mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(auth): close diagnostic filesystem races

Browse Source
This commit is contained in:
marcopan
2026-08-17 13:04:15 +02:00
parent be1724890a
commit 6d438f4c7e
16 changed files with 545 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/auth/oidc-client.ts
+19 -8
View File
@@ -88,13 +88,24 @@ function discoveryStringList(value: unknown): value is readonly string[] {
function schemaValidDiscoveryMetadata(value: unknown): value is Record<string, unknown> & { issuer: string } {
if (!value || typeof value !== "object" || Array.isArray(value)) return false;
const metadata = value as Record<string, unknown>;
return text(metadata.issuer, 2048)
&& text(metadata.authorization_endpoint, 2048)
&& text(metadata.token_endpoint, 2048)
&& text(metadata.jwks_uri, 2048)
&& discoveryStringList(metadata.response_types_supported)
&& discoveryStringList(metadata.subject_types_supported)
&& discoveryStringList(metadata.id_token_signing_alg_values_supported);
const issuer = metadata.issuer;
const authorizationEndpoint = metadata.authorization_endpoint;
const tokenEndpoint = metadata.token_endpoint;
const jwksUri = metadata.jwks_uri;
if (!text(issuer, 2048) || !text(authorizationEndpoint, 2048)
|| !text(tokenEndpoint, 2048) || !text(jwksUri, 2048)
|| !discoveryStringList(metadata.response_types_supported)
|| !discoveryStringList(metadata.subject_types_supported)
|| !discoveryStringList(metadata.id_token_signing_alg_values_supported)) return false;
try {
configuredHttpsUrl(issuer);
httpsEndpoint(authorizationEndpoint);
httpsEndpoint(tokenEndpoint);
httpsEndpoint(jwksUri);
return true;
} catch {
return false;
}
}
function configuredHttpsUrl(value: string): URL {
@@ -526,11 +537,11 @@ export function createOidcProtocol(options: OidcProtocolOptions): OidcProtocol {
{ [customFetch]: issuerCheckingFetch, timeout: httpTimeoutMs / 1000 },
);
const metadata = config.serverMetadata();
if (certifiedIssuerMismatch) throw new OidcIssuerMismatchError();
if (metadata.issuer !== options.issuer) throw new OidcProtocolError();
httpsEndpoint(metadata.authorization_endpoint);
httpsEndpoint(metadata.token_endpoint);
httpsEndpoint(metadata.jwks_uri);
if (certifiedIssuerMismatch) throw new OidcIssuerMismatchError();
return config;
} catch (error) {
throw protocolFailure(error);