Edouard Vanbelle
606 lines
24 KiB
Rust
606 lines
24 KiB
Rust
//! Magic-link redemption endpoint.
|
|
//!
|
|
//! Single public route: `GET /magic/v1/{token}`. Validating the token is
|
|
//! the entire authentication — the URL is the credential.
|
|
//!
|
|
//! Successful redemption:
|
|
//! 1. Atomically marks the token used (single-use, race-free).
|
|
//! 2. Issues access + refresh JWT for the token's owning user.
|
|
//! 3. Sets the standard `oxicloud_access` / `oxicloud_refresh` /
|
|
//! `oxicloud_csrf` cookies (same as `POST /api/auth/login`).
|
|
//! 4. 302-redirects to a SPA route based on the token's resource
|
|
//! target:
|
|
//! - Folder → `/files/{id}`
|
|
//! - File or NULL → `/shared-with-me`
|
|
//!
|
|
//! Files don't have a deep-link route today; v1 lands file invitations
|
|
//! on Shared With Me where the file shows up.
|
|
//!
|
|
//! Failure cases (all return 4xx without setting cookies):
|
|
//! - Token not found / expired / already used → 410 Gone.
|
|
//! - Magic-link feature disabled (no SMTP / repo) → 503.
|
|
//! - Owning user deactivated → 410 Gone.
|
|
//!
|
|
//! Page bodies are rendered via askama templates under
|
|
//! `templates/magic_link/`; all user-visible strings come from the
|
|
//! `server.magic_link.page.*` keys in `static/locales/`.
|
|
|
|
use std::sync::Arc;
|
|
|
|
use askama::Template;
|
|
use axum::{
|
|
Router,
|
|
extract::{Path, Query, State},
|
|
http::{
|
|
HeaderMap, HeaderValue, StatusCode,
|
|
header::{CACHE_CONTROL, CONTENT_TYPE, HeaderName, LOCATION, PRAGMA, REFERRER_POLICY},
|
|
},
|
|
response::{IntoResponse, Response},
|
|
routing::{get, post},
|
|
};
|
|
use serde::Deserialize;
|
|
use tower_http::set_header::SetResponseHeaderLayer;
|
|
|
|
use crate::application::services::auth_application_service::{
|
|
MagicLinkRedeemResult, MagicLinkRedemption,
|
|
};
|
|
use crate::common::di::AppState;
|
|
use crate::common::errors::ErrorKind;
|
|
use crate::common::locale::Locale;
|
|
use crate::domain::entities::magic_link_token::MagicLinkResourceKind;
|
|
use crate::interfaces::api::cookie_auth;
|
|
use crate::interfaces::middleware::locale::RequestLocale;
|
|
use crate::interfaces::middleware::rate_limit::extract_client_ip;
|
|
|
|
/// Build the `/magic/v1/{token}` router. Mounted at the top of the
|
|
/// application tree in `main.rs` — no auth middleware, no CSRF (the
|
|
/// token is the credential, the route is GET-only).
|
|
///
|
|
/// `POST /magic/v1/{token}/resend` is a sibling endpoint that lets the
|
|
/// 410-Gone page offer a one-click "send me a fresh link" button. The
|
|
/// recipient email is looked up server-side from the (expired/used)
|
|
/// token row — no PII in the URL — and the rate limits attached to
|
|
/// `POST /api/auth/magic-link/send` apply identically.
|
|
///
|
|
/// **Cache-Control: no-store** applies to every response from this
|
|
/// router. Magic-link responses are auth-state-sensitive in three
|
|
/// distinct ways and none of them should ever be persisted by a
|
|
/// browser or intermediate proxy:
|
|
///
|
|
/// 1. The 410 / cross-browser-confirm pages reveal *that the token
|
|
/// existed in some state*. Caching them across users of a shared
|
|
/// machine is an information leak.
