Bind share link sessions to the token's own resource

server/routers/badger/exchangeSession.ts

@@ -164,6 +164,14 @@ export async function exchangeSession(
                 )
                 .limit(1);
             if (res) {
+                if (res.resourceId !== resource.resourceId) {
+                    return next(
+                        createHttpError(
+                            HttpCode.UNAUTHORIZED,
+                            "Invalid request token"
+                        )
+                    );
+                }
                 await createResourceSession({
                     token,
                     resourceId: resource.resourceId,

server/routers/badger/verifySession.ts

@@ -821,10 +821,6 @@ export async function verifyResourceSession(
                 }
 
                 if (resourceSession.accessTokenId) {
-                    logger.debug(
-                        "Resource allowed because access token session is valid"
-                    );
-
                     const [tokenItem] = await db
                         .select()
                         .from(resourceAccessToken)
@@ -836,12 +832,18 @@ export async function verifyResourceSession(
                         )
                         .limit(1);
 
-                    const userData = tokenItem
+                    if (
-                        ? await getAccessTokenUserData(
+                        tokenItem &&
+                        tokenItem.resourceId === resource.resourceId
+                    ) {
+                        logger.debug(
+                            "Resource allowed because access token session is valid"
+                        );
+
+                        const userData = await getAccessTokenUserData(
                             tokenItem,
                             resource.orgId
-                          )
+                        );
-                        : undefined;
 
                         logAccessTokenRequestAudit(
                             {
@@ -849,7 +851,7 @@ export async function verifyResourceSession(
                                 orgId: resource.orgId,
                                 location: ipCC,
                                 accessTokenId: resourceSession.accessTokenId,
-                            tokenTitle: tokenItem?.title ?? null,
+                                tokenTitle: tokenItem.title ?? null,
                                 userData
                             },
                             parsedBody.data
@@ -858,6 +860,11 @@ export async function verifyResourceSession(
                         return allowed(res, userData, dontStripSession);
                     }
 
+                    logger.debug(
+                        "Access token session does not belong to this resource"
+                    );
+                }
+
                 if (resourceSession.userSessionId && sso) {
                     const userAccessCacheKey = `userAccess:${
                         resourceSession.userSessionId

server/routers/resource/authWithAccessToken.ts

@@ -1,6 +1,5 @@
 import { generateSessionToken } from "@server/auth/sessions/app";
-import { db } from "@server/db";
+import { db, users } from "@server/db";
-import { Resource, resources, users } from "@server/db";
 import HttpCode from "@server/types/HttpCode";
 import response from "@server/lib/response";
 import { eq } from "drizzle-orm";
@@ -65,63 +64,15 @@ export async function authWithAccessToken(
     const { accessToken, accessTokenId } = parsedBody.data;
 
     try {
-        let valid;
+        const { valid, tokenItem, error, resource } =
-        let tokenItem;
+            await verifyResourceAccessToken({
-        let error;
+                accessToken,
-        let resource: Resource | undefined;
-
-        if (accessTokenId) {
-            if (!resourceId) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Resource ID is required"
-                    )
-                );
-            }
-
-            const [foundResource] = await db
-                .select()
-                .from(resources)
-                .where(eq(resources.resourceId, resourceId))
-                .limit(1);
-
-            if (!foundResource) {
-                return next(
-                    createHttpError(HttpCode.NOT_FOUND, "Resource not found")
-                );
-            }
-
-            const res = await verifyResourceAccessToken({
                 accessTokenId,
-                accessToken
+                resourceId
             });
 
-            valid = res.valid;
+        if (!valid || !tokenItem || !resource) {
-            tokenItem = res.tokenItem;
+            if (resource) {
-            error = res.error;
-            resource = foundResource;
-        } else {
-            const res = await verifyResourceAccessToken({
-                accessToken
-            });
-
-            valid = res.valid;
-            tokenItem = res.tokenItem;
-            error = res.error;
-            resource = res.resource;
-        }
-
-        if (!tokenItem || !resource) {
-            return next(
-                createHttpError(
-                    HttpCode.UNAUTHORIZED,
-                    "Access token does not exist for resource"
-                )
-            );
-        }
-
-        if (!valid) {
                 if (config.getRawConfig().app.log_failed_attempts) {
                     logger.info(
                         `Resource access token invalid. Resource ID: ${resource.resourceId}. IP: ${req.ip}.`
@@ -136,11 +87,12 @@ export async function authWithAccessToken(
                     userAgent: req.headers["user-agent"],
                     requestIp: req.ip
                 });
+            }
 
             return next(
                 createHttpError(
                     HttpCode.UNAUTHORIZED,
-                    error || "Invalid access token"
+                    error || "Access token does not exist for resource"
                 )
             );
         }

src/app/auth/resource/[resourceGuid]/page.tsx

@@ -248,10 +248,7 @@ export default async function ResourceAuthPage(props: {
     if (searchParams.token) {
         return (
             <div className="w-full max-w-md">
-                <AccessToken
+                <AccessToken token={searchParams.token} />
-                    token={searchParams.token}
-                    resourceId={authInfo.resourceId}
-                />
             </div>
         );
     }

src/components/AccessToken.tsx

@@ -17,10 +17,9 @@ import { useTranslations } from "next-intl";
 
 type AccessTokenProps = {
     token: string;
-    resourceId?: number;
 };
 
-export default function AccessToken({ token, resourceId }: AccessTokenProps) {
+export default function AccessToken({ token }: AccessTokenProps) {
     const [loading, setLoading] = useState(true);
     const [isValid, setIsValid] = useState(false);
 
@@ -59,13 +58,13 @@ export default function AccessToken({ token, resourceId }: AccessTokenProps) {
             return;
         }
 
-        async function checkSHA256() {
+        async function check() {
             try {
                 const res = await api.post<
                     AxiosResponse<AuthWithAccessTokenResponse>
                 >(`/auth/access-token`, {
                     accessToken,
-                    accessTokenId
+                    accessTokenId: accessTokenId || undefined
                 });
 
                 if (res.data.data.session) {
@@ -82,35 +81,7 @@ export default function AccessToken({ token, resourceId }: AccessTokenProps) {
             }
         }
 
-        async function check() {
-            try {
-                const res = await api.post<
-                    AxiosResponse<AuthWithAccessTokenResponse>
-                >(`/auth/resource/${resourceId}/access-token`, {
-                    accessToken,
-                    accessTokenId
-                });
-
-                if (res.data.data.session) {
-                    setIsValid(true);
-                    window.location.href = appendRequestToken(
-                        res.data.data.redirectUrl!,
-                        res.data.data.session
-                    );
-                }
-            } catch (e) {
-                console.error(t("accessTokenError"), e);
-            } finally {
-                setLoading(false);
-            }
-        }
-
-        if (!accessTokenId) {
-            // no access token id so check the sha256
-            checkSHA256();
-        } else {
         check();
-        }
     }, [token]);
 
     function renderTitle() {