From e5f6215d03483942fadb5765e20a239c97c227eb Mon Sep 17 00:00:00 2001 From: Taha Yassine Kraiem Date: Fri, 19 Jul 2024 12:17:43 +0200 Subject: [PATCH] fix(chalice): stop SA from logout --- ee/api/auth/auth_jwt.py | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/ee/api/auth/auth_jwt.py b/ee/api/auth/auth_jwt.py index 89d5a80e7..e4b879217 100644 --- a/ee/api/auth/auth_jwt.py +++ b/ee/api/auth/auth_jwt.py @@ -29,6 +29,11 @@ def _get_current_auth_context(request: Request, jwt_payload: dict) -> schemas.Cu return request.state.currentContext +def _allow_access_to_endpoint(request: Request, current_context: schemas.CurrentContext) -> bool: + return not current_context.service_account \ + or request.url.path not in ["/logout", "/api/logout", "/refresh", "/api/refresh"] + + class JWTAuth(HTTPBearer): def __init__(self, auto_error: bool = True): super(JWTAuth, self).__init__(auto_error=auto_error) @@ -68,7 +73,10 @@ class JWTAuth(HTTPBearer): or old_jwt_payload.get("userId") != jwt_payload.get("userId"): raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Invalid token or expired token.") - return _get_current_auth_context(request=request, jwt_payload=jwt_payload) + ctx = _get_current_auth_context(request=request, jwt_payload=jwt_payload) + if not _allow_access_to_endpoint(request=request, current_context=ctx): + raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Unauthorized endpoint.") + return ctx else: credentials: HTTPAuthorizationCredentials = await super(JWTAuth, self).__call__(request) @@ -95,7 +103,10 @@ class JWTAuth(HTTPBearer): raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Invalid token or expired token.") - return _get_current_auth_context(request=request, jwt_payload=jwt_payload) + ctx = _get_current_auth_context(request=request, jwt_payload=jwt_payload) + if not _allow_access_to_endpoint(request=request, current_context=ctx): + raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Unauthorized endpoint.") + return ctx logger.warning("Invalid authorization code.") raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Invalid authorization code.")