mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-14 22:50:51 +00:00
Marc-André Bombeck
9eae352bb1
POST /api/auth/claim/sso checks the handover link and the username and seals the link id, the username and a per-start binding into an hl_claim cookie. GET /api/auth/oidc/login?intent=claim carries the binding into the encrypted OIDC state, and the callback binds the provider subject to the profile in the claim transaction, refusing a subject or verified email another account holds, a link that is no longer usable, and a live session. The handover status and the claim preview name the redemption methods; a single-sign-on-only server hands over through the identity provider, and only the password claim stays refused there.
19 lines
666 B
TypeScript
19 lines
666 B
TypeScript
/**
|
|
* v1.43 (#959) — claiming a managed profile through single sign-on. The
|
|
* handover token and the chosen username ride a sealed cookie into the OIDC
|
|
* round trip; the token never rides a URL.
|
|
*/
|
|
import { z } from "zod/v4";
|
|
|
|
import { accountUsernameSchema } from "@/lib/validations/auth";
|
|
|
|
export const claimSsoSchema = z.strictObject({
|
|
token: z.string().min(1).max(80),
|
|
username: accountUsernameSchema,
|
|
});
|
|
export type ClaimSsoInput = z.infer<typeof claimSsoSchema>;
|
|
|
|
/** How a handover link can be redeemed on this server. */
|
|
export const HANDOVER_METHODS = ["password", "sso"] as const;
|
|
export type HandoverMethod = (typeof HANDOVER_METHODS)[number];
|