mirror of
https://github.com/hanzoai/team.git
synced 2026-09-30 01:57:35 +00:00
fe8025c7f0
* Route Calls pushes through a VoIP token if present
Add VoIP device id support so calls notifications can be delivered as iOS
PushKit pushes, while standard pushes continue using the regular device
token.
* New SessionPropVoIPDeviceId + IsValidVoIPDeviceID validator
* PushNotifyAppleReactNativeVoIP platform constant
* voip_device_id accepted on PUT /users/sessions/device and on login
* DoLogin refactored to accept LoginOptions struct; all four call sites
(api4/user, channels/web/{saml,magic_link,oauth}) converted
* sendPushNotificationToAllSessions: when SubType=calls, prefer
Session.Props[voip_device_id]; fall back to standard DeviceId
Tests cover the validator, the device-props endpoint (accept/reject), and
the SubType=calls routing matrix.
* Skip session per Calls plugin "answered_elsewhere" convention
When the Calls plugin fans out a cancel-ring push to a user's other
VoIP devices after they answer a call from one of them, it can't tell
core which session to skip because the public plugin API doesn't expose
a skip-session-id parameter. It encodes the auth-session-id on SenderId
together with Category="answered_elsewhere". Core honors the convention
and clears SenderId on the per-session copy before forwarding so the
session id never reaches the proxy or device. Category is preserved on
the wire so the mobile client can pick CXCallEndedReason.answeredElsewhere.
The matching side lives in mattermost-plugin-calls' push_notifications.go;
both sides cross-reference the constant.
* delay voip token audit until session props are set
* capture voip audit failed case
* Promote VoIP token to a column; dispatch by Transport; harden revocation
* ai feedback review
* feedback review
* feedback review
* fix tests
* update openAPI
* update serialized session model
---------
Co-authored-by: Jesse Hallam <[email protected]>
94 lines
3.1 KiB
Go
94 lines
3.1 KiB
Go
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
|
// See LICENSE.txt for license information.
|
|
|
|
package web
|
|
|
|
import (
|
|
"html"
|
|
"net/http"
|
|
|
|
"github.com/mattermost/mattermost/server/public/model"
|
|
"github.com/mattermost/mattermost/server/v8/channels/utils"
|
|
)
|
|
|
|
func (w *Web) InitMagicLink() {
|
|
w.MainRouter.Handle("/login/one_time_link", w.APIHandler(loginWithMagicLinkToken)).Methods(http.MethodGet)
|
|
}
|
|
|
|
func loginWithMagicLinkToken(c *Context, w http.ResponseWriter, r *http.Request) {
|
|
auditRec := c.MakeAuditRecord(model.AuditEventLogin, model.AuditStatusFail)
|
|
auditRec.AddMeta("login_method", "guest_magic_link")
|
|
defer c.LogAuditRec(auditRec)
|
|
|
|
if !*c.App.Config().GuestAccountsSettings.EnableGuestMagicLink {
|
|
http.Redirect(w, r, c.GetSiteURLHeader()+"/login?extra=login_error&message="+html.EscapeString("Magic link is disabled"), http.StatusFound)
|
|
return
|
|
}
|
|
|
|
if c.AppContext.Session() != nil && c.AppContext.Session().UserId != "" {
|
|
http.Redirect(w, r, c.GetSiteURLHeader()+"/error?type=magic_link_already_logged_in", http.StatusFound)
|
|
return
|
|
}
|
|
|
|
tokenString := r.URL.Query().Get("t")
|
|
if tokenString == "" {
|
|
c.Err = model.NewAppError("loginWithMagicLinkToken", "api.user.guest_magic_link.missing_token.app_error", nil, "", http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
// Rate limit by IP to prevent brute force attacks on tokens
|
|
if c.App.Srv().RateLimiter != nil {
|
|
rateLimitKey := c.App.Srv().RateLimiter.GenerateKey(r)
|
|
if c.App.Srv().RateLimiter.RateLimitWriter(r.Context(), rateLimitKey, w) {
|
|
return
|
|
}
|
|
}
|
|
|
|
redirectURL := html.EscapeString(r.URL.Query().Get("redirect_to"))
|
|
|
|
user, err := c.App.AuthenticateUserForGuestMagicLink(c.AppContext, tokenString)
|
|
if err != nil {
|
|
http.Redirect(w, r, c.GetSiteURLHeader()+"/login?extra=login_error&message="+html.EscapeString(err.Message), http.StatusFound)
|
|
return
|
|
}
|
|
|
|
auditRec.AddMeta("user_id", user.Id)
|
|
c.LogAuditWithUserId(user.Id, "attempt - guest_magic_link")
|
|
|
|
// Check user authentication criteria
|
|
if authErr := c.App.CheckUserAllAuthenticationCriteria(c.AppContext, user, ""); authErr != nil {
|
|
c.LogAuditWithUserId(user.Id, "failure - guest_magic_link")
|
|
utils.RenderWebAppError(c.App.Config(), w, r, authErr, c.App.AsymmetricSigningKey())
|
|
return
|
|
}
|
|
|
|
// Create session and log user in
|
|
session, err := c.App.DoLogin(c.AppContext, w, r, user, model.LoginOptions{
|
|
IsSaml: true,
|
|
})
|
|
if err != nil {
|
|
utils.RenderWebAppError(c.App.Config(), w, r, err, c.App.AsymmetricSigningKey())
|
|
return
|
|
}
|
|
|
|
c.AppContext = c.AppContext.WithSession(session)
|
|
|
|
// Mark login as successful in audit log
|
|
auditRec.Success()
|
|
c.LogAuditWithUserId(user.Id, "success - guest_magic_link")
|
|
|
|
// Attach session cookies and redirect
|
|
c.App.AttachSessionCookies(c.AppContext, w, r)
|
|
|
|
// Determine redirect URL
|
|
if redirectURL == "" {
|
|
// No redirect specified - go to root and let webapp route to appropriate location
|
|
redirectURL = c.GetSiteURLHeader()
|
|
} else {
|
|
// Validate and make redirect URL fully qualified
|
|
redirectURL = fullyQualifiedRedirectURL(c.GetSiteURLHeader(), redirectURL, c.App.Config().NativeAppSettings.AppCustomURLSchemes)
|
|
}
|
|
|
|
http.Redirect(w, r, redirectURL, http.StatusFound)
|
|
}
|