implement the rest of login process incl. cookie redirects and 'next'

1 files changed, 38 insertions, 9 deletions

diff --git a/routes/login.php b/routes/login.php
index 2f73271..ea81c3b 100644
--- a/routes/login.php
+++ b/routes/login.php
@@ -1,16 +1,33 @@
 <?php
 
+function nextTarget(array $config, string $sid): string {
+    if (count($config['site']['cookie-domains'] ?? []) > 0) {
+        $next = 'https://' . $config['site']['cookie-domains'][0] . '/continue'
+              . '?sid=' . urlencode($sid);
+        if (isset($_GET['next'])) {
+            $next .= '&next=' . urlencode($_GET['next']);
+        }
+        return $next;
+    }
+    if (isset($_GET['next']) && Psso\isValidRedirect($_GET['next'], $config)) {
+        return $_GET['next'];
+    }
+    return '/';
+}
+
+
 function presentChallenges(
-    Psso\Session $session, Psso\Context $context, ?string $message = null
+    array $config,
+    Psso\Session $session,
+    Psso\Context $context,
+    ?string $message = null
 ) {
     $challengeTypes = Psso\AuthFlow::nextStep($context);
     if ($challengeTypes === true) {
         // auth finished! all good
         $session->setChallenges(null);
-        $session->setIdentity(
-            new Psso\Identity($context->user, $context->groups)
-        );
-        header('Location: /'); //temporary crap for testing
+        $session->setIdentity(Psso\Identity::fromContext($context));
+        header('Location: ' . nextTarget($config, $session->token));
         return;
     }
     if (count($challengeTypes) == 0) {
@@ -27,6 +44,7 @@ function presentChallenges(
     // send challenges to user
     $resp = new Psso\XMLResponse;
     $resp->doc->addAttribute('title', L('login.title'));
+    $resp->doc->addAttribute('kind', 'challenges');
     if (isset($message)) {
         $resp->doc->addChild('challenge-message', L($message));
     }
@@ -39,7 +57,8 @@ function presentChallenges(
     $session->setChallenges($challenges);
 }
 
-function GET() {
+
+function GET(array $config) {
     $session = Psso\Session::get();
     if ($session->getIdentity() !== null) {
         // already logged in
@@ -47,9 +66,10 @@ function GET() {
     }
     
     $context = new Psso\Context;
-    presentChallenges($session, $context);
+    presentChallenges($config, $session, $context);
 }
 
+
 function POST(array $config) {
     $session = Psso\Session::get();
     
@@ -75,9 +95,18 @@ function POST(array $config) {
     $context = $answeredChallenge->context;
     $context->addResult($result);
 
-    // also set the user in context if we're able to
+    // also set the user and groups in context if we're able to
     if ($result->successful && isset($result->user) && !isset($context->user)) {
         $context->user = $result->user;
+        if ($provider instanceof Psso\AuthInterface\Groups) {
+            $context->groups = $provider->userGroups($context->user);
+        }
+        if ($provider instanceof Psso\AuthInterface\UserExtra) {
+            $context->extras['name'] =
+                $provider->userDisplayName($context->user);
+            $context->extras['email'] =
+                $provider->userEmailAddress($context->user);
+        }
     }
-    presentChallenges($session, $context, $result->message);
+    presentChallenges($config, $session, $context, $result->message);
 }