|
|
/// 2. The successful-redemption 302 sets `oxicloud_access` /
|
|
/// `oxicloud_refresh` / `oxicloud_csrf` cookies. A cached redirect
|
|
/// response could replay those cookies in a wrong session context.
|
|
/// 3. The resend-confirmation page can be re-submitted; serving a
|
|
/// stale copy from cache could mask a fresh state on the server.
|
|
///
|
|
/// `Pragma: no-cache` is added alongside for HTTP/1.0-era proxies
|
|
/// that ignore `Cache-Control` — harmless on modern stacks, defensive
|
|
/// against the long tail.
|
|
///
|
|
/// **Referrer-Policy: no-referrer** overrides the global
|
|
/// `strict-origin-when-cross-origin`. The magic-link URL itself
|
|
/// contains the secret in the path; even "origin only" disclosure to
|
|
/// a third party narrows the bearer's anonymity. Today the templates
|
|
/// only carry a same-origin `<a href="/">` link, but defense-in-depth
|
|
/// closes the door against any future external reference.
|
|
///
|
|
/// **X-Robots-Tag: noindex, nofollow** so search engines never index
|
|
/// a leaked magic-link URL (e.g. one that ended up in a wiki page or
|
|
/// pastebin). Crawlers that respect the directive skip both the
|
|
/// indexing and the link-following side effect.
|
|
///
|
|
/// Global security headers (CSP / X-Frame-Options /
|
|
/// X-Content-Type-Options / Permissions-Policy) come from the
|
|
/// app-wide layer in `main.rs`; this router doesn't re-set them.
|
|
///
|
|
/// **Why no CSRF on the resend POST?** The endpoint takes no body
|
|
/// and no auth — only the token in the URL path. A cross-site form
|
|
/// submission would dispatch a magic-link mail to the *registered
|
|
/// recipient* (which the attacker has no influence over), capped by
|
|
/// the per-IP and per-target-email rate limits. There's no side
|
|
/// effect the attacker can direct anywhere they benefit from, so a
|
|
/// CSRF token would protect nothing.
|
|
pub fn magic_link_routes() -> Router<Arc<AppState>> {
|
|
Router::new()
|
|
.route("/magic/v1/{token}", get(redeem_magic_link))
|
|
.route("/magic/v1/{token}/resend", post(resend_magic_link))
|
|
.layer(SetResponseHeaderLayer::overriding(
|
|
CACHE_CONTROL,
|
|
HeaderValue::from_static("no-store, no-cache, must-revalidate, max-age=0"),
|
|
))
|
|
.layer(SetResponseHeaderLayer::overriding(
|
|
PRAGMA,
|
|
HeaderValue::from_static("no-cache"),
|
|
))
|
|
.layer(SetResponseHeaderLayer::overriding(
|
|
REFERRER_POLICY,
|
|
HeaderValue::from_static("no-referrer"),
|
|
))
|
|
.layer(SetResponseHeaderLayer::overriding(
|
|
HeaderName::from_static("x-robots-tag"),
|
|
HeaderValue::from_static("noindex, nofollow"),
|
|
))
|
|
}
|
|
|
|
#[derive(Debug, Deserialize)]
|
|
struct RedeemQuery {
|
|
/// PR 22: `?confirm=1` means the user clicked the cross-browser
|
|
/// confirmation prompt's Continue button. The service skips the
|
|
/// challenge-cookie check on this re-entry.
