fix(auth): close OIDC callback role/uuid drift and flow defects #124
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "fix/mapps-137-role-parser-uuid-oidc-defects"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Replace the hand-rolled 4-arm role match on the OIDC-callback path with the shared UserRole::from_str parser (same path as auth.rs:206 / :424) so super_admin/technician/dispatcher/sales no longer downgrade to the default role.
Reject an unparseable id_token subject by setting an error and returning early instead of substituting Uuid::nil(), which could collide or corrupt tenant-scoped writes.
In complete_login, check the OP error param before extracting code/state so an OP error response surfaces honestly instead of masking as "missing code".
In the google_oauth hook, batch both AuthContext mutations into one write to avoid a torn-state render, and deregister the message listener after the first valid message so repeated sign-ins do not accumulate duplicate sends.
Correct the tokens.rs and oidc/mod.rs module docs to state the implemented sessionStorage persistence rather than the stale in-memory-only / reload-reauthorizes claim.
#MAPPS-137