mirror of
https://github.com/gristlabs/grist-core.git
synced 2024-09-28 21:50:46 +00:00
f9630b3aa4
Summary: * Remove adjustSession hack, interfering with loading docs under saml. * Allow the anonymous user to receive an empty list of workspaces for the merged org. * Behave better on first page load when org is in path - this used to fail because of lack of cookie. This is very visible in grist-core, as a failure to load localhost:8484 on first visit. * Mark cookie explicitly as SameSite=Lax to remove a warning in firefox. * Make errorPages available in grist-core. This changes the default behavior of grist-core to now start off in anonymous mode, with an explicit sign-in step available. If SAML is not configured, the sign-in operation will unconditionally sign the user in as a default user, without any password check or other security. The user email is taken from GRIST_DEFAULT_EMAIL if set. This is a significant change, but makes anonymous mode available in grist-core (which is convenient for testing) and makes behavior with and without SAML much more consistent. Test Plan: updated test; manual (time to start adding grist-core tests though!) Reviewers: dsagal Reviewed By: dsagal Differential Revision: https://phab.getgrist.com/D2980
85 lines
3.1 KiB
TypeScript
85 lines
3.1 KiB
TypeScript
import {ScopedSession} from 'app/server/lib/BrowserSession';
|
|
import {cookieName, SessionStore} from 'app/server/lib/gristSessions';
|
|
import * as cookie from 'cookie';
|
|
import * as cookieParser from 'cookie-parser';
|
|
import {Request} from 'express';
|
|
|
|
/**
|
|
*
|
|
* A collection of all the sessions relevant to this instance of Grist.
|
|
*
|
|
* This collection was previously maintained by the Comm object. This
|
|
* class is added as a stepping stone to disentangling session management
|
|
* from code related to websockets.
|
|
*
|
|
* The collection caches all existing interfaces to sessions.
|
|
* ScopedSessions play an important role in
|
|
* hosted Grist and address per-organization scoping of identity.
|
|
*
|
|
* TODO: now this is separated out, we could refactor to share sessions
|
|
* across organizations. Currently, when a user moves between organizations,
|
|
* the session interfaces are not shared. This was for simplicity in working
|
|
* with existing code.
|
|
*
|
|
*/
|
|
export class Sessions {
|
|
private _sessions = new Map<string, ScopedSession>();
|
|
|
|
constructor(private _sessionSecret: string, private _sessionStore: SessionStore) {
|
|
}
|
|
|
|
/**
|
|
* Get the session id and organization from the request (or just pass it in if known), and
|
|
* return the identified session.
|
|
*/
|
|
public getOrCreateSessionFromRequest(req: Request, sessionId?: string): ScopedSession {
|
|
const sid = sessionId || this.getSessionIdFromRequest(req);
|
|
const org = (req as any).org;
|
|
if (!sid) { throw new Error("session not found"); }
|
|
return this.getOrCreateSession(sid, org, ''); // TODO: allow for tying to a preferred user.
|
|
}
|
|
|
|
/**
|
|
* Get or create a session given the session id and organization name.
|
|
*/
|
|
public getOrCreateSession(sid: string, domain: string, userSelector: string): ScopedSession {
|
|
const key = this._getSessionOrgKey(sid, domain, userSelector);
|
|
if (!this._sessions.has(key)) {
|
|
const scopedSession = new ScopedSession(sid, this._sessionStore, domain, userSelector);
|
|
this._sessions.set(key, scopedSession);
|
|
}
|
|
return this._sessions.get(key)!;
|
|
}
|
|
|
|
/**
|
|
* Returns the sessionId from the signed grist cookie.
|
|
*/
|
|
public getSessionIdFromCookie(gristCookie: string) {
|
|
return cookieParser.signedCookie(gristCookie, this._sessionSecret);
|
|
}
|
|
|
|
/**
|
|
* Get the session id from the grist cookie. Returns null if no cookie found.
|
|
*/
|
|
public getSessionIdFromRequest(req: Request): string|null {
|
|
if (req.headers.cookie) {
|
|
const cookies = cookie.parse(req.headers.cookie);
|
|
const sessionId = this.getSessionIdFromCookie(cookies[cookieName]);
|
|
return sessionId;
|
|
}
|
|
return null;
|
|
}
|
|
|
|
/**
|
|
* Get a per-organization, per-session key.
|
|
* Grist has historically cached sessions in memory by their session id.
|
|
* With the introduction of per-organization identity, that cache is now
|
|
* needs to be keyed by the session id and organization name.
|
|
* Also, clients may now want to be tied to a particular user available within
|
|
* a session, so we add that into key too.
|
|
*/
|
|
private _getSessionOrgKey(sid: string, domain: string, userSelector: string): string {
|
|
return `${sid}__${domain}__${userSelector}`;
|
|
}
|
|
}
|