seewe/sub2api
1
0
Fork 0
mirror of https://github.com/Wei-Shaw/sub2api.git synced 2026-10-15 23:22:59 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(grok): tighten OAuth SSO flow and hide password login

Browse Source 
Require oauth state/redirect consistency, fail closed on missing proxy,
and remove password login from create/reauth UI (admin-only password path stays off by default).
This commit is contained in:
IanShaw027
2026-08-08 01:07:19 +08:00
parent d0767eab9d
commit 6d632eec45
13 changed files with 153 additions and 121 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/internal/handler/admin/grok_oauth_handler.go
+8 -2
View File
@@ -128,9 +128,15 @@ func (h *GrokOAuthHandler) RefreshToken(c *gin.Context) {
var proxyURL string
if req.ProxyID != nil {
proxy, err := h.adminService.GetProxy(c.Request.Context(), *req.ProxyID)
if err == nil && proxy != nil {
proxyURL = proxy.URL()
if err != nil {
response.ErrorFrom(c, err)
return
}
if proxy == nil {
response.BadRequest(c, "GROK_OAUTH_PROXY_NOT_FOUND: proxy not found")
return
}
proxyURL = proxy.URL()
}
tokenInfo, err := h.grokOAuthService.RefreshToken(c.Request.Context(), refreshToken, proxyURL, req.ClientID)
if err != nil {
backend/internal/handler/admin/grok_oauth_handler_test.go
-3
View File
@@ -263,11 +263,8 @@ func TestGrokOAuthHandlerAuthorizePasswordReturnsTokenInfoWithoutPassword(t *tes
router.ServeHTTP(rec, req)
require.Equal(t, http.StatusOK, rec.Code)
require.Contains(t, rec.Body.String(), `"email":"user@example.com"`)
require.Contains(t, rec.Body.String(), `"access_token":"access-token"`)
require.NotContains(t, rec.Body.String(), `"sso_token"`)
require.NotContains(t, rec.Body.String(), "super-secret")
require.NotContains(t, rec.Body.String(), "sso-from-password")
}
func TestGrokOAuthHandlerPasswordCapabilityDefaultsToDisabled(t *testing.T) {