sendnrw/pocket-id
2
0
Fork 0
mirror of https://github.com/pocket-id/pocket-id.git synced 2026-10-25 02:59:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: drop user initiated one time access token login method

Browse Source
This commit is contained in:
Elias Schneider
2026-07-29 23:49:08 +02:00
parent 2ef7c93fee
commit 0c27f733b9
11 changed files with 35 additions and 198 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/internal/bootstrap/router_bootstrap.go
-1
View File
@@ -179,7 +179,6 @@ func registerRoutes(r *gin.Engine, db *gorm.DB, svc *services, rateLimitServices
)
svc.oneTimeAccessModule.RegisterRoutes(apiGroup,
authMiddleware.Add(),
authMiddleware.WithAdminNotRequired().Add(),
rateLimitMiddleware.Add(middleware.RateLimitOneTimeAccessToken),
rateLimitMiddleware.Add(middleware.RateLimitOneTimeAccessEmail),
)
backend/internal/onetimeaccess/handler.go
+13 -38
View File
@@ -23,7 +23,15 @@ func newHandler(service *Service, appConfig AppConfigResolver) *handler {
return &handler{service: service, appConfig: appConfig}
}
func (h *handler) createToken(c *gin.Context, own bool) {
// createTokenForUser godoc
// @Summary Create one-time access token for user (admin)
// @Description Generate a one-time access token for a specific user (admin only)
// @Tags Users
// @Param id path string true "User ID"
// @Param body body tokenCreateDto true "Token options"
// @Success 201 {object} object "{ \"token\": \"string\" }"
// @Router /api/users/{id}/one-time-access-token [post]
func (h *handler) createTokenForUser(c *gin.Context) {
var input tokenCreateDto
err := c.ShouldBindJSON(&input)
if err != nil {
@@ -31,21 +39,11 @@ func (h *handler) createToken(c *gin.Context, own bool) {
return
}
var (
userID string
ttl time.Duration
)
if own {
// Get user ID from context and force the default TTL
userID = c.GetString("userID")
// Get the target user ID from the URL and apply the default expiration when no TTL is provided
userID := c.Param("id")
ttl := input.TTL.Duration
if ttl <= 0 {
ttl = defaultTokenDuration
} else {
// Get user ID from URL parameter, and optional TTL from body
userID = c.Param("id")
ttl = input.TTL.Duration
if ttl <= 0 {
ttl = defaultTokenDuration
}
}
if userID == "" {
_ = c.Error(&common.UserIdNotProvidedError{})
@@ -61,29 +59,6 @@ func (h *handler) createToken(c *gin.Context, own bool) {
c.JSON(http.StatusCreated, gin.H{"token": token})
}
// createOwnToken godoc
// @Summary Create one-time access token for current user
// @Description Generate a one-time access token for the currently authenticated user
// @Tags Users
// @Param body body tokenCreateDto true "Token options"
// @Success 201 {object} object "{ \"token\": \"string\" }"
// @Router /api/users/me/one-time-access-token [post]
func (h *handler) createOwnToken(c *gin.Context) {
h.createToken(c, true)
}
// createTokenForUser godoc
// @Summary Create one-time access token for user (admin)
// @Description Generate a one-time access token for a specific user (admin only)
// @Tags Users
// @Param id path string true "User ID"
// @Param body body tokenCreateDto true "Token options"
// @Success 201 {object} object "{ \"token\": \"string\" }"
// @Router /api/users/{id}/one-time-access-token [post]
func (h *handler) createTokenForUser(c *gin.Context) {
h.createToken(c, false)
}
// requestEmailAsUnauthenticatedUser godoc
// @Summary Request one-time access email
// @Description Request a one-time access email for unauthenticated users
backend/internal/onetimeaccess/module.go
+2 -3
View File
@@ -67,9 +67,8 @@ func New(deps Dependencies) (*Module, error) {
}
// RegisterRoutes mounts the one-time access token endpoints
// auth guards the admin routes and ownAuth the current user's own token, while the rate limiters throttle the public exchange and email endpoints
func (m *Module) RegisterRoutes(apiGroup *gin.RouterGroup, auth, ownAuth, exchangeRateLimit, emailRateLimit gin.HandlerFunc) {
apiGroup.POST("/users/me/one-time-access-token", ownAuth, m.handler.createOwnToken)
// auth guards the admin routes, while the rate limiters throttle the public exchange and email endpoints
func (m *Module) RegisterRoutes(apiGroup *gin.RouterGroup, auth, exchangeRateLimit, emailRateLimit gin.HandlerFunc) {
apiGroup.POST("/users/:id/one-time-access-token", auth, m.handler.createTokenForUser)
apiGroup.POST("/users/:id/one-time-access-email", auth, m.handler.requestEmailAsAdmin)
apiGroup.POST("/one-time-access-token/:token", exchangeRateLimit, m.handler.exchangeToken)