andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-09 15:45:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
* fix: add `Scopes` to `Request` interface so that scopes can be validated on all requests

* feat: assert org from scope exists when authorizing requests

* fix: check all scopes

* comments

* check org on callback creation

* fix tests

* clarifications

* fix scope marshaling

* fix: enfore organization for authrequest in initiation

* fix: filter sessions on the accounts page by organization scope

* add integration tests

---------

Co-authored-by: Livio Spring <[email protected]>
Co-authored-by: Max Peintner <[email protected]>
This commit is contained in:
Wim Van Laer
2026-03-17 12:54:27 +01:00
committed by GitHub
co-authored by Livio Spring Max Peintner
parent aa4432dc99
commit c3a6bdb0bb
21 changed files with 729 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/login/src/lib/server/flow-initiation.ts
+2 -2
View File
@@ -268,7 +268,7 @@ export async function handleOIDCFlowInitiation(params: FlowInitiationParams): Pr
} else if (authRequest.prompt.includes(Prompt.NONE)) {
const securitySettings = await getSecuritySettings({ serviceConfig });
const selectedSession = await findValidSession({ serviceConfig, sessions, authRequest });
const selectedSession = await findValidSession({ serviceConfig, sessions, authRequest, organization });
const noSessionResponse = NextResponse.json({ error: "No active session found" }, { status: 400 });
setCSPHeaders(noSessionResponse, serviceConfig, securitySettings);
@@ -304,7 +304,7 @@ export async function handleOIDCFlowInitiation(params: FlowInitiationParams): Pr
return callbackResponse;
} else {
let selectedSession = await findValidSession({ serviceConfig, sessions, authRequest });
let selectedSession = await findValidSession({ serviceConfig, sessions, authRequest, organization });
if (!selectedSession || !selectedSession.id) {
return gotoAccounts({
apps/login/src/lib/session.ts
+7 -1
View File
@@ -142,13 +142,15 @@ export async function findValidSession({
sessions,
authRequest,
samlRequest,
organization,
}: {
serviceConfig: ServiceConfig;
sessions: Session[];
authRequest?: AuthRequest;
samlRequest?: SAMLRequest;
organization?: string;
}): Promise<Session | undefined> {
const sessionsWithHint = sessions.filter((s) => {
let sessionsWithHint = sessions.filter((s) => {
if (authRequest && authRequest.hintUserId) {
return s.factors?.user?.id === authRequest.hintUserId;
}
@@ -163,6 +165,10 @@ export async function findValidSession({
return true;
});
if (organization) {
sessionsWithHint = sessionsWithHint.filter((s) => s.factors?.user?.organizationId === organization);
}
if (sessionsWithHint.length === 0) {
return undefined;
}