kevin/baron-sso
1
0
Fork 0
forked from baron/baron-sso
Code Pull Requests Activity

RP 테넌트 제한 backend 구현

Browse Source
This commit is contained in:
김용연
2026-04-24 16:56:34 +09:00
parent f97b244a59
commit d86c4111ad
4 changed files with 454 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
backend/internal/handler/auth_handler.go
View File

@@ -5130,6 +5130,13 @@ func (h *AuthHandler) GetConsentRequest(c *fiber.Ctx) error {
"scopes", consentRequest.RequestedScope,
)
profile, err := h.resolveCurrentProfile(c)
if err == nil && profile != nil {
if !isClientTenantAccessAllowed(profile, consentRequest.Client) {
return tenantNotAllowedError(c)
}
}
// [New] 로컬 DB에서 기존 동의 내역 확인 (강제 자동 승인 전략)
// Hydra가 skip을 주지 않더라도, 우리 DB에 이미 기록이 있다면 승인 처리함
if !consentRequest.Skip && h.ConsentRepo != nil && consentRequest.Subject != "" {
@@ -5333,6 +5340,13 @@ func (h *AuthHandler) AcceptConsentRequest(c *fiber.Ctx) error {
consentRequest.RequestedScope = filteredScopes
}
profile, err := h.resolveCurrentProfile(c)
if err == nil && profile != nil {
if !isClientTenantAccessAllowed(profile, consentRequest.Client) {
return tenantNotAllowedError(c)
}
}
// 3. Hydra에 승인 요청
if consentRequest.Subject == "" {
return fiber.NewError(fiber.StatusInternalServerError, "Consent subject missing")
@@ -5470,6 +5484,15 @@ func (h *AuthHandler) AcceptOidcLoginRequest(c *fiber.Ctx) error {
}
}
profile, err := h.resolveCurrentProfile(c)
if loginReq != nil {
if err == nil && profile != nil {
if !isClientTenantAccessAllowed(profile, loginReq.Client) {
return tenantNotAllowedError(c)
}
}
}
subject, err := h.resolveConsentSubject(c)
if err != nil || subject == "" {
return fiber.NewError(fiber.StatusUnauthorized, "Authentication required")
@@ -5520,6 +5543,10 @@ func (h *AuthHandler) AcceptOidcLoginRequest(c *fiber.Ctx) error {
}
func (h *AuthHandler) resolveCurrentProfile(c *fiber.Ctx) (*domain.UserProfileResponse, error) {
if profile, ok := c.Locals("user_profile").(*domain.UserProfileResponse); ok && profile != nil {
return profile, nil
}
appEnv := strings.ToLower(os.Getenv("APP_ENV"))
isDev := appEnv == "dev" || appEnv == "development" || appEnv == ""
@@ -5608,16 +5635,18 @@ func (h *AuthHandler) resolveCurrentProfile(c *fiber.Ctx) (*domain.UserProfileRe
}
// Fetch Tenant Metadata if missing
if profile.Tenant == nil && profile.TenantID != nil && *profile.TenantID != "" {
if tenant, err := h.TenantService.GetTenant(c.Context(), *profile.TenantID); err == nil {
profile.Tenant = tenant
if h.TenantService != nil {
if profile.Tenant == nil && profile.TenantID != nil && *profile.TenantID != "" {
if tenant, err := h.TenantService.GetTenant(c.Context(), *profile.TenantID); err == nil {
profile.Tenant = tenant
}
}
}
if profile.Tenant == nil && profile.CompanyCode != "" {
if tenant, err := h.TenantService.GetTenantBySlug(c.Context(), profile.CompanyCode); err == nil && tenant != nil {
profile.Tenant = tenant
if profile.TenantID == nil || *profile.TenantID == "" {
profile.TenantID = &tenant.ID
if profile.Tenant == nil && profile.CompanyCode != "" {
if tenant, err := h.TenantService.GetTenantBySlug(c.Context(), profile.CompanyCode); err == nil && tenant != nil {
profile.Tenant = tenant
if profile.TenantID == nil || *profile.TenantID == "" {
profile.TenantID = &tenant.ID
}
}
}
}