|
|
#[serde(default)]
|
|
confirm: Option<String>,
|
|
}
|
|
|
|
#[utoipa::path(
|
|
get,
|
|
path = "/magic/v1/{token}",
|
|
params(("token" = String, Path, description = "Opaque magic-link token")),
|
|
responses(
|
|
(status = 200, description = "Cross-browser confirmation prompt (HTML page)"),
|
|
(status = 302, description = "Redemption succeeded — redirects to the resource or to /shared-with-me"),
|
|
(status = 410, description = "Token is unknown, expired, or already used"),
|
|
(status = 503, description = "Magic-link feature is not configured on this server"),
|
|
),
|
|
tag = "magic-link",
|
|
)]
|
|
async fn redeem_magic_link(
|
|
State(state): State<Arc<AppState>>,
|
|
Path(token): Path<String>,
|
|
Query(query): Query<RedeemQuery>,
|
|
RequestLocale(locale): RequestLocale,
|
|
headers: HeaderMap,
|
|
) -> Response {
|
|
let Some(auth_svc) = state.auth_service.as_ref() else {
|
|
return service_unavailable_page(&state, &locale).await;
|
|
};
|
|
|
|
// PR 22 browser binding: read the per-request challenge from the
|
|
// cookie (set by `POST /api/auth/magic-link/send` on the originating
|
|
// browser). The service compares it to the token's stored
|
|
// challenge. `confirm=1` means the user just clicked through the
|
|
// cross-browser prompt and is fine redeeming from a different
|
|
// browser anyway.
|
|
let incoming_challenge =
|
|
cookie_auth::extract_cookie_value(&headers, cookie_auth::MAGIC_REQUEST_COOKIE);
|
|
let cross_browser_confirmed = query
|
|
.confirm
|
|
.as_deref()
|
|
.map(|v| v == "1" || v == "true")
|
|
.unwrap_or(false);
|
|
|
|
match auth_svc
|
|
.auth_application_service
|
|
.redeem_magic_link(
|
|
&token,
|
|
incoming_challenge.as_deref(),
|
|
cross_browser_confirmed,
|
|
)
|
|
.await
|
|
{
|
|
Ok(MagicLinkRedeemResult::Allowed(redemption)) => {
|
|
build_success_response(&state, *redemption)
|
|
}
|
|
Ok(MagicLinkRedeemResult::NeedsCrossBrowserConfirm) => {
|
|
cross_browser_confirmation_page(&state, &locale, &token).await
|
|
}
|
|
Err(e) => {
|
|
// Log the cause for ops; the user gets a generic page so the
|
|
// outcome can't be used as an enumeration oracle.
|
|
tracing::info!(
|
|
target: "audit",
|
|
event = "magic_link.redemption_failed",
|
|
error_kind = ?e.kind,
|
|
error = %e.message,
|
|
);
|
|
match e.kind {
|
|
ErrorKind::NotImplemented => service_unavailable_page(&state, &locale).await,
|
|
ErrorKind::NotFound | ErrorKind::AccessDenied => {
|
|
expired_or_used_page(&state, &locale, &token).await
|
|
}
|
|
_ => internal_error_page(&state, &locale).await,
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
/// `POST /magic/v1/{token}/resend` — one-click handler behind the
|
|
/// "Send a fresh link" button on the 410-Gone page.
|
|
///
|
|
/// The token in the URL serves as a *recipient-discovery key*, never as
|
|
/// a credential: the server looks up the (expired or used) row, walks
|
|
/// to the owning user, and dispatches a fresh login-via-email magic-
|
|
/// link to that user's email. The endpoint never trusts client-supplied
|
|
/// email and never echoes the resolved address back, so the resend
|
|
/// URL is safe to leave in browser history.
|
|
///
|
|
/// Anti-abuse:
|
|
/// - **Per-source-IP** (200/h, shared with `/api/auth/magic-link/send`)
|
|
/// bounds burst from a single attacker.
|
|
/// - **Per-target-email** (5/h, also shared) caps actual mail volume
|
|
/// to the recipient regardless of how many IPs hammer the endpoint.
|
|
/// - **Uniform response** on every outcome — rate-limited, no-account,
|
|
/// SMTP-failed, succeeded — so the page shape is not an oracle.
|
|
/// - **Audit log** carries the truth via the `auth.magic_link_send`
|
|
/// events emitted by `MagicLinkInviteService::send_login_link`.
