private/desktop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

adadsa
All checks were successful
Deploy / deploy-staging (push) Successful in 24s
Details
Deploy / deploy-production (push) Has been skipped
Details

Browse Source
This commit is contained in:
Lars Gebhardt-Kusche
2026-06-15 23:45:59 +02:00
parent 84a367bdc9
commit 29b5987aac
5 changed files with 25 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
public/auth/callback/index.php
View File

@@ -56,11 +56,12 @@ if ($state === '' || $expectedState === '' || !hash_equals($expectedState, $stat
$accountCheck = $accountGate->checkUsername($username); $accountCheck = $accountGate->checkUsername($username);
if (!($accountCheck['allowed'] ?? false)) { if (!($accountCheck['allowed'] ?? false)) {
$auth->logout();
$target = (string) ($accountCheck['state'] ?? '') === 'pending' $target = (string) ($accountCheck['state'] ?? '') === 'pending'
? '/auth/pending/?username=' . urlencode($username) ? '/auth/pending/?username=' . urlencode($username)
: '/auth/inactive/?message=' . urlencode((string) ($accountCheck['message'] ?? 'Dieses Konto ist noch nicht freigeschaltet.')); : '/auth/inactive/?message=' . urlencode((string) ($accountCheck['message'] ?? 'Dieses Konto ist noch nicht freigeschaltet.'));
header('Location: ' . $target, true, 302); $logoutUrl = $auth->logoutUrl($target, (string) ($tokenPayload['id_token'] ?? ''));
$auth->logout();
header('Location: ' . $logoutUrl, true, 302);
exit; exit;
} else { } else {
$auth->establishSession($tokenPayload, $userPayload); $auth->establishSession($tokenPayload, $userPayload);

2
public/auth/inactive/index.php
View File

@@ -27,7 +27,7 @@ if ($message === '') {
</div> </div>
<div class="login-actions"> <div class="login-actions">
<a class="login-button login-button-primary" href="/auth/logout">Zum Login</a> <a class="login-button login-button-primary" href="/auth/logout?target=/auth/keycloak">Zum Login</a>
</div> </div>
</section> </section>
</main> </main>

9
public/auth/logout/index.php
View File

@@ -12,9 +12,14 @@ session_start();
$projectRoot = dirname(__DIR__, 3); $projectRoot = dirname(__DIR__, 3);
$auth = new KeycloakAuth(ConfigLoader::load($projectRoot, 'keycloak')); $auth = new KeycloakAuth(ConfigLoader::load($projectRoot, 'keycloak'));
$logoutUrl = null; $logoutUrl = null;
$target = trim((string) ($_GET['target'] ?? '/auth/keycloak'));
if ($target === '' || !str_starts_with($target, '/')) {
$target = '/auth/keycloak';
}
if ($auth->isConfigured()) { if ($auth->isConfigured()) {
$logoutUrl = $auth->logoutUrl(); $logoutUrl = $auth->logoutUrl($target);
} }
$auth->logout(); $auth->logout();
@@ -24,5 +29,5 @@ if ($logoutUrl !== null) {
exit; exit;
} }
header('Location: /auth/keycloak', true, 302); header('Location: ' . $target, true, 302);
exit; exit;

2
public/auth/pending/index.php
View File

@@ -64,7 +64,7 @@ $view = $statusMap[$status] ?? [
</div> </div>
<div class="login-actions"> <div class="login-actions">
<a class="login-button login-button-primary" href="/auth/logout">Zum Login</a> <a class="login-button login-button-primary" href="/auth/logout?target=/auth/keycloak">Zum Login</a>
</div> </div>
</section> </section>
</main> </main>

18
src/App/KeycloakAuth.php
View File

@@ -186,14 +186,16 @@ final class KeycloakAuth
]; ];
} }
public function logoutUrl(): string public function logoutUrl(?string $redirectPath = null, ?string $idTokenHint = null): string
{ {
$params = [ $params = [
'client_id' => $this->clientId(), 'client_id' => $this->clientId(),
'post_logout_redirect_uri' => $this->postLogoutRedirectUri(), 'post_logout_redirect_uri' => $this->postLogoutRedirectUri($redirectPath),
]; ];
$idToken = (string) ($_SESSION['desktop_auth']['id_token'] ?? ''); $idToken = $idTokenHint !== null && $idTokenHint !== ''
? $idTokenHint
: (string) ($_SESSION['desktop_auth']['id_token'] ?? '');
if ($idToken !== '') { if ($idToken !== '') {
$params['id_token_hint'] = $idToken; $params['id_token_hint'] = $idToken;
@@ -263,9 +265,15 @@ final class KeycloakAuth
. '/protocol/openid-connect/userinfo'; . '/protocol/openid-connect/userinfo';
} }
private function postLogoutRedirectUri(): string private function postLogoutRedirectUri(?string $redirectPath = null): string
{ {
return $this->requestOrigin() . '/'; $path = trim((string) $redirectPath);
if ($path === '' || !str_starts_with($path, '/')) {
$path = '/';
}
return $this->requestOrigin() . $path;
} }
private function requestOrigin(): string private function requestOrigin(): string