Enterprise SSO Authentication
@@ -5340,10 +5347,6 @@ export default function App({ showLabPanels = false }: { showLabPanels?: boolean
);
}
- if (!accessToken) {
- return
{t("Authenticated, but no access token was returned.")}
;
- }
-
return (
diff --git a/frontend/src/components/StatusNotice.stories.tsx b/frontend/src/components/StatusNotice.stories.tsx
index 89ad543b4..55827d78b 100644
--- a/frontend/src/components/StatusNotice.stories.tsx
+++ b/frontend/src/components/StatusNotice.stories.tsx
@@ -63,3 +63,18 @@ export const Retry: Story = {
await expect(args.onRetry).toHaveBeenCalledTimes(1);
},
};
+
+export const SignInRetry: Story = {
+ args: {
+ kind: "retry",
+ message: "This request failed. Retry the same action.",
+ retryLabel: "Log in",
+ onRetry: fn(),
+ },
+ play: async ({ canvasElement, args }) => {
+ const canvas = within(canvasElement);
+ await expect(canvas.getByRole("alert")).toHaveTextContent("Retry needed");
+ await userEvent.click(canvas.getByRole("button", { name: "Log in" }));
+ await expect(args.onRetry).toHaveBeenCalledTimes(1);
+ },
+};
diff --git a/frontend/src/oidcReturnUrl.test.ts b/frontend/src/oidcReturnUrl.test.ts
index 2ecddb1c1..1a40fea12 100644
--- a/frontend/src/oidcReturnUrl.test.ts
+++ b/frontend/src/oidcReturnUrl.test.ts
@@ -24,12 +24,28 @@ describe("OIDC return URL handling", () => {
// one-time code/state; a return URL built from it must not.
const cleaned = returnUrlFromLocation({
pathname: "/",
- search: "?post=abc&code=xyz&state=s&session_state=t&iss=i",
+ search: "?post=abc&code=xyz&state=s&session_state=t&iss=i&error=access_denied&error_description=private&error_uri=https://example.test/error",
hash: "",
});
expect(cleaned).toBe("/?post=abc");
});
+ it("sanitizes callback artifacts in returned state and stored fallbacks", () => {
+ const callbackPath = "/?post=abc&error=access_denied&error_description=private&code=one-time#evidence";
+ expect(restoreOidcReturnUrl({ returnUrl: callbackPath })).toBe("/?post=abc#evidence");
+ window.localStorage.setItem("lineageweave.oidc.returnUrl", callbackPath);
+ expect(restoreOidcReturnUrl(undefined)).toBe("/?post=abc#evidence");
+ rememberOidcReturnUrl(callbackPath);
+ expect(window.sessionStorage.getItem("lineageweave.oidc.returnUrl")).toBe("/?post=abc#evidence");
+ expect(window.localStorage.getItem("lineageweave.oidc.returnUrl")).toBe("/?post=abc#evidence");
+ });
+
+ it.each(["/\\evil.example", "/\t/evil.example", "/\\["])("rejects paths that URL parsing would turn into another authority (%j)", (unsafePath) => {
+ rememberOidcReturnUrl(unsafePath);
+ expect(window.localStorage.getItem("lineageweave.oidc.returnUrl")).toBeNull();
+ expect(restoreOidcReturnUrl({ returnUrl: unsafePath })).toBe("/");
+ });
+
it("restores an object or serialized OIDC state before storage fallback", () => {
rememberOidcReturnUrl("/?post=stored-before-direct");
expect(restoreOidcReturnUrl("/?post=from-direct-state")).toBe(
@@ -83,7 +99,7 @@ describe("OIDC return URL handling", () => {
describe("stripOidcCallbackParams", () => {
it("removes the Keycloak auth-exchange params but keeps app deep-link params", () => {
const url = new URL(
- "http://localhost:15173/?state=abc&session_state=def&iss=http%3A%2F%2Fidp&code=xyz&post=post-1&workspace=board",
+ "http://localhost:15173/?state=abc&session_state=def&iss=http%3A%2F%2Fidp&code=xyz&error=access_denied&error_description=private&error_uri=https://example.test/error&post=post-1&workspace=board",
);
stripOidcCallbackParams(url);