|
|
async fn resend_magic_link(
|
|
State(state): State<Arc<AppState>>,
|
|
Path(token): Path<String>,
|
|
RequestLocale(locale): RequestLocale,
|
|
req: axum::http::Request<axum::body::Body>,
|
|
) -> Response {
|
|
let confirmation_state = state.clone();
|
|
let confirmation_locale = locale.clone();
|
|
let confirmation = move || {
|
|
let s = confirmation_state.clone();
|
|
let l = confirmation_locale.clone();
|
|
async move { resend_confirmation_page(&s, &l).await }
|
|
};
|
|
|
|
let Some(invite_svc) = state.magic_link_invite_service.as_ref() else {
|
|
return service_unavailable_page(&state, &locale).await;
|
|
};
|
|
|
|
let client_ip = extract_client_ip(&req);
|
|
|
|
// Per-IP backstop runs unconditionally — burns through the budget
|
|
// even when the token doesn't resolve, so the endpoint can't be
|
|
// used to spread probes thin across many tokens.
|
|
if state
|
|
.magic_link_send_per_ip_rate_limiter
|
|
.check_and_increment(&client_ip)
|
|
.is_err()
|
|
{
|
|
tracing::warn!(
|
|
target: "audit",
|
|
event = "auth.magic_link_send",
|
|
reason = "rate_limited_ip",
|
|
ip = %client_ip,
|
|
"Per-IP rate limit exceeded on /magic/v1/{{token}}/resend"
|
|
);
|
|
return confirmation().await;
|
|
}
|
|
|
|
let hint = match invite_svc.lookup_resend_recipient(&token).await {
|
|
Ok(Some(h)) => h,
|
|
_ => {
|
|
// Unknown / pending / deactivated — uniform response so the
|
|
// outcome is not an oracle for "is this a known token".
|
|
return confirmation().await;
|
|
}
|
|
};
|
|
|
|
// Per-target-email cap — keyed on the recipient we just resolved.
|
|
// Locks the mail volume to a single recipient regardless of how
|
|
// many distinct IPs the attacker spreads across.
|
|
if state
|
|
.magic_link_send_per_email_rate_limiter
|
|
.check_and_increment(&hint.email)
|
|
.is_err()
|
|
{
|
|
tracing::warn!(
|
|
target: "audit",
|
|
event = "auth.magic_link_send",
|
|
reason = "rate_limited_email",
|
|
ip = %client_ip,
|
|
"Per-target-email rate limit exceeded on /magic/v1/{{token}}/resend"
|
|
);
|
|
return confirmation().await;
|
|
}
|
|
|
|
let challenge = cookie_auth::generate_magic_request_challenge();
|
|
let login_ttl_secs = (state.core.config.magic_link.login_ttl_minutes * 60) as i64;
|
|
|
|
// Service swallows operational outcomes and audits the truth; we
|
|
// surface only DB / unexpected errors as 500.
|
|
if let Err(e) = invite_svc.send_login_link(&hint.email, &challenge).await {
|
|
tracing::error!(
|
|
target: "audit",
|
|
event = "auth.magic_link_send",
|
|
reason = "internal_error",
|
|
error = %e.message,
|
|
"Resend dispatch failed for an unexpected reason"
|
|
);
|
|
return resend_failure_page(&state, &locale).await;
|
|
}
|
|
|
|
let mut response = confirmation().await;
|
|
cookie_auth::append_magic_request_cookie(response.headers_mut(), &challenge, login_ttl_secs);
|
|
response
|
|
}
|
|
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
// Template structs
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
//
|
|
// Each user-visible page maps to one askama-derived struct. The strings
|
|
// they hold are already-resolved translations — the templates themselves
|
|
// are pure layout (HTML structure + escaping), no conditional locale
|
|
// logic. That keeps the template language minimal and pushes all i18n
|
|
// concerns to the call site, where we already have async + an
|
|
// I18nApplicationService handle.
