| | | 1 | | using Elsa.Abstractions; |
| | | 2 | | using Elsa.ExternalAuthentication.Models; |
| | | 3 | | using Elsa.ExternalAuthentication.Services; |
| | | 4 | | using Elsa.Identity.Constants; |
| | | 5 | | |
| | | 6 | | namespace Elsa.ExternalAuthentication.Endpoints.Broker; |
| | | 7 | | |
| | | 8 | | internal sealed class Logout(IExternalAuthenticationBroker broker) : ElsaEndpoint<LogoutRequest> |
| | | 9 | | { |
| | | 10 | | public override void Configure() |
| | | 11 | | { |
| | | 12 | | // Deliberately authenticated without a permission: the session id is read from the caller's |
| | | 13 | | // principal below, so an identity is required, but logging out is never permission-gated. |
| | | 14 | | Post("/external-authentication/logout"); |
| | | 15 | | |
| | | 16 | | // Authenticated without a permission: the session id is read from the caller's principal below, |
| | | 17 | | // so an identity is required, but logging out is never permission-gated. |
| | | 18 | | RequireAuthenticatedOnly(); |
| | | 19 | | } |
| | | 20 | | |
| | | 21 | | public override async Task HandleAsync(LogoutRequest request, CancellationToken cancellationToken) |
| | | 22 | | { |
| | | 23 | | var sessionId = HttpContext.User.FindFirst(CustomClaimTypes.ExternalAuthenticationSessionId)?.Value; |
| | | 24 | | if (string.IsNullOrWhiteSpace(sessionId) || !Uri.TryCreate(request.PostLogoutRedirectUri, UriKind.Absolute, out |
| | | 25 | | { |
| | | 26 | | await BrokerEndpointSupport.SendErrorAsync(Send, BrokerErrorFactory.Create(BrokerErrorCategory.InvalidReques |
| | | 27 | | return; |
| | | 28 | | } |
| | | 29 | | |
| | | 30 | | var result = await broker.LogoutAsync(new(request.ClientId ?? string.Empty, redirectUri, request.Mode ?? "local" |
| | | 31 | | if (result.Error is { } error) |
| | | 32 | | { |
| | | 33 | | await BrokerEndpointSupport.SendErrorAsync(Send, error, cancellationToken); |
| | | 34 | | return; |
| | | 35 | | } |
| | | 36 | | |
| | | 37 | | await Send.OkAsync(new LogoutResponse(result.Completed, result.NavigationUri?.ToString(), result.RedirectUri?.To |
| | | 38 | | } |
| | | 39 | | } |
| | | 40 | | |
| | | 41 | | internal sealed class LogoutRequest |
| | | 42 | | { |
| | | 43 | | public string? ClientId { get; set; } |
| | | 44 | | public string? PostLogoutRedirectUri { get; set; } |
| | | 45 | | public string? Mode { get; set; } |
| | | 46 | | } |
| | | 47 | | |
| | | 48 | | internal sealed record LogoutResponse(bool Completed, string? NavigationUrl, string? RedirectUri); |
| | | 49 | | |
| | 11 | 50 | | internal sealed class ContinueLogout(IExternalAuthenticationBroker broker) : ElsaEndpointWithoutRequest |
| | | 51 | | { |
| | | 52 | | public override void Configure() |
| | | 53 | | { |
| | 9 | 54 | | Get("/external-authentication/logout/continue/{handle}"); |
| | | 55 | | |
| | | 56 | | // Anonymous, like every other broker endpoint the browser is navigated to. The single-use |
| | | 57 | | // route handle carries the authority; the caller's Elsa session has already been revoked by |
| | | 58 | | // the time this runs, and a top-level browser navigation sends no Authorization header, so |
| | | 59 | | // this endpoint can never present authenticated credentials. |
| | 9 | 60 | | AllowAnonymous(); |
| | 9 | 61 | | } |
| | | 62 | | |
| | | 63 | | public override async Task HandleAsync(CancellationToken cancellationToken) |
| | | 64 | | { |
| | 2 | 65 | | var result = await broker.ContinueLogoutAsync(Route<string>("handle")!, cancellationToken); |
| | 2 | 66 | | if (result.Error is { } error) |
| | | 67 | | { |
| | 1 | 68 | | await BrokerEndpointSupport.SendErrorAsync(Send, error, cancellationToken); |
| | 1 | 69 | | return; |
| | | 70 | | } |
| | | 71 | | |
| | 1 | 72 | | if (result.NavigationUri is null) |
| | | 73 | | { |
| | 0 | 74 | | await BrokerEndpointSupport.SendErrorAsync(Send, BrokerErrorFactory.Create(BrokerErrorCategory.InvalidReques |
| | 0 | 75 | | return; |
| | | 76 | | } |
| | | 77 | | |
| | | 78 | | // Responses must go through the Send API: writing to HttpContext.Response without starting it |
| | | 79 | | // lets the FastEndpoints auto-response overwrite the status with 204, which silently discarded |
| | | 80 | | // both the redirect and the error this endpoint used to produce. |
| | 1 | 81 | | await Send.RedirectAsync(result.NavigationUri.ToString(), false, true); |
| | 2 | 82 | | } |
| | | 83 | | } |