@@ -92,6 +108,9 @@ describe("stripOidcCallbackParams", () => {
expect(url.searchParams.get("session_state")).toBeNull();
expect(url.searchParams.get("iss")).toBeNull();
expect(url.searchParams.get("code")).toBeNull();
+ expect(url.searchParams.get("error")).toBeNull();
+ expect(url.searchParams.get("error_description")).toBeNull();
+ expect(url.searchParams.get("error_uri")).toBeNull();
expect(url.searchParams.get("post")).toBe("post-1");
expect(url.searchParams.get("workspace")).toBe("board");
});
diff --git a/frontend/src/oidcReturnUrl.ts b/frontend/src/oidcReturnUrl.ts
index 5d478668c..56622eb0d 100644
--- a/frontend/src/oidcReturnUrl.ts
+++ b/frontend/src/oidcReturnUrl.ts
@@ -1,11 +1,13 @@
export const OIDC_RETURN_URL_STORAGE_KEY = "lineageweave.oidc.returnUrl";
const MAX_OIDC_RETURN_URL_LENGTH = 4096;
-/** Authorization-code response params Keycloak appends to the redirect URI
- * (RFC 6749 sec. 4.1.2; `session_state` per OIDC Session Management). Any
+/** Authorization response params Keycloak appends to the redirect URI
+ * (RFC 6749 sec. 4.1.2 and 4.1.2.1; `session_state` per OIDC Session Management). Any
* link built from `window.location` must strip these -- they're a one-time
* auth exchange, never part of a shareable URL. */
-const OIDC_CALLBACK_PARAMS = ["code", "state", "session_state", "iss"] as const;
+const OIDC_CALLBACK_PARAMS = [
+ "code", "state", "session_state", "iss", "error", "error_description", "error_uri",
+] as const;
/** Removes OIDC callback artifacts from `url` in place -- call before turning
* `window.location` into a link a user can copy or share. */
@@ -16,11 +18,14 @@ export function stripOidcCallbackParams(url: URL): void {
type UrlLike = Pick;
function isSafeReturnUrl(value: string): boolean {
- return (
- value.length <= MAX_OIDC_RETURN_URL_LENGTH &&
- value.startsWith("/") &&
- !value.startsWith("//")
- );
+ if (value.length > MAX_OIDC_RETURN_URL_LENGTH || !value.startsWith("/") || value.startsWith("//")) {
+ return false;
+ }
+ try {
+ return new URL(value, window.location.origin).origin === window.location.origin;
+ } catch {
+ return false;
+ }
}
export function returnUrlFromLocation(location: UrlLike = window.location): string {
@@ -37,13 +42,14 @@ export function returnUrlFromLocation(location: UrlLike = window.location): stri
export function rememberOidcReturnUrl(value: string): void {
if (!isSafeReturnUrl(value)) return;
+ const returnUrl = returnUrlFromLocation(new URL(value, window.location.origin));
try {
- window.sessionStorage.setItem(OIDC_RETURN_URL_STORAGE_KEY, value);
+ window.sessionStorage.setItem(OIDC_RETURN_URL_STORAGE_KEY, returnUrl);
} catch {
// OIDC state remains the fallback when session storage is unavailable.
}
try {
- window.localStorage.setItem(OIDC_RETURN_URL_STORAGE_KEY, value);
+ window.localStorage.setItem(OIDC_RETURN_URL_STORAGE_KEY, returnUrl);
} catch {
// The OIDC state and session storage remain the fallbacks.
}
@@ -83,9 +89,8 @@ export function restoreOidcReturnUrl(state: unknown): string {
} catch {
// Fall through to the current path.
}
- if (fromState) return fromState;
- if (isSafeReturnUrl(sessionStored)) return sessionStored;
- if (isSafeReturnUrl(localStored)) return localStored;
+ const returnUrl = [fromState, sessionStored, localStored].find(isSafeReturnUrl);
+ if (returnUrl) return returnUrlFromLocation(new URL(returnUrl, window.location.origin));
return new URLSearchParams(window.location.search).has("post")
? returnUrlFromLocation()
: window.location.pathname;