mirror of
https://github.com/hanzoai/sign.git
synced 2026-10-21 01:21:51 +00:00
zooqueenandHanzo Dev
ecee5e40aa
The IAM callback at /auth/callback reads IAM's userinfo answer and refuses an address IAM has not verified. An account is found by its linked IAM identity alone (provider hanzo, the IAM subject); an existing account that only shares the address is refused, never merged. A first sign-in makes an account only for an admin of the org the application serves or for someone an organisation invited at that verified address. Every refusal returns to /signin with a sentence saying what to do. Accepting an organisation invitation joins the signed-in person, and only when their verified address is the invited one; opening the link no longer adds whoever holds the address. The local email/password sign-up, sign-in, reset, verify-email and update routes, pages, jobs and mail are gone, as are passkey sign-in, the Google, Microsoft and generic OIDC providers, the per-organisation SSO portal and its account-link flow. Passkeys and two-factor stay for confirming a signature. The e2e suite starts sessions the way a finished IAM sign-in leaves them. Co-authored-by: Hanzo Dev <[email protected]>
26 lines
766 B
TypeScript
26 lines
766 B
TypeScript
import { sValidator } from '@hono/standard-validator';
|
|
import { Hono } from 'hono';
|
|
import { z } from 'zod';
|
|
|
|
import { HanzoAuthOptions } from '../config';
|
|
import { handleOAuthAuthorizeUrl } from '../lib/utils/handle-oauth-authorize-url';
|
|
import type { HonoAuthContext } from '../types/context';
|
|
|
|
const ZOAuthAuthorizeSchema = z.object({
|
|
redirectPath: z.string().optional(),
|
|
});
|
|
|
|
export const oauthRoute = new Hono<HonoAuthContext>()
|
|
/**
|
|
* Hanzo IAM authorize endpoint — the one way to sign in.
|
|
*/
|
|
.post('/authorize/hanzo', sValidator('json', ZOAuthAuthorizeSchema), async (c) => {
|
|
const { redirectPath } = c.req.valid('json');
|
|
|
|
return handleOAuthAuthorizeUrl({
|
|
c,
|
|
clientOptions: HanzoAuthOptions,
|
|
redirectPath,
|
|
});
|
|
});
|