mirror of
https://github.com/Tria-plc/edr-platform.git
synced 2026-08-27 07:22:53 +00:00
3a69b961d4
Namespaces the OAuth landing path in all three places it exists: the API's
ack controller, both web apps' routes, and the redirect_uri env values.
A bare /callback claimed a generic top-level path in every app for one
provider's redirect.
The API side needed care. The ack controller moves to @Controller
('fayda/callback'), and the global-prefix exclusion has to name that exact
path — setGlobalPrefix's exclude is an exact route match, not a subtree, so
excluding "fayda" would have left /fayda/callback served at
/api/fayda/callback and 404ing at the registered redirect_uri, while
reading as though it covered everything under /fayda. Naming the full path
also keeps /api/fayda/verification/* prefixed, which every client calls.
Also drops a stale comment on the portal's callback route describing the
popup that no longer exists, and records why the route is public: behind
RequireAuth the onboarding gate redirects to /portal before the code+state
exchange can run.
NOT verified at runtime — this changes route registration, so boot the API
and confirm GET /fayda/callback answers un-prefixed and
/api/fayda/verification/start still resolves before relying on it.
Deploying this requires registering the new redirect_uri with eSignet
first; FAYDA_WEB_REDIRECT_URI, FAYDA_PORTAL_REDIRECT_URI and any mobile
client must be updated in step or verification breaks with a redirect_uri
mismatch.
36 lines
1.5 KiB
TypeScript
36 lines
1.5 KiB
TypeScript
import { Controller, Get, Query } from '@nestjs/common';
|
|
import { ApiOkResponse, ApiOperation, ApiTags } from '@nestjs/swagger';
|
|
import { IsPublic } from '@tria-plc/api-common/modules/auth/decorators/public.decorator';
|
|
import { VerifaydaCallbackDto } from './verifayda.dto';
|
|
|
|
/**
|
|
* Plain acknowledgement endpoint for the Fayda redirect_uri when it points at
|
|
* the API instead of the web app (e.g. MOBILE clients or connectivity checks).
|
|
* Registered at /fayda/callback (excluded by exact path from the global /api
|
|
* prefix in main.ts — the exclusion must NOT be widened to "fayda", or
|
|
* /api/fayda/verification/* loses its prefix too).
|
|
* It does NOT consume the verification session — the client must still call
|
|
* GET /api/fayda/verification/complete with the echoed code+state.
|
|
*/
|
|
@ApiTags('Fayda Verification')
|
|
@Controller('fayda/callback')
|
|
export class FaydaCallbackController {
|
|
@Get()
|
|
@IsPublic()
|
|
@ApiOperation({ summary: 'Acknowledge a Fayda redirect (returns OK, echoes code/state)' })
|
|
@ApiOkResponse({
|
|
schema: { example: { status: 'ok', code: '...', state: '...' } },
|
|
})
|
|
ok(@Query() query: VerifaydaCallbackDto) {
|
|
return {
|
|
status: 'ok',
|
|
...(query.code ? { code: query.code } : {}),
|
|
...(query.state ? { state: query.state } : {}),
|
|
...(query.error ? { error: query.error } : {}),
|
|
...(query.error_description ? { error_description: query.error_description } : {}),
|
|
};
|
|
}
|
|
}
|
|
|
|
// return res.redirect(url.toString());
|