Commit b299d590ed68d0c8d7bece74fb2c69e5e0f7f287 | home-infra

author	clover caruso <git@paperclover.net> 2026-10-05 12:08:27-07:00
committer	clover caruso <git@paperclover.net> 2026-10-05 15:36:02-07:00
log	b299d590ed68d0c8d7bece74fb2c69e5e0f7f287
tree	688bac2311f90543c7ac0329ef53bfcfe9e157e6
parent	3bf9328875537be8dc3ab53792a4596b0ab4e1bf
signature	Signed by SSH key SHA256:52mNGHRsVFBDED9IAX5pe+LRWUefqTbxEReunq21QvU

Preserve the guest session cookie on the provider callback

Append the temporary-cookie deletion without overwriting the new Snowglobe session. Log the exact Astheno verification invariant that failed without logging token values. Remove the temporary authorization-code shape diagnostic.

Assisted-by: gpt-6

1 files changed, 73 insertions(+), 47 deletions(-)

dashboard
- src
  - guest.rs

dashboard/src/guest.rs+73-47

 @@ -158,22 +158,33 @@ fn signed_claims(
     nonce: &str,
     require_nonce: bool,
 ) -> Result<Value> {
-    let reject = || {
+    let reject = |reason: &str| {
+        eprintln!(
+            "guest token verification: {} {reason}",
+            if require_nonce {
+                "id_token"
+            } else {
+                "userinfo"
+            }
+        );
         Error::new(
             502,
             "The provider couldn't verify your sign-in. Return to Shale and try again.",
         )
     };
     if token.len() > 32768 {
-        return Err(reject());
+        return Err(reject("size"));
     }
     let parts: Vec<_> = token.split('.').collect();
     if parts.len() != 3 {
-        return Err(reject());
+        return Err(reject("format"));
     }
-    let header: Value =
+    let header: Value = serde_json::from_slice(
-        serde_json::from_slice(&URL_SAFE_NO_PAD.decode(parts[0]).map_err(|_| reject())?)
+        &URL_SAFE_NO_PAD
-            .map_err(|_| reject())?;
+            .decode(parts[0])
+            .map_err(|_| reject("header_encoding"))?,
+    )
+    .map_err(|_| reject("header_json"))?;
     if header
         .get("kid")
         .is_some_and(|id| id.as_str().is_none_or(str::is_empty))
 @@ -182,7 +193,7 @@ fn signed_claims(
         || header.get("jku").is_some()
         || header.get("jwk").is_some()
     {
-        return Err(reject());
+        return Err(reject("header"));
     }
     let matching: Vec<_> = array(&keys["keys"])
         .iter()
 @@ -197,17 +208,17 @@ fn signed_claims(
         })
         .collect();
     if matching.len() != 1 {
-        return Err(reject());
+        return Err(reject("key_selection"));
     }
     let key = matching[0];
     let x = URL_SAFE_NO_PAD
         .decode(string(&key["x"]))
-        .map_err(|_| reject())?;
+        .map_err(|_| reject("key_x"))?;
     let y = URL_SAFE_NO_PAD
         .decode(string(&key["y"]))
-        .map_err(|_| reject())?;
+        .map_err(|_| reject("key_y"))?;
     if x.len() != 32 || y.len() != 32 {
-        return Err(reject());
+        return Err(reject("key_coordinates"));
     }
     let group = EcGroup::from_curve_name(Nid::X9_62_PRIME256V1)?;
     let mut point = EcPoint::new(&group)?;
 @@ -218,9 +229,11 @@ fn signed_claims(
     let ec = EcKey::from_public_key(&group, &point)?;
     ec.check_key()?;
     let key = PKey::from_ec_key(ec)?;
-    let raw = URL_SAFE_NO_PAD.decode(parts[2]).map_err(|_| reject())?;
+    let raw = URL_SAFE_NO_PAD
+        .decode(parts[2])
+        .map_err(|_| reject("signature_encoding"))?;
     if raw.len() != 64 {
-        return Err(reject());
+        return Err(reject("signature_length"));
     }
     let signature = EcdsaSig::from_private_components(
         BigNum::from_slice(&raw[..32])?,
 @@ -230,30 +243,55 @@ fn signed_claims(
     let mut verify = Verifier::new(MessageDigest::sha256(), &key)?;
     verify.update(format!("{}.{}", parts[0], parts[1]).as_bytes())?;
     if !verify.verify(&signature)? {
-        return Err(reject());
