Skip to content

Commit 5cbd30c

Browse files
myasnikovdaniilmyasnikovdaniil
committed
fix(dashboard): re-auth via /oauth2/sign_in so token-proxy mode works
The default 401 handler navigated to /oauth2/start, which only oauth2-proxy serves. The dashboard gatekeeper runs one of two mutually-exclusive proxies chosen by the cluster's oidc-enabled flag (templates/gatekeeper.yaml), and the token-proxy branch registers only sign_in, sign_out and userinfo under the /oauth2 prefix. There, /oauth2/start fell through to the catch-all reverse-proxy handler, which does not re-verify the token: with a present-but-expired cookie it proxied the request to the console upstream instead of re-authenticating, so the SPA reloaded, 401'd again and looped. /oauth2/sign_in is the one entry point both modes implement. oauth2-proxy's sign_in hands straight off to OAuthStart because the gatekeeper passes --skip-provider-button, and it resolves rd through the same app-director, so the OIDC path behaves exactly as before. token-proxy serves its token form there. rd is not yet honoured by token-proxy, which lands the user on / after sign-in rather than looping. Assisted-By: Claude <[email protected]> Signed-off-by: Myasnikov Daniil <[email protected]>
1 parent 7e91698 commit 5cbd30c

2 files changed

Lines changed: 9 additions & 4 deletions

File tree

‎packages/system/dashboard/images/console/apps/console/src/__tests__/k8s-client/client.unauthorized.test.ts‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ describe("K8sClient onUnauthorized (401) handling", () => {
110110
})
111111

112112
describe("K8sClient default unauthorized handler", () => {
113-
it("redirects to /oauth2/start with the current location preserved as rd", async () => {
113+
it("redirects to /oauth2/sign_in with the current location preserved as rd", async () => {
114114
// jsdom's location.assign is non-configurable, so swap the whole object.
115115
const original = window.location
116116
const assign = vi.fn()
@@ -128,10 +128,12 @@ describe("K8sClient default unauthorized handler", () => {
128128
)
129129

130130
// Relative rd (no origin) preserves the destination without tripping
131-
// oauth2-proxy's open-redirect rejection.
131+
// oauth2-proxy's open-redirect rejection. The target must stay
132+
// /oauth2/sign_in: token-proxy (oidc-enabled=false) serves no
133+
// /oauth2/start, so that path falls through to its catch-all.
132134
expect(assign).toHaveBeenCalledTimes(1)
133135
expect(assign).toHaveBeenCalledWith(
134-
`/oauth2/start?rd=${encodeURIComponent("/apps/postgres?tab=config#x")}`,
136+
`/oauth2/sign_in?rd=${encodeURIComponent("/apps/postgres?tab=config#x")}`,
135137
)
136138
} finally {
137139
Object.defineProperty(window, "location", {

‎packages/system/dashboard/images/console/packages/k8s-client/src/client.ts‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,13 @@ export interface K8sClientConfig {
44
onUnauthorized?: () => void
55
}
66

7+
// /oauth2/sign_in is the only sign-in entry both gatekeeper modes serve:
8+
// oauth2-proxy jumps straight to the provider there (--skip-provider-button)
9+
// and token-proxy renders its token form; /oauth2/start is oauth2-proxy-only.
710
function defaultOnUnauthorized(): void {
811
if (typeof window === "undefined") return
912
const rd = window.location.pathname + window.location.search + window.location.hash
10-
window.location.assign(`/oauth2/start?rd=${encodeURIComponent(rd)}`)
13+
window.location.assign(`/oauth2/sign_in?rd=${encodeURIComponent(rd)}`)
1114
}
1215

1316
export class K8sApiError extends Error {

0 commit comments

Comments
 (0)