cjw/Oxicloud
1
0
Fork 0
Code Issues Pull Requests Actions 4 Packages Projects Releases Wiki Activity

feat(DPoP): check requests and 401 on failure

Browse Source
This commit is contained in:
Edouard Vanbelle
2026-08-08 19:55:18 +02:00
parent ed99b08e62
commit 8d6e03a4bb
11 changed files with 283 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/interfaces/middleware/auth.rs
+7
View File
@@ -224,6 +224,7 @@ pub async fn auth_middleware(
username: Arc::clone(&claims.username),
email: Arc::clone(&claims.email),
role,
dpop_jkt: claims.dpop_jkt.clone(),
});
request.extensions_mut().insert(current_user);
tracing::Span::current()
@@ -267,11 +268,16 @@ pub async fn auth_middleware(
"App password authentication successful for user: {}",
uname
);
// App-password sessions are always unbound —
// they belong to NC clients / CLI / mobile
// tools without WebCrypto. DPoP middleware
// exempts them.
let current_user = Arc::new(CurrentUser {
id: user_id,
username: uname,
email,
role,
dpop_jkt: None,
});
request.extensions_mut().insert(current_user);
tracing::Span::current()
@@ -341,6 +347,7 @@ pub async fn auth_middleware(
username: Arc::clone(&claims.username),
email: Arc::clone(&claims.email),
role,
dpop_jkt: claims.dpop_jkt.clone(),
});
request.extensions_mut().insert(current_user);
request.extensions_mut().insert(CookieAuthenticated);