mirror of
https://github.com/yusufipk/OpenFrame.git
synced 2026-09-11 17:46:06 +00:00
The invitation preview surfaces (/invitations/accept and /register?invitationToken=) are the
only unauthenticated reads of invitation data, and each render costs two database queries.
They are now rate limited before the lookup can touch the database: a generous per-IP bucket
that bounds enumeration across tokens, plus a tight per-IP+token bucket that stops repeated
probing of a single invitation. Tokens are hashed before they reach the rate_limits table.
A throttled lookup says so ("we couldn't check this invitation right now") instead of claiming
the invitation is invalid, and signed-in acceptance is not gated by it.
The callback sanitizer also checked only the origin, which is not enough: an attacker can
smuggle a host into the path of an otherwise same-origin URL — new URL('https://app//evil.com')
keeps our origin but yields a pathname of //evil.com, which navigation sinks resolve as
protocol-relative and follow off-site. Paths are now required to be rooted at a single slash,
and the login redirect re-checks at the sink.
getClientIp is split so server components that only have `await headers()` resolve the client
IP through the same trusted-proxy logic as route handlers.
201 lines
6.7 KiB
TypeScript
201 lines
6.7 KiB
TypeScript
import Link from 'next/link';
|
|
import { Video, UserPlus, LogIn, MailWarning } from 'lucide-react';
|
|
import { Button } from '@/components/ui/button';
|
|
import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card';
|
|
import type { InvitationPreview } from '@/lib/invitations';
|
|
|
|
interface InvitationLandingProps {
|
|
token: string;
|
|
preview: InvitationPreview | null;
|
|
}
|
|
|
|
function Shell({ children }: { children: React.ReactNode }) {
|
|
return (
|
|
<div className="min-h-screen flex items-center justify-center p-4 bg-background">
|
|
<div className="w-full max-w-md">
|
|
<Link href="/" className="flex items-center justify-center gap-2 mb-8">
|
|
<Video className="h-8 w-8 text-primary" />
|
|
<span className="font-bold text-2xl">OpenFrame</span>
|
|
</Link>
|
|
{children}
|
|
</div>
|
|
</div>
|
|
);
|
|
}
|
|
|
|
function UnusableInvitation({ title, message }: { title: string; message: string }) {
|
|
return (
|
|
<Shell>
|
|
<Card>
|
|
<CardHeader className="text-center">
|
|
<CardTitle className="flex items-center justify-center gap-2">
|
|
<MailWarning className="h-5 w-5 text-amber-500" />
|
|
{title}
|
|
</CardTitle>
|
|
<CardDescription>{message}</CardDescription>
|
|
</CardHeader>
|
|
<CardContent className="space-y-3">
|
|
<Button asChild className="w-full">
|
|
<Link href="/login">Sign in</Link>
|
|
</Button>
|
|
<p className="text-center text-sm text-muted-foreground">
|
|
Ask whoever invited you to send a new invitation link.
|
|
</p>
|
|
</CardContent>
|
|
</Card>
|
|
</Shell>
|
|
);
|
|
}
|
|
|
|
/** Too many unauthenticated invitation lookups from this client — nothing was queried. */
|
|
export function InvitationRateLimited() {
|
|
return (
|
|
<UnusableInvitation
|
|
title="Too many attempts"
|
|
message="We couldn't check this invitation right now. Please wait a few minutes and open the link again."
|
|
/>
|
|
);
|
|
}
|
|
|
|
/** Signed in, but with an account whose address the invitation was not issued to. */
|
|
export function InvitationAccountMismatch({
|
|
invitedEmail,
|
|
signedInEmail,
|
|
}: {
|
|
invitedEmail: string;
|
|
signedInEmail: string;
|
|
}) {
|
|
return (
|
|
<Shell>
|
|
<Card>
|
|
<CardHeader className="text-center">
|
|
<CardTitle className="flex items-center justify-center gap-2">
|
|
<MailWarning className="h-5 w-5 text-amber-500" />
|
|
Wrong account
|
|
</CardTitle>
|
|
<CardDescription>
|
|
This invitation was sent to <strong>{invitedEmail}</strong>, but you are signed in as{' '}
|
|
<strong>{signedInEmail}</strong>.
