ARCG/ARCG-Remote-Station-Software
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

honor requested auth method instead of silently falling back

Browse Source 
Return auth.method_unavailable when a user requests an auth method that is not enabled for their account, rather than silently sending the smtp-link challenge. Also log requested/selected method details in auth.request_access audit entries for easier diagnostics.
This commit is contained in:
OE6DXD
2026-03-16 12:35:08 +01:00
parent ebeb18bb99
commit 6342b40369
1 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
server/index.js
View File

@@ -958,6 +958,9 @@ async function handleRequestAccess(req, res, body) {
} }
const selectedMethod = resolveAuthMethodForUser(user, requestedMethod); const selectedMethod = resolveAuthMethodForUser(user, requestedMethod);
if (requestedMethod && !selectedMethod) {
return sendError(res, 400, "auth.method_unavailable", "Gewaehlte Bestaetigungsart ist fuer dieses Konto nicht verfuegbar");
}
if (!selectedMethod) { if (!selectedMethod) {
const token = await issueEmailToken(user.id, user.status === "active" ? "login" : "verify"); const token = await issueEmailToken(user.id, user.status === "active" ? "login" : "verify");
const actionPath = user.status === "active" ? "/login?loginToken=" : "/login?verifyToken="; const actionPath = user.status === "active" ? "/login?loginToken=" : "/login?verifyToken=";
@@ -978,7 +981,11 @@ async function handleRequestAccess(req, res, body) {
message.text, message.text,
message.html message.html
); );
await appendAudit("auth.request_access", user, { status: user.status, method: "fallback-mail" }); await appendAudit("auth.request_access", user, {
status: user.status,
requestedMethod: requestedMethod || null,
method: "fallback-mail"
});
return sendJson(res, 200, { return sendJson(res, 200, {
ok: true, ok: true,
method: "smtp-link", method: "smtp-link",
@@ -1039,7 +1046,12 @@ async function handleRequestAccess(req, res, body) {
return sendError(res, 400, "auth.method_invalid", "Unbekannte Bestaetigungsart"); return sendError(res, 400, "auth.method_invalid", "Unbekannte Bestaetigungsart");
} }
await appendAudit("auth.request_access", user, { status: user.status }); await appendAudit("auth.request_access", user, {
status: user.status,
requestedMethod: requestedMethod || null,
method: selectedMethod.id,
challengeType
});
return sendJson(res, 200, { return sendJson(res, 200, {
ok: true, ok: true,
method: selectedMethod.id, method: selectedMethod.id,