lexton-it/NextWks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(auth): admin redirects to OIDC login when no session

Browse source
This commit is contained in:
Claus Lohmar 2026-06-15 20:15:12 +00:00
parent bcfe28b16b
commit 94258749dc
1 changed files with 21 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

41
src/main.go
View file

@ -167,27 +167,28 @@ func main() {
bearerAuth := admin.TokenAuthMiddleware(cfg.Admin.SecretToken)
adminAuth := func(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
// First, try session-based authentication
cookie, err := r.Cookie("nextwks_session")
if err == nil && cookie != nil {
session, err := sessionStore.ValidateSession(cookie.Value)
if err == nil && session != nil {
isAdmin, _ := roleChecker.IsAdmin(session.UserID)
if isAdmin {
ctx := context.WithValue(r.Context(), auth.ContextUserID, session.UserID)
ctx = context.WithValue(ctx, auth.ContextRole, "admin")
next.ServeHTTP(w, r.WithContext(ctx))
return
} else {
ctx := context.WithValue(r.Context(), auth.ContextUserID, session.UserID)
ctx = context.WithValue(ctx, auth.ContextRole, "user")
next.ServeHTTP(w, r.WithContext(ctx))
return
}
}
if token := r.Header.Get("Authorization"); token != "" {
bearerAuth(next).ServeHTTP(w, r)
return
}
// Fall back to bearer token
bearerAuth(next).ServeHTTP(w, r)
cookie, err := r.Cookie("nextwks_session")
if err != nil || cookie == nil {
oidcHandler.LoginRedirect(w, r)
return
}
session, err := sessionStore.ValidateSession(cookie.Value)
if err != nil || session == nil {
oidcHandler.LoginRedirect(w, r)
return
}
isAdmin, _ := roleChecker.IsAdmin(session.UserID)
if isAdmin {
ctx := context.WithValue(r.Context(), auth.ContextUserID, session.UserID)
ctx = context.WithValue(ctx, auth.ContextRole, "admin")
next.ServeHTTP(w, r.WithContext(ctx))
return
}
http.Error(w, "{\"error\":\"admin access required\"}", http.StatusForbidden)
})
}