|
|
</CardDescription>
|
|
</CardHeader>
|
|
<CardContent className="space-y-3">
|
|
<Button asChild className="w-full">
|
|
<Link href="/signout">Sign out and switch account</Link>
|
|
</Button>
|
|
<Button asChild variant="outline" className="w-full">
|
|
<Link href="/dashboard">Back to dashboard</Link>
|
|
</Button>
|
|
<p className="text-center text-sm text-muted-foreground">
|
|
After signing out, open the invitation link from your email again.
|
|
</p>
|
|
</CardContent>
|
|
</Card>
|
|
</Shell>
|
|
);
|
|
}
|
|
|
|
export function InvitationLanding({ token, preview }: InvitationLandingProps) {
|
|
const acceptPath = `/invitations/accept?token=${encodeURIComponent(token)}`;
|
|
const loginHref = `/login?callbackUrl=${encodeURIComponent(acceptPath)}`;
|
|
|
|
if (!preview) {
|
|
return (
|
|
<UnusableInvitation
|
|
title="Invitation not found"
|
|
message="This invitation link is invalid. It may have been revoked or replaced by a newer one."
|
|
/>
|
|
);
|
|
}
|
|
|
|
if (preview.status === 'CANCELED') {
|
|
return (
|
|
<UnusableInvitation
|
|
title="Invitation revoked"
|
|
message="This invitation is no longer valid."
|
|
/>
|
|
);
|
|
}
|
|
|
|
if (preview.status === 'EXPIRED' || preview.isExpired) {
|
|
return (
|
|
<UnusableInvitation
|
|
title="Invitation expired"
|
|
message={`The invitation sent to ${preview.email} has expired.`}
|
|
/>
|
|
);
|
|
}
|
|
|
|
const registerHref =
|
|
`/register?invitationToken=${encodeURIComponent(token)}` +
|
|
`&email=${encodeURIComponent(preview.email)}` +
|
|
`&callbackUrl=${encodeURIComponent(acceptPath)}`;
|
|
|
|
const alreadyAccepted = preview.status === 'ACCEPTED';
|
|
const targetLabel = preview.targetName
|
|
? `${preview.targetName} (${preview.scopeLabel})`
|
|
: `a ${preview.scopeLabel}`;
|
|
|
|
return (
|
|
<Shell>
|
|
<Card>
|
|
<CardHeader className="text-center">
|
|
<CardTitle>You've been invited</CardTitle>
|
|
<CardDescription>
|
|
{preview.inviterName} invited you to join <strong>{targetLabel}</strong> on OpenFrame as{' '}
|
|
{preview.roleLabel}.
|
|
</CardDescription>
|
|
</CardHeader>
|
|
<CardContent className="space-y-4">
|
|
<div className="rounded-md border bg-muted/40 p-3 text-sm">
|
|
<p className="text-muted-foreground">
|
|
This invitation was sent to{' '}
|
|
<strong className="text-foreground">{preview.email}</strong>.{' '}
|
|
{preview.hasAccount || alreadyAccepted ? 'Sign in with' : 'Use'} that address to
|
|
accept it.
|
|
</p>
|
|
</div>
|
|
|
|
{preview.hasAccount || alreadyAccepted ? (
|
|
<>
|
|
<Button asChild className="w-full">
|
|
<Link href={loginHref}>
|
|
<LogIn className="h-4 w-4 mr-2" />
|
|
Sign in to accept
|
|
</Link>
|
|
</Button>
|
|
{!alreadyAccepted && (
|
|
<p className="text-center text-sm text-muted-foreground">
|
|
Wrong address?{' '}
|
|
<Link href={registerHref} className="text-primary hover:underline">
|
|
Create an account instead
|
|
</Link>
|
|
</p>
|
|
)}
|
|
</>
|
|
) : (
|
|
<>
|
|
<p className="text-sm text-muted-foreground">
|
|
You don't have an OpenFrame account yet. Create one to open this{' '}
|
|
{preview.scopeLabel} — we'll bring you right back here once you're signed
|
|
in.
|
|
</p>
|
|
<Button asChild className="w-full">
|
|
<Link href={registerHref}>
|
|
<UserPlus className="h-4 w-4 mr-2" />
|
|
Create your account
|
|
</Link>
|
|
</Button>
|
|
<p className="text-center text-sm text-muted-foreground">
|
|
Already have an account?{' '}
|
|
<Link href={loginHref} className="text-primary hover:underline">
|
|
Sign in
|
|
</Link>
|
|
</p>
|
|
</>
|
|
)}
|
|
</CardContent>
|
|
</Card>
|
|
</Shell>
|
|
);
|
|
}
|