Mirrors/photoprism
1
0
Fork 0
mirror of https://github.com/photoprism/photoprism.git synced 2026-01-23 02:24:24 +00:00
Code Issues Projects Releases Wiki Activity

Entity: revert wrap/unwrap for AuthID

Browse source
This commit is contained in:
Keith Martin 2025-11-18 22:32:39 +10:00
parent 0672e58232
commit a691ddb98b
3 changed files with 8 additions and 111 deletions
Download patch file Download diff file Expand all files Collapse all files

57
internal/entity/auth_session.go
View file

@ -50,7 +50,7 @@ type Session struct {
AuthProvider string `gorm:"type:VARBINARY(128);default:'';" json:"AuthProvider" yaml:"AuthProvider,omitempty"`
AuthMethod string `gorm:"type:VARBINARY(128);default:'';" json:"AuthMethod" yaml:"AuthMethod,omitempty"`
AuthIssuer string `gorm:"type:VARBINARY(255);default:'';" json:"AuthIssuer,omitempty" yaml:"AuthIssuer,omitempty"`
AuthID string `gorm:"type:VARBINARY(264);index;default:'';" json:"AuthID" yaml:"AuthID,omitempty"` // Make sure that you wrap and unwrap if using auth_id in a query.
AuthID string `gorm:"type:VARBINARY(255);index;default:'';" json:"AuthID" yaml:"AuthID,omitempty"`
AuthScope string `gorm:"size:1024;default:'';" json:"AuthScope" yaml:"AuthScope,omitempty"`
GrantType string `gorm:"type:VARBINARY(64);default:'';" json:"GrantType" yaml:"GrantType,omitempty"`
LastActive int64 `json:"LastActive" yaml:"LastActive,omitempty"`
@ -276,30 +276,6 @@ func (m *Session) Updates(values interface{}) error {
return UnscopedDb().Model(m).Updates(values).Error
}
// Wraps a string value in pseudo XML to force type to string
func wrapString(s string) (r string) {
return s
r = s
if s != "" && !strings.HasPrefix(s, "<pp>") && !strings.HasSuffix(s, "</pp>") {
r = fmt.Sprintf("<pp>%s</pp>", s)
}
return r
}
// Wraps the AuthID field so that SQLite will save it correctly
func (m *Session) wrapAuthID() {
return
m.AuthID = wrapString(m.AuthID)
}
// Unwraps the AuthID field so that PhotoPrism can use it correctly
func (m *Session) unwrapAuthID() {
return
if m.AuthID != "" && strings.HasPrefix(m.AuthID, "<pp>") && strings.HasSuffix(m.AuthID, "</pp>") {
m.AuthID = strings.TrimSuffix(strings.TrimPrefix(m.AuthID, "<pp>"), "</pp>")
}
}
// BeforeCreate creates a random UID if needed before inserting a new row to the database.
func (m *Session) BeforeCreate(scope *gorm.Scope) error {
if rnd.InvalidRefID(m.RefID) {
@ -307,7 +283,6 @@ func (m *Session) BeforeCreate(scope *gorm.Scope) error {
Log("session", "set ref id", scope.SetColumn("RefID", m.RefID))
}
m.wrapAuthID()
if rnd.IsSessionID(m.ID) {
return nil
}
@ -317,36 +292,6 @@ func (m *Session) BeforeCreate(scope *gorm.Scope) error {
return scope.SetColumn("ID", m.ID)
}
// BeforeSave ensures that the AuthID will save correctly on SQLite
func (m *Session) BeforeSave(scope *gorm.Scope) error {
m.wrapAuthID()
return nil
}
// BeforeUpdate ensures that the AuthID will save correctly on SQLite
func (m *Session) BeforeUpdate(scope *gorm.Scope) error {
m.wrapAuthID()
return nil
}
// AfterSave ensures that the AuthID will not have the prefix and suffix added so that it will save correctly on SQLite
func (m *Session) AfterSave(scope *gorm.Scope) error {
m.unwrapAuthID()
return nil
}
// AfterUpdate ensures that the AuthID will not have the prefix and suffix added so that it will save correctly on SQLite
func (m *Session) AfterUpdate(scope *gorm.Scope) error {
m.unwrapAuthID()
return nil
}
// AfterFind ensures that the AuthID will not have the prefix and suffix added so that it will save correctly on SQLite
func (m *Session) AfterFind(scope *gorm.Scope) error {
m.unwrapAuthID()
return nil
}
// SetClient sets the client of this session.
func (m *Session) SetClient(c *Client) *Session {
if c == nil {