|
|
|
|
#[derive(Template)]
|
|
#[template(path = "magic_link/page_expired_or_used.html")]
|
|
struct ExpiredOrUsedTemplate {
|
|
locale_code: String,
|
|
title: String,
|
|
body: String,
|
|
return_link: String,
|
|
/// `Some` when the row was recoverable (status = expired or used,
|
|
/// owning user still active) and we want to render the resend
|
|
/// button. `None` for unknown/pending/deactivated tokens — the page
|
|
/// then matches the generic shape, no oracle.
|
|
resend: Option<ResendOffer>,
|
|
}
|
|
|
|
struct ResendOffer {
|
|
action_url: String,
|
|
button_label: String,
|
|
}
|
|
|
|
#[derive(Template)]
|
|
#[template(path = "magic_link/page_cross_browser_confirm.html")]
|
|
struct CrossBrowserConfirmTemplate {
|
|
locale_code: String,
|
|
title: String,
|
|
body: String,
|
|
warning: String,
|
|
confirm_url: String,
|
|
continue_label: String,
|
|
}
|
|
|
|
#[derive(Template)]
|
|
#[template(path = "magic_link/page_resend_confirmation.html")]
|
|
struct ResendConfirmationTemplate {
|
|
locale_code: String,
|
|
title: String,
|
|
body: String,
|
|
return_link: String,
|
|
}
|
|
|
|
#[derive(Template)]
|
|
#[template(path = "magic_link/page_generic_error.html")]
|
|
struct GenericErrorTemplate {
|
|
locale_code: String,
|
|
title: String,
|
|
body: String,
|
|
return_link: String,
|
|
}
|
|
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
// Page builders
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
//
|
|
// Helpers that resolve the user-visible strings via i18n, instantiate
|
|
// the template, and wrap the rendered HTML in an axum Response with
|
|
// the right status + Content-Type. The status is the caller's choice,
|
|
// the locale comes from the `RequestLocale` extractor.
|
|
|
|
/// Pre-resolve the strings shared across nearly every page (the title
|
|
/// fallback and "Return to OxiCloud" footer link). Keeps every builder
|
|
/// terse.
|
|
async fn translate(state: &Arc<AppState>, locale: &Locale, key: &str) -> String {
|
|
state
|
|
.applications
|
|
.i18n_service
|
|
.translate(key, Some(locale.clone()))
|
|
.await
|
|
.unwrap_or_else(|_| key.to_string())
|
|
}
|
|
|
|
async fn translate_args(
|
|
state: &Arc<AppState>,
|
|
locale: &Locale,
|
|
key: &str,
|
|
args: &[(&str, &str)],
|
|
) -> String {
|
|
state
|
|
.applications
|
|
.i18n_service
|
|
.translate_args(key, Some(locale.clone()), args)
|
|
.await
|
|
.unwrap_or_else(|_| key.to_string())
|
|
}
|
|
|
|
async fn expired_or_used_page(state: &Arc<AppState>, locale: &Locale, token: &str) -> Response {
|
|
let hint = match state.magic_link_invite_service.as_ref() {
|
|
Some(svc) => svc.lookup_resend_recipient(token).await.ok().flatten(),
|
|
None => None,
|
|
};
|
|
|
|
let (title, body, resend) = if let Some(hint) = hint {
|
|
(
|
|
translate(state, locale, "server.magic_link.page.expired_title").await,
|
|
translate(state, locale, "server.magic_link.page.expired_body").await,
|
|
Some(ResendOffer {
|
|
action_url: format!("/magic/v1/{}/resend", token),
|
|
button_label: translate_args(
|
|
state,
|
|
locale,
|
|
"server.magic_link.page.resend_to",
|
|
&[("email", &hint.masked_email)],
|
|
)
|
|
.await,
|
|
}),
|
|
)
|
|
} else {
|
|
// Generic "no longer valid" page — the body conveys both
|
|
// outcomes (expired or used) in one sentence to defeat the
|
|
// oracle.
