Something went wrong. Try again.
a pds written in elixir tempest.desertthunder.dev
Something went wrong. Try again.
4.8 kB · 137 lines
Elixir
at main
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138defmodule TempestWeb.AdminSessionController do use TempestWeb, :controller
alias Tempest.AdminAuth
def new(conn, params) do render_login(conn, params, nil) end
def create(conn, %{"admin" => admin_params} = params) do case AdminAuth.auth_method() do {:ok, %{method: :local_account}} -> create_local_session(conn, admin_params, params)
{:ok, %{method: :oauth}} -> create_external_oauth_session(conn, admin_params, params)
{:error, reason} -> conn |> put_status(:service_unavailable) |> render_login(params, login_error(reason)) end end
def create(conn, params), do: create(conn, Map.put(params, "admin", %{}))
def delete(conn, params) do AdminAuth.revoke_browser_session( get_session(conn, :admin_session_id), get_session(conn, :admin_session_family_id), get_session(conn, :admin_did) )
conn |> renew_session() |> redirect(to: safe_return_to(return_to(params), ~p"/")) end
defp create_local_session(conn, admin_params, params) do identifier = Map.get(admin_params, "identifier", "") password = Map.get(admin_params, "password", "") return_to = return_to(params)
case AdminAuth.create_local_browser_session(identifier, password) do {:ok, admin_session} -> conn |> renew_session() |> put_session(:account_session_id, admin_session.session.id) |> put_session(:account_session_family_id, admin_session.family_id) |> put_session(:account_did, admin_session.did) |> put_session(:admin_session_id, admin_session.session.id) |> put_session(:admin_session_family_id, admin_session.family_id) |> put_session(:admin_did, admin_session.did) |> redirect(to: safe_return_to(return_to, ~p"/admin"))
{:error, reason} -> conn |> put_status(:unauthorized) |> render_login(params, login_error(reason)) end end
defp create_external_oauth_session(conn, admin_params, params) do access_token = Map.get(admin_params, "access_token", "") return_to = return_to(params)
case AdminAuth.create_external_oauth_browser_session(access_token) do {:ok, admin_session} -> conn |> renew_session() |> put_session(:admin_session_id, admin_session.session.id) |> put_session(:admin_session_family_id, admin_session.family_id) |> put_session(:admin_did, admin_session.did) |> redirect(to: safe_return_to(return_to, ~p"/admin"))
{:error, reason} -> conn |> put_status(:unauthorized) |> render_login(params, login_error(reason)) end end
defp render_login(conn, params, error) do auth_method = case AdminAuth.auth_method() do {:ok, info} -> info.method {:error, reason} -> reason end
render(conn, :new, form: Phoenix.Component.to_form(%{}, as: :admin), return_to: safe_return_to(return_to(params), ~p"/"), error: error, auth_method: auth_method, admin_did: configured_admin_did() ) end
defp configured_admin_did do case AdminAuth.configured_did() do {:ok, did} -> did {:error, _reason} -> nil end end
defp return_to(params), do: Map.get(params, "return_to")
defp safe_return_to(path, fallback) when is_binary(path) do cond do path == "" -> fallback String.starts_with?(path, "//") -> fallback String.contains?(path, ["\r", "\n"]) -> fallback String.starts_with?(path, "/") -> path true -> fallback end end
defp safe_return_to(_path, fallback), do: fallback
defp login_error(:admin_did_not_configured), do: "TEMPEST_ADMIN_DID is not configured." defp login_error(:admin_did_not_found), do: "The configured admin DID could not be resolved." defp login_error(:not_admin_account), do: "This account is not the configured admin DID." defp login_error(:inactive_account), do: "This account is not active." defp login_error(:missing_oauth_token), do: "OAuth access token is required for this external admin DID." defp login_error(:invalid_oauth_token), do: "OAuth access token is invalid for this admin DID." defp login_error(:pds_not_found), do: "The configured admin DID does not advertise an AT Protocol PDS." defp login_error(:oauth_metadata_not_found), do: "Admin OAuth metadata could not be discovered." defp login_error(:oauth_introspection_failed), do: "Admin OAuth token introspection failed." defp login_error(:rate_limited), do: "Too many attempts. Try again later." defp login_error(_reason), do: "The username or password is incorrect."
defp renew_session(conn) do conn |> configure_session(renew: true) |> clear_session() endend