2
internal/entity/auth_session_delete.go
View file

@ -49,7 +49,7 @@ func DeleteChildSessions(s *Session) (deleted int) {
found := Sessions{}
if err := Db().Where("auth_id = ? AND auth_method = ?", wrapString(s.ID), authn.MethodSession.String()).Find(&found).Error; err != nil {
if err := Db().Where("auth_id = ? AND auth_method = ?", s.ID, authn.MethodSession.String()).Find(&found).Error; err != nil {
event.AuditErr([]string{"failed to find child sessions", status.Error(err)})
return deleted
}

60
internal/entity/auth_user.go
View file

@ -52,7 +52,7 @@ type User struct {
AuthProvider string `gorm:"type:VARBINARY(128);default:'';" json:"AuthProvider" yaml:"AuthProvider,omitempty"`
AuthMethod string `gorm:"type:VARBINARY(128);default:'';" json:"AuthMethod" yaml:"AuthMethod,omitempty"`
AuthIssuer string `gorm:"type:VARBINARY(255);default:'';" json:"AuthIssuer,omitempty" yaml:"AuthIssuer,omitempty"`
AuthID string `gorm:"type:VARBINARY(264);index;default:'';" json:"AuthID" yaml:"AuthID,omitempty"` // Make sure that you wrap and unwrap if using auth_id in a query. See FindUser below.
AuthID string `gorm:"type:VARBINARY(255);index;default:'';" json:"AuthID" yaml:"AuthID,omitempty"`
UserName string `gorm:"size:200;index;" json:"Name" yaml:"Name,omitempty"`
DisplayName string `gorm:"size:200;" json:"DisplayName" yaml:"DisplayName,omitempty"`
UserEmail string `gorm:"size:255;index;" json:"Email" yaml:"Email,omitempty"`
@ -148,18 +148,18 @@ func FindUser(find User) *User {
stmt = stmt.Where("user_uid = ?", find.UserUID)
} else if authn.ProviderOIDC.Equal(find.AuthProvider) && find.AuthID != "" {
if find.AuthIssuer == "" {
stmt = stmt.Where("auth_provider = ? AND auth_id = ?", find.AuthProvider, wrapString(find.AuthID))
stmt = stmt.Where("auth_provider = ? AND auth_id = ?", find.AuthProvider, find.AuthID)
} else {
stmt = stmt.Where("auth_provider = ? AND (auth_issuer = '' OR auth_issuer = ?) AND auth_id = ?", find.AuthProvider, find.AuthIssuer, wrapString(find.AuthID))
stmt = stmt.Where("auth_provider = ? AND (auth_issuer = '' OR auth_issuer = ?) AND auth_id = ?", find.AuthProvider, find.AuthIssuer, find.AuthID)
}
} else if find.AuthProvider != "" && find.AuthID != "" && find.UserName != "" {
stmt = stmt.Where("auth_provider = ? AND auth_id = ? OR user_name = ?", find.AuthProvider, wrapString(find.AuthID), find.UserName)
stmt = stmt.Where("auth_provider = ? AND auth_id = ? OR user_name = ?", find.AuthProvider, find.AuthID, find.UserName)
} else if find.UserName != "" {
stmt = stmt.Where("user_name = ?", find.UserName)
} else if find.UserEmail != "" {
stmt = stmt.Where("user_email = ?", find.UserEmail)
} else if find.AuthProvider != "" && find.AuthID != "" {
stmt = stmt.Where("auth_provider = ? AND auth_id = ?", find.AuthProvider, wrapString(find.AuthID))
stmt = stmt.Where("auth_provider = ? AND auth_id = ?", find.AuthProvider, find.AuthID)