|
|
(
|
|
translate(state, locale, "server.magic_link.page.expired_title").await,
|
|
translate(state, locale, "server.magic_link.page.generic_unavailable").await,
|
|
None,
|
|
)
|
|
};
|
|
|
|
let template = ExpiredOrUsedTemplate {
|
|
locale_code: locale.as_str().to_string(),
|
|
title,
|
|
body,
|
|
return_link: translate(state, locale, "server.magic_link.page.return_link").await,
|
|
resend,
|
|
};
|
|
render(StatusCode::GONE, template)
|
|
}
|
|
|
|
async fn cross_browser_confirmation_page(
|
|
state: &Arc<AppState>,
|
|
locale: &Locale,
|
|
token: &str,
|
|
) -> Response {
|
|
let template = CrossBrowserConfirmTemplate {
|
|
locale_code: locale.as_str().to_string(),
|
|
title: translate(state, locale, "server.magic_link.page.cross_browser_title").await,
|
|
body: translate(state, locale, "server.magic_link.page.cross_browser_body").await,
|
|
warning: translate(
|
|
state,
|
|
locale,
|
|
"server.magic_link.page.cross_browser_warning",
|
|
)
|
|
.await,
|
|
confirm_url: format!("/magic/v1/{}?confirm=1", token),
|
|
continue_label: translate(
|
|
state,
|
|
locale,
|
|
"server.magic_link.page.cross_browser_continue",
|
|
)
|
|
.await,
|
|
};
|
|
render(StatusCode::OK, template)
|
|
}
|
|
|
|
async fn resend_confirmation_page(state: &Arc<AppState>, locale: &Locale) -> Response {
|
|
let template = ResendConfirmationTemplate {
|
|
locale_code: locale.as_str().to_string(),
|
|
title: translate(
|
|
state,
|
|
locale,
|
|
"server.magic_link.page.resend_confirmation_title",
|
|
)
|
|
.await,
|
|
body: translate(
|
|
state,
|
|
locale,
|
|
"server.magic_link.page.resend_confirmation_body",
|
|
)
|
|
.await,
|
|
return_link: translate(state, locale, "server.magic_link.page.return_link").await,
|
|
};
|
|
render(StatusCode::OK, template)
|
|
}
|
|
|
|
async fn service_unavailable_page(state: &Arc<AppState>, locale: &Locale) -> Response {
|
|
let template = GenericErrorTemplate {
|
|
locale_code: locale.as_str().to_string(),
|
|
title: translate(state, locale, "server.magic_link.page.expired_title").await,
|
|
body: translate(state, locale, "server.magic_link.page.service_unavailable").await,
|
|
return_link: translate(state, locale, "server.magic_link.page.return_link").await,
|
|
};
|
|
render(StatusCode::SERVICE_UNAVAILABLE, template)
|
|
}
|
|
|
|
async fn internal_error_page(state: &Arc<AppState>, locale: &Locale) -> Response {
|
|
let template = GenericErrorTemplate {
|
|
locale_code: locale.as_str().to_string(),
|
|
title: translate(state, locale, "server.magic_link.page.expired_title").await,
|
|
body: translate(state, locale, "server.magic_link.page.internal_error").await,
|
|
return_link: translate(state, locale, "server.magic_link.page.return_link").await,
|
|
};
|
|
render(StatusCode::INTERNAL_SERVER_ERROR, template)
|
|
}
|
|
|
|
async fn resend_failure_page(state: &Arc<AppState>, locale: &Locale) -> Response {
|
|
let template = GenericErrorTemplate {
|
|
locale_code: locale.as_str().to_string(),
|
|
title: translate(state, locale, "server.magic_link.page.expired_title").await,
|
|
body: translate(state, locale, "server.magic_link.page.resend_failure").await,
|
|
return_link: translate(state, locale, "server.magic_link.page.return_link").await,
|
|
};
|
|
render(StatusCode::INTERNAL_SERVER_ERROR, template)
|
|
}
|
|
|
|
/// Render an askama template into a UTF-8 HTML response with the given
|
|
/// status. Template render failures only happen when a hand-edited
|
|
/// template references a field that doesn't exist on the struct, which
|
|
/// would have failed at compile time — but we still log + return a
|
|
/// minimal fallback rather than panic in production.
