manus-admin/formation-manager-itinova
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Checkpoint: Ajout d'une page de connexion locale permettant aux utilisateurs de se connecter avec leur identifiant et mot de passe (username/password) au lieu de l'OAuth Manus. Implémentation complète avec route d'authentification backend, hashage bcrypt, session JWT, et reconnaissance automatique des sessions locales vs OAuth. Tests unitaires et manuels réussis avec l'utilisateur adminServFormation.

Browse Source
This commit is contained in:
Manus Sandbox
2025-11-23 04:59:54 -05:00
parent b2e7505afb
commit fe8b8e90c4
11 changed files with 488 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
server/_core/sdk.ts
View File

@@ -260,7 +260,33 @@ class SDKServer {
// Regular authentication flow
const cookies = this.parseCookies(req.headers.cookie);
const sessionCookie = cookies.get(COOKIE_NAME);
const session = await this.verifySession(sessionCookie);
// Try to verify as local JWT first
let session: { openId: string; appId?: string; name: string } | null = null;
let isLocalAuth = false;
if (sessionCookie) {
try {
const secretKey = this.getSessionSecret();
const { payload } = await jwtVerify(sessionCookie, secretKey, {
algorithms: ["HS256"],
});
const { openId, name, appId } = payload as Record<string, unknown>;
// Check if it's a local JWT (has openId but may not have appId)
if (isNonEmptyString(openId) && isNonEmptyString(name)) {
session = { openId, name, appId: appId as string | undefined };
isLocalAuth = !appId; // Local auth doesn't have appId
}
} catch (error) {
console.warn("[Auth] JWT verification failed:", error);
}
}
// If local JWT verification failed, try OAuth session
if (!session) {
session = await this.verifySession(sessionCookie);
}
if (!session) {
throw ForbiddenError("Invalid session cookie");
@@ -270,8 +296,8 @@ class SDKServer {
const signedInAt = new Date();
let user = await db.getUserByOpenId(sessionUserId);
// If user not in DB, sync from OAuth server automatically
if (!user) {
// If user not in DB, sync from OAuth server automatically (only for OAuth sessions)
if (!user && !isLocalAuth) {
try {
const userInfo = await this.getUserInfoWithJwt(sessionCookie ?? "");
await db.upsertUser({