lendry/IdP
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix and update

Browse Source
This commit is contained in:
lendry
2026-06-30 09:11:55 +03:00
parent f1d6a5167f
commit 250976ca08
5 changed files with 94 additions and 142 deletions
Download Patch File Download Diff File Expand all files Collapse all files

137
apps/frontend/app/auth/oauth/authorize/page.tsx
View File

@@ -11,15 +11,10 @@ import { Button } from '@/components/ui/button';
import {
approveOAuthAuthorization,
checkOAuthConsent,
fetchAuthSession,
fetchOAuthClientPublicInfo,
type OAuthConsentCheckResponse
} from '@/lib/api';
import {
parseAuthorizationRedirect,
parsePopupOAuthParams,
postOneTapResult
} from '@/lib/oauth-popup-bridge';
import { deliverOAuthPopupResult, parsePopupOAuthParams, postOneTapResult } from '@/lib/oauth-popup-bridge';
function buildOAuthQuery(searchParams: URLSearchParams) {
const params = new URLSearchParams();
@@ -37,7 +32,6 @@ function OAuthAuthorizeContent() {
const [submitting, setSubmitting] = useState(false);
const [checkingConsent, setCheckingConsent] = useState(false);
const [error, setError] = useState<string | null>(null);
const [sessionChecked, setSessionChecked] = useState(false);
const [consentInfo, setConsentInfo] = useState<OAuthConsentCheckResponse | null>(null);
const [clientName, setClientName] = useState<string | null>(null);
const autoApproveStartedRef = useRef(false);
@@ -55,20 +49,26 @@ function OAuthAuthorizeContent() {
const clientLabel = clientName ?? consentInfo?.client?.name ?? 'Приложение';
useEffect(() => {
if (!clientId || isLoading) return;
let cancelled = false;
void fetchOAuthClientPublicInfo(clientId)
.then((info) => {
if (!cancelled && info.name.trim()) {
setClientName(info.name.trim());
}
})
.catch(() => undefined);
return () => {
cancelled = true;
};
}, [clientId, isLoading]);
const approve = useCallback(async () => {
if (!token || !user || isPinLocked) return;
setSubmitting(true);
setError(null);
try {
const data = await approveOAuthAuthorization(oauthQuery, token);
if (!data.redirectUrl) {
throw new Error('Сервер не вернул redirect URL');
}
if (deliverOAuthPopupResult(popupContext, data.redirectUrl) === 'popup') {
return;
}
window.location.href = data.redirectUrl;
} catch (err) {
setError(err instanceof Error ? err.message : 'Ошибка OAuth авторизации');
autoApproveStartedRef.current = false;
} finally {
setSubmitting(false);
}
}, [isPinLocked, oauthQuery, popupContext, token, user]);
useEffect(() => {
if (!searchParams.has('userId')) return;
@@ -84,72 +84,24 @@ function OAuthAuthorizeContent() {
}, [clientId, isLoading, isPinLocked, redirectUri, returnUrl, router, token, user]);
useEffect(() => {
if (isLoading || isPinLocked || !token || !user) {
setSessionChecked(false);
return;
}
let cancelled = false;
void fetchAuthSession(token)
.then(() => {
if (!cancelled) setSessionChecked(true);
})
.catch(() => {
if (!cancelled) {
setSessionChecked(false);
router.replace(`/auth/login?redirect=${encodeURIComponent(returnUrl)}`);
