core/appview/oauth/ at 013ad3128c23c598e20761746dda2c64aef6eeea · alice.pds.demo.boltless.dev/core · Tangled

alice.pds.demo.boltless.dev / core

0

This repository has no description

0

core / appview / oauth

7 files

at 013ad3128c23c598e20761746dda2c64aef6eeea

Seongmin Lee appview: don't trust `oauth.ClientSessionData` 7mo ago

appview: don't trust `oauth.ClientSessionData` `oauth.ClientSessionData.HostURL` is not validated after first session creation. If user switches the PDS while logged in, `.HostURL` will still point to old PDS, showing account management options for `tngl.sh` users. This can confuse users to accidentally put account in odd state (activated in both PDSes) Instead, always resolve Handles and PDS hosts on-demand. Technically `HostURL` is used on creating authorized atpclient, but that's ok because request to old PDS will reject the request. Ideally we should revoke user sessions on `#account` event, indigo currently doesn't support DID based revoking. Signed-off-by: Seongmin Lee <git@boltless.me>

7 months ago

accounts_test.go

appview: don't trust `oauth.ClientSessionData` `oauth.ClientSessionData.HostURL` is not validated after first session creation. If user switches the PDS while logged in, `.HostURL` will still point to old PDS, showing account management options for `tngl.sh` users. This can confuse users to accidentally put account in odd state (activated in both PDSes) Instead, always resolve Handles and PDS hosts on-demand. Technically `HostURL` is used on creating authorized atpclient, but that's ok because request to old PDS will reject the request. Ideally we should revoke user sessions on `#account` event, indigo currently doesn't support DID based revoking. Signed-off-by: Seongmin Lee <git@boltless.me>

7 months ago

fmt: * Signed-off-by: oppiliappan <me@oppi.li>

7 months ago

appview/oauth: refresh sessions in bsky post updater makes the homepage more "live". Signed-off-by: oppiliappan <me@oppi.li>

4 months ago

appview: don't trust `oauth.ClientSessionData` `oauth.ClientSessionData.HostURL` is not validated after first session creation. If user switches the PDS while logged in, `.HostURL` will still point to old PDS, showing account management options for `tngl.sh` users. This can confuse users to accidentally put account in odd state (activated in both PDSes) Instead, always resolve Handles and PDS hosts on-demand. Technically `HostURL` is used on creating authorized atpclient, but that's ok because request to old PDS will reject the request. Ideally we should revoke user sessions on `#account` event, indigo currently doesn't support DID based revoking. Signed-off-by: Seongmin Lee <git@boltless.me>

7 months ago

oauth: add granular scope request for atproto records & everything tangled-related

7 months ago

appview/oauth: invalidate sessions if inactive for too long if sessions are inactive for too long, tokens will not be refreshed, and calling authorized xrpc methods will error out with invalid_grant. this changeset does two things: - tracks the last time a session was active using a new redis pair: `oauth:session_meta:<did>:<session>`, this is updated every time `SaveSession` is called - checks for session inactivity every time `GetSession` is called, and deletes the session if so this way, `GetSession` will never return a session with expired tokens. Signed-off-by: oppiliappan <me@oppi.li>

10 months ago