diff --git a/custom_components/auth_oidc/endpoints/callback.py b/custom_components/auth_oidc/endpoints/callback.py index 79ef6bc..5192d19 100644 --- a/custom_components/auth_oidc/endpoints/callback.py +++ b/custom_components/auth_oidc/endpoints/callback.py @@ -34,7 +34,6 @@ async def get(self, request: web.Request) -> web.Response: "error", { "error": "Missing code or state parameter.", - "link": get_url("/auth/oidc/redirect"), }, ) return web.Response(text=view_html, content_type="text/html") @@ -49,7 +48,6 @@ async def get(self, request: web.Request) -> web.Response: { "error": "Failed to get user details, " + "see Home Assistant logs for more information.", - "link": get_url("/auth/oidc/redirect"), }, ) return web.Response(text=view_html, content_type="text/html") diff --git a/custom_components/auth_oidc/endpoints/finish.py b/custom_components/auth_oidc/endpoints/finish.py index 7ac9b21..adfd24a 100644 --- a/custom_components/auth_oidc/endpoints/finish.py +++ b/custom_components/auth_oidc/endpoints/finish.py @@ -2,7 +2,7 @@ from homeassistant.components.http import HomeAssistantView from aiohttp import web -from ..helpers import get_view, get_url +from ..helpers import get_view PATH = "/auth/oidc/finish" @@ -15,21 +15,40 @@ class OIDCFinishView(HomeAssistantView): name = "auth:oidc:finish" async def get(self, request: web.Request) -> web.Response: + """Show the finish screen to allow the user to view their code.""" + + code = request.query.get("code") + + if not code: + view_html = await get_view( + "error", + {"error": "Missing code to show the finish screen."}, + ) + return web.Response(text=view_html, content_type="text/html") + + view_html = await get_view("finish", {"code": code}) + return web.Response(text=view_html, content_type="text/html") + + async def post(self, request: web.Request) -> web.Response: """Receive response.""" - code = request.query.get("code", "FAIL") - link = get_url("/") + # Get code from the message body + data = await request.post() + code = data.get("code") + + if not code: + return web.Response(text="No code received", status=500) - view_html = await get_view("finish", {"code": code, "link": link}) - return web.Response( + # Return redirect to the main page for sign in with a cookie + return web.HTTPFound( + location="/", headers={ - "content-type": "text/html", # Set a cookie to enable autologin on only the specific path used # for the POST request, with all strict parameters set # This cookie should not be read by any Javascript or any other paths. + # It can be really short lifetime as we redirect immediately (15 seconds) "set-cookie": "auth_oidc_code=" + code - + "; Path=/auth/login_flow; SameSite=Strict; HttpOnly; Max-Age=300", + + "; Path=/auth/login_flow; SameSite=Strict; HttpOnly; Max-Age=15", }, - text=view_html, ) diff --git a/custom_components/auth_oidc/endpoints/redirect.py b/custom_components/auth_oidc/endpoints/redirect.py index d938dc4..f95fa77 100644 --- a/custom_components/auth_oidc/endpoints/redirect.py +++ b/custom_components/auth_oidc/endpoints/redirect.py @@ -31,10 +31,7 @@ async def get(self, _: web.Request) -> web.Response: view_html = await get_view( "error", - { - "error": "Integration is misconfigured, discovery could not be obtained.", - "link": get_url("/auth/oidc/redirect"), - }, + {"error": "Integration is misconfigured, discovery could not be obtained."}, ) return web.Response(text=view_html, content_type="text/html") diff --git a/custom_components/auth_oidc/views/error.html b/custom_components/auth_oidc/views/error.html index 0ec54c0..d3a9aec 100644 --- a/custom_components/auth_oidc/views/error.html +++ b/custom_components/auth_oidc/views/error.html @@ -8,7 +8,7 @@
{{ error }}
diff --git a/custom_components/auth_oidc/views/finish.html b/custom_components/auth_oidc/views/finish.html index 9e54b45..6c91500 100644 --- a/custom_components/auth_oidc/views/finish.html +++ b/custom_components/auth_oidc/views/finish.html @@ -7,9 +7,13 @@You have been invited to login to Home Assistant.
Start the login process below.
After login, you will be granted a one-time code to login to any device. You may complete this login on your desktop or any mobile browser and then use the token for any desktop or the Home Assistant app.