSession{
 		Version: 1,
 		Expiry:  s.Expiry,
@@ -42,7 +47,7 @@ func (s *Session) ToLocalSession(encryptor EncryptionImpl) *LocalSession {
 }
 
 // Decode the remote session from the local session
-func (s *LocalSession) GetDecodedSession(decryptor EncryptionImpl) (*Session, error) {
+func (s *LocalSession) GetDecodedSession(decryptor EncryptionImpl) (*ExportableSession, error) {
 	decoded, err := EncodingWrapper{}.DecodeAndDecrypt(s.Session, decryptor)
 
 	if err != nil {
@@ -53,7 +58,7 @@ func (s *LocalSession) GetDecodedSession(decryptor EncryptionImpl) (*Session, er
 		return nil, fmt.Errorf("invalid session type: %s", decoded.Type)
 	}
 
-	var session *Session
+	var session *ExportableSession
 	common.ConvertMapToInterface(decoded.Data.(map[string]any), &session)
 
 	return session, nil

internal/models/user.go

@@ -11,7 +11,7 @@ type User struct {
 	Email    string   `json:"email"`
 	Name     string   `json:"name"`
 	Verified *bool    `json:"verified,omitempty"`
-	Provider string   `json:"provider"`
+	Source   string   `json:"source,omitempty"`
 	Groups   []string `json:"groups,omitempty"`
 }
 

internal/providers/github/sessions.go

@@ -28,10 +28,10 @@ func (p *githubProvider) CreateSession(ctx context.Context, authRequest *models.
 	session := &models.Session{
 		UUID: uuid.New(),
 		User: &models.User{
-			ID:       fmt.Sprintf("%d", user.ID),
-			Email:    user.Email,
-			Name:     user.Name,
-			Provider: ProviderName,
+			ID:     fmt.Sprintf("%d", user.ID),
+			Email:  user.Email,
+			Name:   user.Name,
+			Source: ProviderName,
 		},
 		AccessToken: accessToken,
 		Expiry:      time.Now().Add(24 * time.Hour), // GitHub tokens don't expire, but we set session expiry

internal/providers/oauth2.google/main.go

@@ -113,7 +113,7 @@ func (p *oauth2Provider) CreateSession(ctx context.Context, authRequest *models.
 	}
 
 	// Use a new context with a secure http client
-	secureContext := context.WithValue(context.TODO(), oauth2.HTTPClient, &http.Client{
+	secureContext := context.WithValue(ctx, oauth2.HTTPClient, &http.Client{
 		Transport: &http.Transport{
 			TLSClientConfig: &tls.Config{
 				InsecureSkipVerify: false, // Ensure this is false for production
@@ -146,7 +146,7 @@ func (p *oauth2Provider) CreateSession(ctx context.Context, authRequest *models.
 			Email:    userInfo.Email,
 			Name:     userInfo.Name,
 			Verified: userInfo.VerifiedEmail,
-			Provider: "google",
+			Source:   "google",
 		},
 		AccessToken:  token.AccessToken,
 		RefreshToken: token.RefreshToken,

internal/providers/saml/main.go

@@ -133,7 +133,7 @@ func (p *samlProvider) CreateSession(ctx context.Context, authRequest *models.Au
 	user := &models.User{
 		Username: "saml_user",        // Extract from SAML assertion
 		Email:    "user@example.com", // Extract from SAML assertion
-		Provider: "saml",
+		Source:   "saml",
 		Groups:   []string{}, // Extract groups from SAML assertion
 	}