}
});
return () => {
cancelled = true;
};
}, [isLoading, isPinLocked, returnUrl, router, token, user]);
const finishPopupFlow = useCallback(
(redirectUrl: string) => {
if (!popupContext) return false;
const parsed = parseAuthorizationRedirect(redirectUrl);
postOneTapResult(popupContext.popupOrigin, {
code: parsed.code ?? undefined,
state: parsed.state ?? undefined,
token: parsed.code ?? undefined,
error: parsed.error ?? undefined,
errorDescription: parsed.errorDescription ?? undefined
});
return true;
},
[popupContext]
);
const approve = useCallback(async () => {
if (!token || !user || isPinLocked) return;
setSubmitting(true);
setError(null);
try {
const data = await approveOAuthAuthorization(oauthQuery, token);
if (!data.redirectUrl) {
throw new Error('Сервер не вернул redirect URL');
}
if (finishPopupFlow(data.redirectUrl)) {
return;
}
window.location.href = data.redirectUrl;
} catch (err) {
setError(err instanceof Error ? err.message : 'Ошибка OAuth авторизации');
autoApproveStartedRef.current = false;
} finally {
setSubmitting(false);
}
}, [finishPopupFlow, isPinLocked, oauthQuery, token, user]);
useEffect(() => {
if (!token || !clientId || !sessionChecked || isPinLocked) return;
if (isLoading || !token || !clientId || isPinLocked) return;
let cancelled = false;
setCheckingConsent(true);
void checkOAuthConsent(oauthQuery, token)
.then((result) => {
setError(null);
void (async () => {
try {
try {
const info = await fetchOAuthClientPublicInfo(clientId);
if (!cancelled && info.name.trim()) {
setClientName(info.name.trim());
}
} catch {
// название приложения необязательно для consent
}
const result = await checkOAuthConsent(oauthQuery, token);
if (cancelled) return;
setConsentInfo(result);
if (result.client?.name?.trim()) {
@@ -159,28 +111,27 @@ function OAuthAuthorizeContent() {
autoApproveStartedRef.current = true;
void approve();
}
})
.catch((err) => {
} catch (err) {
if (!cancelled) {
setError(err instanceof Error ? err.message : 'Не удалось проверить согласие');
}
})
.finally(() => {
} finally {
if (!cancelled) setCheckingConsent(false);
});
}
})();
return () => {
cancelled = true;
};
}, [approve, clientId, isPinLocked, oauthQuery, sessionChecked, token]);
}, [approve, clientId, isLoading, isPinLocked, oauthQuery, token]);
const cancel = useCallback(() => {
if (popupContext) {
postOneTapResult(popupContext.popupOrigin, {
const delivered = postOneTapResult(popupContext.popupOrigin, {
error: 'access_denied',
errorDescription: 'Пользователь отклонил запрос'
});
return;
if (delivered) return;
}
if (!redirectUri) {
@@ -198,7 +149,7 @@ function OAuthAuthorizeContent() {
}
}, [popupContext, redirectUri, router, state]);
const authReady = Boolean(user && token && !isPinLocked && sessionChecked);
const authReady = Boolean(user && token && !isPinLocked && !isLoading);
const scopeItems = consentInfo?.requestedScopes ?? [];
if (isLoading || (clientId && redirectUri && !authReady && !isPinLocked)) {

