sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-02 11:39:06 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into fix/pkce-flow-session-extend

Browse Source 
Both sides extended the OAuth flow entry points: main threads a login hint
through GetOAuthFlow/NewOAuthFlow, this branch threads a sessionExtend flag.
The merged signatures carry both.

client/android/login.go keeps main's structure — the hint reaches the flow
through GetOAuthFlow rather than a loginHintSetter assertion, profile email
helpers live in client/mobile, and runOAuthFlow is the shared driver — with
this branch's sessionExtend plumbing and wrong-account retry layered on top.
The branch's runInteractiveFlow is dropped in favour of runOAuthFlow.

client/android/ssh_client.go is new from main and merged without conflict,
but calls NewOAuthFlow; SSH login is a fresh login, so it passes false.

management.pb.go regenerated with the pinned protoc-gen-go v1.26 from
generate.sh. The .proto merged cleanly: main's LazyState and proxy_embedded
are disjoint from this branch's SessionExtend field.
This commit is contained in:
Zoltán Papp
2026-08-26 16:00:34 +02:00
parent 907e66b9d7 f221347c7a
commit 31c183c591
346 changed files with 20217 additions and 4994 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/internal/auth/auth.go
+19 -8
View File
@@ -142,26 +142,37 @@ func (a *Auth) IsSSOSupported(ctx context.Context) (bool, error) {
// sessionExtend marks the flow as renewing an existing peer's session rather than
// logging one in; the server needs it to rule out a silent authorization that the
// IdP could answer from another account. See PKCEAuthorizationFlowRequest.
func (a *Auth) GetOAuthFlow(ctx context.Context, forceDeviceAuth bool, sessionExtend bool) (OAuthFlow, error) {
func (a *Auth) GetOAuthFlow(ctx context.Context, forceDeviceAuth bool, sessionExtend bool, hint string) (OAuthFlow, error) {
var flow OAuthFlow
var err error
err = a.withRetry(ctx, func(client *mgm.GrpcClient) error {
err := a.withRetry(ctx, func(client *mgm.GrpcClient) error {
if forceDeviceAuth {
flow, err = a.getDeviceFlow(client)
return err
deviceFlow, err := a.getDeviceFlow(client)
if err != nil {
return err
}
deviceFlow.SetLoginHint(hint)
flow = deviceFlow
return nil
}
// Try PKCE flow first
flow, err = a.getPKCEFlow(client, sessionExtend)
pkceFlow, err := a.getPKCEFlow(client, sessionExtend)
if err != nil {
// If PKCE not supported, try Device flow
if s, ok := status.FromError(err); ok && (s.Code() == codes.NotFound || s.Code() == codes.Unimplemented) {
flow, err = a.getDeviceFlow(client)
return err
deviceFlow, err := a.getDeviceFlow(client)
if err != nil {
return err
}
deviceFlow.SetLoginHint(hint)
flow = deviceFlow
return nil
}
return err
}
pkceFlow.SetLoginHint(hint)
flow = pkceFlow
return nil
})
client/internal/auth/oauth.go
+2 -6
View File
@@ -125,9 +125,7 @@ func authenticateWithPKCEFlow(ctx context.Context, config *profilemanager.Config
return nil, fmt.Errorf("getting pkce authorization flow info failed with error: %v", err)
}
if hint != "" {
pkceFlowInfo.SetLoginHint(hint)
}
pkceFlowInfo.SetLoginHint(hint)
return pkceFlowInfo, nil
}
@@ -155,9 +153,7 @@ func authenticateWithDeviceCodeFlow(ctx context.Context, config *profilemanager.
}
}
if hint != "" {
deviceFlowInfo.SetLoginHint(hint)
}
deviceFlowInfo.SetLoginHint(hint)
return deviceFlowInfo, nil
}