jakub/sm-bm-plugin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: reserve /oauth for social sign-in

Browse Source 
The SPA fallback no longer answers /oauth and the paths below it with
index.html, so golem15.sociallogin's start and provider callback routes
reach the backend; /oauthy is still a client route.
This commit is contained in:
Jakub Zych
2026-10-21 00:15:31 +02:00
parent 2536bcb959
commit 438c0b9761
2 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
static.go
View File

@@ -37,9 +37,10 @@ const (
const defaultAdminPath = "/bmadmin"
// reservedPrefixes are the path prefixes the student app never answers: the
// APIs of the plugins and the public uploads. The admin path is added from
// the configuration.
var reservedPrefixes = []string{"/_user", "/_bm", "/_quizzes", "/_presentations", "/api", "/storage"}
// APIs of the plugins, the public uploads and /oauth (the social sign-in
// routes of golem15.sociallogin and their provider callbacks). The admin
// path is added from the configuration.
var reservedPrefixes = []string{"/_user", "/_bm", "/_quizzes", "/_presentations", "/api", "/storage", "/oauth"}
// errMissingIndex reports a tree without index.html (an unbuilt tree).
var errMissingIndex = errors.New("jz.bm: public/index.html missing; run the frontend build (cd frontend && npm ci && npm run build)")

3
static_test.go
View File

@@ -116,6 +116,7 @@ func TestStaticReservedPaths(t *testing.T) {
"/_presentations", "/_presentations/api/v1/nope",
"/bmadmin", "/bmadmin/", "/bmadmin/login", "/storage/app/uploads/public/x.pdf",
"/storage", "/_user/../_user/x", "//_bm/api",
"/oauth", "/oauth/microsoft", "/oauth/microsoft/callback",
} {
rec := get(h, http.MethodGet, p, nil)
if rec.Code != http.StatusNotFound || strings.Contains(rec.Body.String(), "app") {
@@ -123,7 +124,7 @@ func TestStaticReservedPaths(t *testing.T) {
}
}
// Names that merely start like a reserved prefix are client routes.
for _, p := range []string{"/bmadmins", "/storage-info", "/_users"} {
for _, p := range []string{"/bmadmins", "/storage-info", "/_users", "/oauthy"} {
if rec := get(h, http.MethodGet, p, nil); rec.Code != http.StatusOK {
t.Fatalf("GET %s = %d, want the fallback", p, rec.Code)
}