Vishnu NarayananandGitHub
ba0ba46c9c
## Description SuperAdmin impersonation SSO logins no longer create UserSession rows visible to the customer. Impersonation tokens use a 2-day lifespan instead of ~2 months, so they naturally evict first and don't linger in the user's token list. Server-side detection via Redis value (`'impersonation'` vs `'normal'`) without changing the `valid_sso_auth_token?` signature. Backward compatible with in-flight tokens. Depends on #14556. ## Type of change - [x] Bug fix (non-breaking change which fixes an issue) ## How Has This Been Tested? Specs cover: impersonation login skips UserSession creation, impersonation token has short lifespan, normal SSO login still creates UserSession row. ## Checklist: - [x] My code follows the style guidelines of this project - [x] I have performed a self-review of my code - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] Any dependent changes have been merged and published in downstream modules
39 lines
1.1 KiB
Ruby
39 lines
1.1 KiB
Ruby
module SsoAuthenticatable
|
|
extend ActiveSupport::Concern
|
|
|
|
def generate_sso_auth_token(impersonation: false)
|
|
token = SecureRandom.hex(32)
|
|
::Redis::Alfred.setex(sso_token_key(token), impersonation ? 'impersonation' : 'normal', 5.minutes)
|
|
token
|
|
end
|
|
|
|
def invalidate_sso_auth_token(token)
|
|
::Redis::Alfred.delete(sso_token_key(token))
|
|
end
|
|
|
|
def valid_sso_auth_token?(token)
|
|
::Redis::Alfred.get(sso_token_key(token)).present?
|
|
end
|
|
|
|
def generate_sso_link
|
|
encoded_email = ERB::Util.url_encode(email)
|
|
"#{ENV.fetch('FRONTEND_URL', nil)}/app/login?email=#{encoded_email}&sso_auth_token=#{generate_sso_auth_token}"
|
|
end
|
|
|
|
def sso_auth_token_impersonation?(token)
|
|
::Redis::Alfred.get(sso_token_key(token)) == 'impersonation'
|
|
end
|
|
|
|
def generate_sso_link_with_impersonation
|
|
encoded_email = ERB::Util.url_encode(email)
|
|
"#{ENV.fetch('FRONTEND_URL',
|
|
nil)}/app/login?email=#{encoded_email}&sso_auth_token=#{generate_sso_auth_token(impersonation: true)}&impersonation=true"
|
|
end
|
|
|
|
private
|
|
|
|
def sso_token_key(token)
|
|
format(::Redis::RedisKeys::USER_SSO_AUTH_TOKEN, user_id: id, token: token)
|
|
end
|
|
end
|