groove/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-07-06 09:21:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

OIDC: Improve error messages

Browse source
This commit is contained in:
Denis Arnst 2026-02-05 20:10:18 +01:00
parent 49aeb2da19
commit c2a7615319
No known key found for this signature in database
GPG key ID: D5866C58940197BF
1 changed files with 6 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
server/auth/OidcAuthStrategy.js
View file

@ -175,7 +175,8 @@ class OidcAuthStrategy {
user = await Database.userModel.findUserFromOpenIdUserInfo(userinfo) user = await Database.userModel.findUserFromOpenIdUserInfo(userinfo)
if (user?.error) { if (user?.error) {
throw new AuthError('Invalid userinfo or already linked', 401) Logger.warn(`[OidcAuth] User lookup failed: ${user.error}`)
throw new AuthError(user.error, 401)
} }
if (!user) { if (!user) {
@ -273,7 +274,8 @@ class OidcAuthStrategy {
if (user.type === 'root') { if (user.type === 'root') {
// Check OpenID Group // Check OpenID Group
if (userType !== 'admin') { if (userType !== 'admin') {
throw new AuthError(`Root user "${user.username}" cannot be downgraded to ${userType}. Denying login.`, 403) Logger.warn(`[OidcAuth] Root user "${user.username}" denied login: IdP group maps to "${userType}", not admin`)
throw new AuthError('Root user cannot be downgraded from admin. Denying login.', 403)
} else { } else {
// If root user is logging in via OpenID, we will not change the type // If root user is logging in via OpenID, we will not change the type
return return
@ -286,7 +288,8 @@ class OidcAuthStrategy {
await user.save() await user.save()
} }
} else { } else {
throw new AuthError(`No valid group found in userinfo: ${JSON.stringify(userinfo[groupClaimName], null, 2)}`, 401) Logger.warn(`[OidcAuth] No valid group found in userinfo groups: ${JSON.stringify(userinfo[groupClaimName])}`)
throw new AuthError('No valid group found in userinfo', 401)
} }
} }