46
apps/frontend/lib/api.ts
View File

@@ -567,6 +567,7 @@ let fedcmSyncInFlight = false;
/** Откладывает FedCM sync после OAuth/bootstrap, чтобы не конкурировать с consent/session. */
export function scheduleFedcmSessionSync(accessToken?: string | null, delayMs = 1500) {
if (typeof window === 'undefined') return;
if (window.location.pathname.startsWith('/auth/oauth/authorize')) return;
if (fedcmSyncTimer) {
clearTimeout(fedcmSyncTimer);
}
@@ -676,12 +677,9 @@ export function buildSystemSettingPayload(setting: Pick<SystemSetting, 'key' | '
}
const GATEWAY_RETRY_STATUS = new Set([502, 503, 504]);
const GATEWAY_RETRY_ATTEMPTS = 6;
const GATEWAY_WARMUP_INITIAL_DELAY_MS = 500;
const GATEWAY_WARMUP_DELAY_MS = 450;
const GATEWAY_READY_CONSECUTIVE_OK = 1;
const GATEWAY_WARMUP_MAX_DELAY_MS = 2200;
const GATEWAY_WARMUP_MAX_TOTAL_MS = 90_000;
const GATEWAY_RETRY_ATTEMPTS = 2;
const GATEWAY_PROBE_MAX_ATTEMPTS = 4;
const GATEWAY_PROBE_DELAY_MS = 600;
function sleep(ms: number): Promise<void> {
return new Promise((resolve) => setTimeout(resolve, ms));
@@ -722,30 +720,18 @@ async function probeGatewayAlive(): Promise<boolean> {
}
async function waitForGatewayAlive(): Promise<void> {
await sleep(GATEWAY_WARMUP_INITIAL_DELAY_MS);
const deadline = Date.now() + GATEWAY_WARMUP_MAX_TOTAL_MS;
let consecutiveOk = 0;
let attempt = 0;
while (Date.now() < deadline) {
for (let attempt = 0; attempt < GATEWAY_PROBE_MAX_ATTEMPTS; attempt += 1) {
if (await probeGatewayAlive()) {
consecutiveOk += 1;
if (consecutiveOk >= GATEWAY_READY_CONSECUTIVE_OK) {
gatewayReadyResolved = true;
return;
}
} else {
consecutiveOk = 0;
gatewayReadyResolved = true;
return;
}
if (attempt + 1 < GATEWAY_PROBE_MAX_ATTEMPTS) {
await sleep(GATEWAY_PROBE_DELAY_MS * (attempt + 1));
}
attempt += 1;
const delay = Math.min(GATEWAY_WARMUP_DELAY_MS * 1.28 ** attempt, GATEWAY_WARMUP_MAX_DELAY_MS);
await sleep(delay);
}
gatewayReadyResolved = true;
}
/** Один общий прогрев перед API: без сброса promise и без десятков параллельных проб /health/ready. */
/** Один общий прогрев: до 4 проб /health, без бесконечного цикла. */
export async function ensureApiGatewayReady(force = false): Promise<void> {
if (typeof window === 'undefined') return;
if (gatewayReadyResolved && !force) return;
@@ -763,7 +749,7 @@ export async function ensureApiGatewayReady(force = false): Promise<void> {
}
function gatewayRetryDelay(attempt: number): number {
return Math.min(500 * (attempt + 1), 2800);
return 700 + attempt * 400;
}
/** Повтор при кратковременном 502/503/504 (nginx не достучался до api-gateway после перезапуска). */
@@ -793,7 +779,7 @@ async function fetchWithGatewayRetry(url: string, init: RequestInit): Promise<Re
}
export async function apiFetch<T>(path: string, options: RequestInit = {}, token?: string | null, allowRetry = true): Promise<T> {
if (typeof window !== 'undefined' && !path.startsWith('/health')) {
if (typeof window !== 'undefined' && !gatewayReadyResolved && !path.startsWith('/health')) {
await ensureApiGatewayReady();
}
@@ -839,12 +825,6 @@ export async function apiFetch<T>(path: string, options: RequestInit = {}, token
}
}
if (allowRetry && isGatewayUnavailableError(error)) {
invalidateApiGatewayReady();
await sleep(900);
return apiFetch<T>(path, options, token, false);
}
throw error;
}

34
apps/frontend/lib/oauth-popup-bridge.ts
View File

@@ -14,14 +14,38 @@ export function parsePopupOAuthParams(searchParams: URLSearchParams) {
}
}
export function postOneTapResult(popupOrigin: string, payload: Record<string, unknown>) {
if (!window.opener) {
export function postOneTapResult(popupOrigin: string, payload: Record<string, unknown>): boolean {
if (!window.opener || window.opener.closed) {
return false;
}
window.opener.postMessage({ type: ONE_TAP_MESSAGE_TYPE, ...payload }, popupOrigin);
window.close();
return true;
try {
window.opener.postMessage({ type: ONE_TAP_MESSAGE_TYPE, ...payload }, popupOrigin);
window.close();
return true;
} catch {
return false;
}
}
export function deliverOAuthPopupResult(
popupContext: { popupOrigin: string } | null,
redirectUrl: string
): 'popup' | 'redirect' {
if (!popupContext) {
return 'redirect';
}
const parsed = parseAuthorizationRedirect(redirectUrl);
const delivered = postOneTapResult(popupContext.popupOrigin, {
code: parsed.code ?? undefined,
state: parsed.state ?? undefined,
token: parsed.code ?? undefined,
error: parsed.error ?? undefined,
errorDescription: parsed.errorDescription ?? undefined
});
return delivered ? 'popup' : 'redirect';
}
export function parseAuthorizationRedirect(redirectUrl: string) {

