mirrors/zed
1
0
Fork 0
mirror of https://github.com/zed-industries/zed.git synced 2024-12-28 11:29:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

Merge pull request #732 from zed-industries/fix-impersonation-in-api

Browse source 
In API, wait to create access token until after we impersonate a user
This commit is contained in:
Nathan Sobo 2022-04-04 15:16:35 -06:00 committed by GitHub
commit b060fb0f67
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
crates/server/src/api.rs
View file

@ -111,7 +111,6 @@ async fn create_access_token(request: Request) -> tide::Result {
.get_user_by_github_login(request.param("github_login")?)
.await?
.ok_or_else(|| surf::Error::from_str(StatusCode::NotFound, "user not found"))?;
let access_token = auth::create_access_token(request.db().as_ref(), user.id).await?;
#[derive(Deserialize)]
struct QueryParams {
@ -123,9 +122,6 @@ async fn create_access_token(request: Request) -> tide::Result {
surf::Error::from_str(StatusCode::UnprocessableEntity, "invalid query params")
})?;
let encrypted_access_token =
auth::encrypt_access_token(&access_token, query_params.public_key.clone())?;
let mut user_id = user.id;
if let Some(impersonate) = query_params.impersonate {
if user.admin {
@ -151,6 +147,10 @@ async fn create_access_token(request: Request) -> tide::Result {
}
}
let access_token = auth::create_access_token(request.db().as_ref(), user_id).await?;
let encrypted_access_token =
auth::encrypt_access_token(&access_token, query_params.public_key.clone())?;
Ok(tide::Response::builder(StatusCode::Ok)
.body(json!({"user_id": user_id, "encrypted_access_token": encrypted_access_token}))
.build())