71 lines
3.1 KiB
TypeScript
71 lines
3.1 KiB
TypeScript
import { NextRequest, NextResponse } from 'next/server';
|
|
import { cookies } from 'next/headers';
|
|
import { logger } from '@/lib/logger';
|
|
import { decryptPayload } from '@/lib/auth/crypto';
|
|
import { exchangeCodeForTokens } from '@/lib/oauth/token-exchange';
|
|
import { setPairReauth } from '@/lib/auth/pair-reauth';
|
|
|
|
// Completes the step-up re-authentication for device pairing. The user was sent
|
|
// to the IdP with prompt=login (see /api/auth/sso/start with purpose=reauth);
|
|
// here we verify the returned code against the pending state and exchange it to
|
|
// confirm a fresh login actually happened, then set the short-lived pairing
|
|
// re-auth proof cookie. We deliberately do NOT issue a login session or write
|
|
// any refresh-token cookies — the user is already signed in; this only proves
|
|
// recency for the pairing action.
|
|
|
|
const SSO_PENDING_COOKIE = 'sso_pending';
|
|
const SSO_PENDING_MAX_AGE_MS = 5 * 60 * 1000;
|
|
|
|
export async function POST(request: NextRequest) {
|
|
const cookieStore = await cookies();
|
|
try {
|
|
const { code, state } = await request.json();
|
|
if (!code || !state) {
|
|
return NextResponse.json({ error: 'Missing code or state' }, { status: 400 });
|
|
}
|
|
|
|
const pendingCookie = cookieStore.get(SSO_PENDING_COOKIE)?.value;
|
|
if (!pendingCookie) {
|
|
return NextResponse.json({ error: 'No pending re-auth session' }, { status: 400 });
|
|
}
|
|
|
|
const pending = decryptPayload(pendingCookie);
|
|
cookieStore.delete(SSO_PENDING_COOKIE);
|
|
if (!pending) {
|
|
return NextResponse.json({ error: 'Invalid re-auth session' }, { status: 400 });
|
|
}
|
|
|
|
// Only honor pending sessions that were started for the reauth purpose, so
|
|
// a normal login code can't be redirected into setting a pairing proof.
|
|
if (pending.purpose !== 'reauth') {
|
|
return NextResponse.json({ error: 'Not a re-auth session' }, { status: 400 });
|
|
}
|
|
if (pending.state !== state) {
|
|
return NextResponse.json({ error: 'State mismatch' }, { status: 400 });
|
|
}
|
|
const createdAt = pending.created_at as number;
|
|
if (!createdAt || Date.now() - createdAt > SSO_PENDING_MAX_AGE_MS) {
|
|
return NextResponse.json({ error: 'Re-auth session expired' }, { status: 400 });
|
|
}
|
|
|
|
const codeVerifier = pending.code_verifier as string;
|
|
const redirectUri = pending.redirect_uri as string;
|
|
const pendingServerId = typeof pending.server_id === 'string' ? pending.server_id : null;
|
|
if (!codeVerifier || !redirectUri) {
|
|
return NextResponse.json({ error: 'Invalid re-auth session data' }, { status: 400 });
|
|
}
|
|
|
|
// A successful exchange proves the user just authenticated at the IdP (the
|
|
// freshness is enforced by prompt=login on the authorize request). We don't
|
|
// keep the resulting tokens.
|
|
await exchangeCodeForTokens(code, codeVerifier, redirectUri, pendingServerId);
|
|
|
|
await setPairReauth();
|
|
return NextResponse.json({ ok: true });
|
|
} catch (error) {
|
|
cookieStore.delete(SSO_PENDING_COOKIE);
|
|
logger.error('Reauth complete error', { error: error instanceof Error ? error.message : 'Unknown error' });
|
|
return NextResponse.json({ error: 'Re-authentication failed' }, { status: 401 });
|
|
}
|
|
}
|