4
apps/frontend/public/sso-widget.js
View File

@@ -339,6 +339,7 @@
var height = 640;
var left = Math.max(0, Math.round((global.screen.width - width) / 2));
var top = Math.max(0, Math.round((global.screen.height - height) / 2));
// Без noopener/noreferrer: popup должен видеть window.opener для postMessage после «Разрешить».
var features =
'popup=yes,width=' +
width +
@@ -347,8 +348,7 @@
',left=' +
left +
',top=' +
top +
',noopener,noreferrer';
top;
var popup = global.open(url, 'lendry_sso_onetap', features);
if (!popup) {

15
install.sh
View File

@@ -1942,10 +1942,7 @@ nginx_proxy_headers=" proxy_set_header Host \$host;
proxy_set_header X-Forwarded-Host \$host;
proxy_set_header Authorization \$http_authorization;
proxy_read_timeout 300s;
proxy_connect_timeout 75s;
proxy_next_upstream error timeout invalid_header http_502 http_503 http_504;
proxy_next_upstream_tries 2;
proxy_next_upstream_timeout 10s;"
proxy_connect_timeout 75s;"
# Встроенный DNS Docker. В docker-режиме nginx обязан перерезолвлять имена
# бэкенд-контейнеров на каждый запрос — иначе после пересборки контейнера
@@ -1986,16 +1983,16 @@ render_proxy_rewrite() {
fi
}
# proxy_pass для /idp-api/ — named capture надёжнее rewrite+break с переменной upstream.
# proxy_pass для /idp-api/ — prefix ^~ выше regex; rewrite снимает префикс перед api-gateway.
render_proxy_idp_api() {
local key="api" up var
up="$(nginx_upstream "$key")"
if [[ "$NGINX_MODE" == "docker" ]]; then
var="$(nginx_upstream_var "$key")"
printf '%s\n set $%s %s;\n proxy_pass $%s/$api_path$is_args$args;' \
printf '%s\n set $%s %s;\n rewrite ^/idp-api/?(.*)$ /$1 break;\n proxy_pass $%s;' \
"$NGINX_DOCKER_RESOLVER" "$var" "$up" "$var"
else
printf ' proxy_pass %s/$api_path$is_args$args;' "$up"
printf ' rewrite ^/idp-api/?(.*)$ /$1 break;\n proxy_pass %s;' "$up"
fi
}
@@ -2190,7 +2187,7 @@ ${proxy_ws}
proxy_connect_timeout 75s;
}
location ~ ^/idp-api/(?<api_path>.*)$ {
location ^~ /idp-api/ {
${proxy_idp}
proxy_http_version 1.1;
${nginx_proxy_headers}
@@ -2501,7 +2498,7 @@ validate_docker_frontend_nginx_config() {
local conf="${LOCAL_CONF_DIR}/${NGINX_PREFIX}-frontend.conf"
[[ -f "$conf" ]] || fail "Не найден ${conf} — конфиг SSO-домена не записан"
if ! grep -q 'location.*idp-api' "$conf" 2>/dev/null; then
if ! grep -q 'location \^~ /idp-api/' "$conf" 2>/dev/null && ! grep -q 'location.*idp-api' "$conf" 2>/dev/null; then
fail "Конфиг ${conf} без location /idp-api — браузер SPA получит 502. Выполните ./install.sh --fix-all"
fi
if ! grep -q 'resolver 127.0.0.11' "$conf" 2>/dev/null; then