mirror of
https://github.com/suitenumerique/meet.git
synced 2026-08-19 06:46:37 +00:00
lebaudantoine
e3871418e5
Some integrators render our videoconference inside an iframe, where our cookie-based authentication does not work: our cookies are SameSite=Lax/Strict, so the iframe drops them. We looked at what Jitsi offers: a shared secret used to sign JWTs that authenticate users coming from external services. Since we already expose an external API where third parties authenticate as a given user, it was simpler for us to add an exchange mechanism on top of that. Flow: * Through the external API, mint a short-lived, single-use exchange code for a user. * The third party hands that code to the frontend as a URL fragment. * The frontend exchanges the code for a longer-lived JWT that can be used to query the regular API viewsets. Known limitations and follow-ups: * At some point it would be nice to shorten the JWT lifetime and add a refresh mechanism. This will be handled in a follow-up PR when actually needed. * CSP rules to control which origins are allowed to embed the app in an iframe still need to be added. * This alternative authentication cannot easily be scoped to a subset of endpoints without adding a lot of complexity, so it is accepted globally on the API for now.
81 lines
2.1 KiB
Python
81 lines
2.1 KiB
Python
"""URL configuration for the core app."""
|
|
|
|
from django.conf import settings
|
|
from django.urls import include, path
|
|
|
|
from lasuite.oidc_login.urls import urlpatterns as oidc_urls
|
|
from rest_framework.routers import DefaultRouter, SimpleRouter
|
|
|
|
from core.addons import viewsets as addons_viewsets
|
|
from core.api import get_frontend_configuration, viewsets
|
|
from core.external_api import viewsets as external_viewsets
|
|
from core.roomkit import viewsets as roomkit_viewsets
|
|
|
|
# - Main endpoints
|
|
router = DefaultRouter()
|
|
router.register("users", viewsets.UserViewSet, basename="users")
|
|
router.register("rooms", viewsets.RoomViewSet, basename="rooms")
|
|
router.register("recordings", viewsets.RecordingViewSet, basename="recordings")
|
|
router.register("files", viewsets.FileViewSet, basename="files")
|
|
router.register(
|
|
"resource-accesses", viewsets.ResourceAccessViewSet, basename="resource_accesses"
|
|
)
|
|
router.register(
|
|
"roomkit",
|
|
roomkit_viewsets.RoomKitViewSet,
|
|
basename="roomkit",
|
|
)
|
|
router.register(
|
|
"addons/sessions",
|
|
addons_viewsets.SessionViewSet,
|
|
basename="addons_sessions",
|
|
)
|
|
router.register(
|
|
"diagnostics",
|
|
viewsets.DiagnosticsViewSet,
|
|
basename="diagnostics",
|
|
)
|
|
|
|
# - External API
|
|
external_router = SimpleRouter()
|
|
external_router.register(
|
|
"application",
|
|
external_viewsets.ApplicationViewSet,
|
|
basename="external_application",
|
|
)
|
|
external_router.register(
|
|
"rooms",
|
|
external_viewsets.RoomViewSet,
|
|
basename="external_room",
|
|
)
|
|
external_router.register(
|
|
"users",
|
|
external_viewsets.UserViewSet,
|
|
basename="external_user",
|
|
)
|
|
|
|
urlpatterns = [
|
|
path(
|
|
f"api/{settings.API_VERSION}/",
|
|
include(
|
|
[
|
|
*router.urls,
|
|
*oidc_urls,
|
|
path("config/", get_frontend_configuration, name="config"),
|
|
]
|
|
),
|
|
),
|
|
]
|
|
|
|
if settings.EXTERNAL_API_ENABLED:
|
|
urlpatterns.append(
|
|
path(
|
|
f"external-api/{settings.EXTERNAL_API_VERSION}/",
|
|
include(
|
|
[
|
|
*external_router.urls,
|
|
]
|
|
),
|
|
)
|
|
)
|