+        return Err(reject("signature"));
     }
-    let claims: Value =
+    let claims: Value = serde_json::from_slice(
-        serde_json::from_slice(&URL_SAFE_NO_PAD.decode(parts[1]).map_err(|_| reject())?)
+        &URL_SAFE_NO_PAD
-            .map_err(|_| reject())?;
+            .decode(parts[1])
+            .map_err(|_| reject("claims_encoding"))?,
+    )
+    .map_err(|_| reject("claims_json"))?;
     let time = now() as i64;
     let audience = claims["aud"].as_str().is_some_and(|a| a == client)
         || array(&claims["aud"])
             .iter()
             .any(|a| a.as_str() == Some(client));
-    if claims["iss"] != ASTHENO
+    for (reason, invalid) in [
-        || !audience
+        ("issuer", claims["iss"] != ASTHENO),
-        || (claims["aud"].is_array() && array(&claims["aud"]).len() > 1 && claims["azp"] != client)
+        ("audience", !audience),
-        || claims.get("azp").is_some_and(|a| a != client)
+        (
-        || string(&claims["sub"]).is_empty()
+            "authorized_party",
-        || string(&claims["sub"]).len() > 512
+            (claims["aud"].is_array()
-        || claims["exp"].as_i64().is_none_or(|t| t <= time)
+                && array(&claims["aud"]).len() > 1
-        || claims["iat"].as_i64().is_none_or(|t| t > time + 60)
+                && claims["azp"] != client)
-        || claims
+                || claims.get("azp").is_some_and(|a| a != client),
-            .get("nbf")
+        ),
-            .is_some_and(|t| t.as_i64().is_none_or(|n| n > time + 60))
+        (
-        || (require_nonce && claims["nonce"].as_str() != Some(nonce))
+            "subject",
-    {
+            string(&claims["sub"]).is_empty() || string(&claims["sub"]).len() > 512,
-        return Err(reject());
+        ),
+        (
+            "expiration",
+            claims["exp"].as_i64().is_none_or(|t| t <= time),
+        ),
+        (
+            "issued_at",
+            claims["iat"].as_i64().is_none_or(|t| t > time + 60),
+        ),
+        (
+            "not_before",
+            claims
+                .get("nbf")
+                .is_some_and(|t| t.as_i64().is_none_or(|n| n > time + 60)),
+        ),
+        (
+            "nonce",
+            require_nonce && claims["nonce"].as_str() != Some(nonce),
+        ),
+    ] {
+        if invalid {
+            return Err(reject(reason));
+        }
     }
     Ok(claims)
 }
 @@ -560,17 +598,8 @@ async fn handle(app: &App, request: Request) -> Result<Response> {
                 headers
             })
             .build()?;
-        let (subject, name) = exchange(&http, provider, &client, &secret, code, &callback, &flow)
+        let (subject, name) =
-            .await
+            exchange(&http, provider, &client, &secret, code, &callback, &flow).await?;
-            .map_err(|error| {
-                eprintln!(
-                    "guest rejected code: {provider} length {} whitespace {} dots {}",
-                    code.len(),
-                    code.bytes().any(|c| c.is_ascii_whitespace()),
-                    code.bytes().filter(|c| *c == b'.').count()
-                );
-                error
-            })?;
         let id = account(auth, provider, &subject, &name)?;
         auth.create_session(&id, "dashboard", headers, None)
     }
 @@ -578,11 +607,8 @@ async fn handle(app: &App, request: Request) -> Result<Response> {
     match result {
         Ok(session) => Ok((
             StatusCode::FOUND,
-            [
+            [("location", next), ("set-cookie", session)],
-                ("location", next),
+            axum::response::AppendHeaders([("set-cookie", auth::set_cookie(COOKIE, "", 0))]),
-                ("set-cookie", session),
-                ("set-cookie", auth::set_cookie(COOKIE, "", 0)),
-            ],
         )
             .into_response()),
         Err(error) => {