mirror of
https://github.com/suitenumerique/meet.git
synced 2026-07-27 12:19:10 +00:00
lebaudantoine
ecb710688d
Add a new authentication backend for add-ons, with a core service managing session state in cache and exposing three API endpoints. Microsoft Add-ins recommend launching authentication from the side panel via a dialog, then returning the JWT to the parent context using postMessage. However, due to Django and SSO security constraints (window.opener not preserved), this approach is not viable. Implement a three-step authentication flow: - `/init`: create a session, return a short-lived transit token and CSRF token. Store session ID in a secure HttpOnly cookie. - `/poll`: allow the add-on to poll until authentication is complete, then consume the session and clear the cookie. - `/exchange`: exchange the transit token for a JWT, which is later retrieved via the `/poll` endpoint. The add-on opens an authentication dialog, stores the transit token in sessionStorage, and performs the exchange after login. This approach works within iframe constraints and provides a sufficiently secure v0 despite known limitations.
65 lines
1.7 KiB
Python
65 lines
1.7 KiB
Python
"""URL configuration for the core app."""
|
|
|
|
from django.conf import settings
|
|
from django.urls import include, path
|
|
|
|
from lasuite.oidc_login.urls import urlpatterns as oidc_urls
|
|
from rest_framework.routers import DefaultRouter, SimpleRouter
|
|
|
|
from core.addons import viewsets as addons_viewsets
|
|
from core.api import get_frontend_configuration, viewsets
|
|
from core.external_api import viewsets as external_viewsets
|
|
|
|
# - Main endpoints
|
|
router = DefaultRouter()
|
|
router.register("users", viewsets.UserViewSet, basename="users")
|
|
router.register("rooms", viewsets.RoomViewSet, basename="rooms")
|
|
router.register("recordings", viewsets.RecordingViewSet, basename="recordings")
|
|
router.register("files", viewsets.FileViewSet, basename="files")
|
|
router.register(
|
|
"resource-accesses", viewsets.ResourceAccessViewSet, basename="resource_accesses"
|
|
)
|
|
router.register(
|
|
"addons/sessions",
|
|
addons_viewsets.SessionViewSet,
|
|
basename="addons_sessions",
|
|
)
|
|
|
|
# - External API
|
|
external_router = SimpleRouter()
|
|
external_router.register(
|
|
"application",
|
|
external_viewsets.ApplicationViewSet,
|
|
basename="external_application",
|
|
)
|
|
external_router.register(
|
|
"rooms",
|
|
external_viewsets.RoomViewSet,
|
|
basename="external_room",
|
|
)
|
|
|
|
urlpatterns = [
|
|
path(
|
|
f"api/{settings.API_VERSION}/",
|
|
include(
|
|
[
|
|
*router.urls,
|
|
*oidc_urls,
|
|
path("config/", get_frontend_configuration, name="config"),
|
|
]
|
|
),
|
|
),
|
|
]
|
|
|
|
if settings.EXTERNAL_API_ENABLED:
|
|
urlpatterns.append(
|
|
path(
|
|
f"external-api/{settings.EXTERNAL_API_VERSION}/",
|
|
include(
|
|
[
|
|
*external_router.urls,
|
|
]
|
|
),
|
|
)
|
|
)
|