|
|
fn render<T: Template>(status: StatusCode, template: T) -> Response {
|
|
match template.render() {
|
|
Ok(body) => {
|
|
let mut response = (status, body).into_response();
|
|
response.headers_mut().insert(
|
|
CONTENT_TYPE,
|
|
HeaderValue::from_static("text/html; charset=utf-8"),
|
|
);
|
|
response
|
|
}
|
|
Err(e) => {
|
|
tracing::error!(
|
|
target: "audit",
|
|
event = "magic_link.template_render_failed",
|
|
error = %e,
|
|
"askama render failed — template definition out of sync with caller"
|
|
);
|
|
(
|
|
StatusCode::INTERNAL_SERVER_ERROR,
|
|
"Internal error rendering page.",
|
|
)
|
|
.into_response()
|
|
}
|
|
}
|
|
}
|
|
|
|
fn build_success_response(state: &Arc<AppState>, redemption: MagicLinkRedemption) -> Response {
|
|
let target = redirect_target(&redemption);
|
|
|
|
let mut response = (StatusCode::FOUND, [(LOCATION, target.as_str())]).into_response();
|
|
|
|
cookie_auth::append_auth_cookies(
|
|
response.headers_mut(),
|
|
&redemption.auth.access_token,
|
|
&redemption.auth.refresh_token,
|
|
redemption.auth.expires_in,
|
|
state.core.config.auth.refresh_token_expiry_secs,
|
|
);
|
|
cookie_auth::append_csrf_cookie(response.headers_mut(), redemption.auth.expires_in);
|
|
// Clear the request-challenge cookie — it's single-use and we don't
|
|
// want a stale value on the browser confusing a later flow.
|
|
cookie_auth::append_clear_magic_request_cookie(response.headers_mut());
|
|
|
|
response
|
|
}
|
|
|
|
/// Build the SPA route the redemption should land on.
|
|
///
|
|
/// - **Resource token** (folder invitation): deep-link into the folder
|
|
/// view. SvelteKit `files/[...path]` accepts folder IDs as path
|
|
/// segments (see `frontend/src/routes/files/[...path]/+page.svelte`
|
|
/// — `goto(resolve(`/files/${folder.id}`))`).
|
|
/// - **NULL-resource token + external user**: land on `/shared-with-me`
|
|
/// (their entry point — they own no folders themselves).
|
|
/// - **NULL-resource token + internal user**: land on `/files` (the
|
|
/// user has a home folder; the "shared with me" view would be empty
|
|
/// on first signup, so home is the better welcome). Internal users
|
|
/// on NULL-resource tokens come from the email-only-signup welcome
|
|
/// path (PR 18) or from a magic-link they requested themselves
|
|
/// while password-eligible-and-lenient-mode (PR 19).
|
|
///
|
|
/// Historical: pre-SvelteKit these were hash routes
|
|
/// (`/#/files`, `/#/sharedwithme`, `/#/files/folder/{id}`) served by the
|
|
/// legacy vanilla frontend. Landing on those now serves the legacy
|
|
/// shell (with old meta-CSP + inline scripts) instead of the SPA and
|
|
/// triggers a CSP violation on modern deployments.
|
|
fn redirect_target(redemption: &MagicLinkRedemption) -> String {
|
|
match (redemption.resource_kind, redemption.resource_id) {
|
|
(Some(MagicLinkResourceKind::Folder), Some(folder_id)) => {
|
|
format!("/files/{}", folder_id)
|
|
}
|
|
_ if redemption.auth.user.is_external => "/shared-with-me".to_string(),
|
|
_ => "/files".to_string(),
|
|
}
|
|
}
|