} else {
return nil
}
@ -382,22 +382,6 @@ func (m *User) Updates(values interface{}) error {
return UnscopedDb().Model(m).Updates(values).Error
}
// Wraps the AuthID field so that SQLite will save it correctly
func (m *User) wrapAuthID() {
return
if m.AuthID != "" && !strings.HasPrefix(m.AuthID, "<pp>") && !strings.HasSuffix(m.AuthID, "</pp>") {
m.AuthID = fmt.Sprintf("<pp>%s</pp>", m.AuthID)
}
}
// Unwraps the AuthID field so that PhotoPrism can use it correctly
func (m *User) unwrapAuthID() {
return
if m.AuthID != "" && strings.HasPrefix(m.AuthID, "<pp>") && strings.HasSuffix(m.AuthID, "</pp>") {
m.AuthID = strings.TrimSuffix(strings.TrimPrefix(m.AuthID, "<pp>"), "</pp>")
}
}
// BeforeCreate sets a random UID if needed before inserting a new row to the database.
func (m *User) BeforeCreate(scope *gorm.Scope) error {
if m.UserSettings != nil {
@ -415,8 +399,6 @@ func (m *User) BeforeCreate(scope *gorm.Scope) error {
Log("user", "set ref id", scope.SetColumn("RefID", m.RefID))
}
m.wrapAuthID()
if rnd.IsUnique(m.UserUID, UserUID) {
return nil
}
@ -425,36 +407,6 @@ func (m *User) BeforeCreate(scope *gorm.Scope) error {
return scope.SetColumn("UserUID", m.UserUID)
}
// BeforeSave ensures that the AuthID will save correctly on SQLite
func (m *User) BeforeSave(scope *gorm.Scope) error {
m.wrapAuthID()
return nil
}
// BeforeUpdate ensures that the AuthID will save correctly on SQLite
func (m *User) BeforeUpdate(scope *gorm.Scope) error {
m.wrapAuthID()
return nil
}
// AfterSave ensures that the AuthID will not have the prefix and suffix added so that it will save correctly on SQLite
func (m *User) AfterSave(scope *gorm.Scope) error {
m.unwrapAuthID()
return nil
}
// AfterUpdate ensures that the AuthID will not have the prefix and suffix added so that it will save correctly on SQLite
func (m *User) AfterUpdate(scope *gorm.Scope) error {
m.unwrapAuthID()
return nil
}
// AfterFind ensures that the AuthID will not have the prefix and suffix added so that it will save correctly on SQLite
func (m *User) AfterFind(scope *gorm.Scope) error {
m.unwrapAuthID()
return nil
}
// IsExpired checks if the user account has expired.
func (m *User) IsExpired() bool {
if m.ExpiresAt == nil {
@ -685,7 +637,7 @@ func (m *User) SetAuthID(id, issuer string) *User {
// Make sure other users do not use the same identifier.
if m.HasUID() && m.AuthProvider != "" {
if err := UnscopedDb().Model(&User{}).
Where("user_uid <> ? AND auth_provider = ? AND auth_id = ? AND super_admin = 0", m.UserUID, m.AuthProvider, wrapString(m.AuthID)).
Where("user_uid <> ? AND auth_provider = ? AND auth_id = ? AND super_admin = 0", m.UserUID, m.AuthProvider, m.AuthID).
Updates(Values{"auth_id": "", "auth_provider": authn.ProviderNone}).Error; err != nil {
event.AuditErr([]string{"user %s", "failed to resolve auth id conflicts", status.Error(err)}, m.RefID)
}