calvin.erfmann/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-08-25 13:35:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

Dont strip session

Browse Source
This commit is contained in:
Owen
2026-05-30 12:10:06 -07:00
parent 3b82ac568f
commit 0943cf5d4c
1 changed files with 33 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/routers/badger/verifySession.ts
+33 -19
View File
@@ -61,6 +61,7 @@ export type VerifyResourceSessionSchema = z.infer<
>; >;
type BasicUserData = { type BasicUserData = {
dontStripSession?: boolean;
userId: string; userId: string;
username: string; username: string;
email: string | null; email: string | null;
@@ -74,6 +75,7 @@ export type VerifyUserResponse = {
redirectUrl?: string; redirectUrl?: string;
userData?: BasicUserData; userData?: BasicUserData;
pangolinVersion?: string; pangolinVersion?: string;
dontStripSession?: boolean;
}; };
export async function verifyResourceSession( export async function verifyResourceSession(
@@ -191,7 +193,8 @@ export async function verifyResourceSession(
return notAllowed(res); return notAllowed(res);
} }
const { sso, blockAccess } = resource; const { sso, blockAccess, mode } = resource;
const dontStripSession = ["ssh", "rdp", "vnc"].includes(mode);
if (blockAccess) { if (blockAccess) {
logger.debug("Resource blocked", host); logger.debug("Resource blocked", host);
@@ -234,7 +237,7 @@ export async function verifyResourceSession(
parsedBody.data parsedBody.data
); );
return allowed(res); return allowed(res, undefined, dontStripSession);
} else if (action == "DROP") { } else if (action == "DROP") {
logger.debug("Resource denied by rule"); logger.debug("Resource denied by rule");
@@ -282,7 +285,7 @@ export async function verifyResourceSession(
parsedBody.data parsedBody.data
); );
return allowed(res); return allowed(res, undefined, dontStripSession);
} }
const redirectPath = `/auth/resource/${encodeURIComponent( const redirectPath = `/auth/resource/${encodeURIComponent(
@@ -348,7 +351,7 @@ export async function verifyResourceSession(
parsedBody.data parsedBody.data
); );
return allowed(res); return allowed(res, undefined, dontStripSession);
} }
} }
@@ -399,7 +402,7 @@ export async function verifyResourceSession(
parsedBody.data parsedBody.data
); );
return allowed(res); return allowed(res, undefined, dontStripSession);
} }
} }
@@ -422,7 +425,7 @@ export async function verifyResourceSession(
parsedBody.data parsedBody.data
); );
return allowed(res); return allowed(res, undefined, dontStripSession);
} else if ( } else if (
await verifyPassword( await verifyPassword(
clientHeaderAuth, clientHeaderAuth,
@@ -443,7 +446,7 @@ export async function verifyResourceSession(
parsedBody.data parsedBody.data
); );
return allowed(res); return allowed(res, undefined, dontStripSession);
} }
if ( if (
@@ -590,7 +593,7 @@ export async function verifyResourceSession(
parsedBody.data parsedBody.data
); );
return allowed(res); return allowed(res, undefined, dontStripSession);
} }
if (password && resourceSession.passwordId) { if (password && resourceSession.passwordId) {
@@ -609,7 +612,7 @@ export async function verifyResourceSession(
parsedBody.data parsedBody.data
); );
return allowed(res); return allowed(res, undefined, dontStripSession);
} }
if ( if (
@@ -631,7 +634,7 @@ export async function verifyResourceSession(
parsedBody.data parsedBody.data
); );
return allowed(res); return allowed(res, undefined, dontStripSession);
} }
if (resourceSession.accessTokenId) { if (resourceSession.accessTokenId) {
@@ -654,7 +657,7 @@ export async function verifyResourceSession(
parsedBody.data parsedBody.data
); );
return allowed(res); return allowed(res, undefined, dontStripSession);
} }
if (resourceSession.userSessionId && sso) { if (resourceSession.userSessionId && sso) {
@@ -699,7 +702,11 @@ export async function verifyResourceSession(
parsedBody.data parsedBody.data
); );
return allowed(res, allowedUserData); return allowed(
res,
{ ...allowedUserData, dontStripSession },
dontStripSession
);
} }
} }
} }
@@ -832,16 +839,23 @@ async function notAllowed(
message: "Access denied", message: "Access denied",
status: HttpCode.OK status: HttpCode.OK
}; };
logger.debug(JSON.stringify(data)); // logger.debug(JSON.stringify(data));
return response<VerifyUserResponse>(res, data); return response<VerifyUserResponse>(res, data);
} }
function allowed(res: Response, userData?: BasicUserData) { function allowed(
res: Response,
userData?: BasicUserData,
dontStripSession?: boolean
) {
const baseData =
userData !== undefined && userData !== null
? { valid: true, ...userData, pangolinVersion: APP_VERSION }
: { valid: true, pangolinVersion: APP_VERSION };
const data = { const data = {
data: data: dontStripSession
userData !== undefined && userData !== null ? { ...baseData, dontStripSession: true }
? { valid: true, ...userData, pangolinVersion: APP_VERSION } : baseData,
: { valid: true, pangolinVersion: APP_VERSION },
success: true, success: true,
error: false, error: false,
message: "Access allowed", message: "Access allowed",
@@ -894,7 +908,7 @@ async function headerAuthChallenged(
message: "Access denied", message: "Access denied",
status: HttpCode.OK status: HttpCode.OK
}; };
logger.debug(JSON.stringify(data)); // logger.debug(JSON.stringify(data));
return response<VerifyUserResponse>(res, data); return response<VerifyUserResponse>(res, data);
} }