sr2/link-stack
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Clean up middleware, add security-headers to non-Zammad pages

Browse source
This commit is contained in:
Darren Clarke 2024-09-04 12:09:28 +02:00
parent 027aac3a92
commit 8c6e954fdf
9 changed files with 81 additions and 62 deletions
Download patch file Download diff file Expand all files Collapse all files

15
apps/link/app/_lib/authentication.ts
View file

@ -101,30 +101,19 @@ export const authOptions: NextAuthOptions = {
callbacks: {
signIn: async ({ user }) => {
const roles = (await getUserRoles(user.email)) ?? [];
return (
roles.includes("admin") ||
roles.includes("agent") ||
process.env.SETUP_MODE === "true"
);
return roles.includes("admin") || roles.includes("agent");
},
session: async ({ session, token }) => {
// @ts-ignore
session.user.roles = token.roles ?? [];
// @ts-ignore
session.user.leafcutter = token.leafcutter; // remove
// @ts-ignore
session.user.zammadCsrfToken = token.zammadCsrfToken;
return session;
},
jwt: async ({ token, user, trigger, session }) => {
jwt: async ({ token, user }) => {
if (user) {
token.roles = (await getUserRoles(user.email)) ?? [];
}
if (session && trigger === "update") {
token.zammadCsrfToken = session.zammadCsrfToken;
}
return token;
},
},

3
apps/link/app/_lib/zammad.ts
View file

@ -1,5 +1,4 @@
import { getServerSession } from "app/_lib/authentication";
import { redirect } from "next/navigation";
import { cookies } from "next/headers";
const getHeaders = async () => {
@ -8,8 +7,6 @@ const getHeaders = async () => {
const headers = {
"Content-Type": "application/json",
Accept: "application/json",
// @ts-ignore
"X-CSRF-Token": session.user.zammadCsrfToken,
"X-Browser-Fingerprint": `${session.expires}`,
Cookie: allCookies
.map((cookie: any) => `${cookie.name}=${cookie.value}`)