ThreadCount Community edition

Uniform stock management for healthcare linen rooms. Licensed under the GNU AGPL v3.

app/api/auth/sso/lookup/route.ts

@@ -0,0 +1,26 @@
+import { NextRequest, NextResponse } from "next/server";
+import { sameOriginJson } from "@/lib/csrf";
+import { allow, clientIp } from "@/lib/ratelimit";
+import { facilityForEmail, ssoConfigured } from "@/lib/sso";
+
+export const dynamic = "force-dynamic";
+
+/* Does this address belong to a facility that signs in with single sign-on?
+ *
+ * Asked by the Log in box once an address is typed, so the box can offer "Continue with single
+ * sign-on" before anyone reaches for a password. It answers about a DOMAIN, never a person: a
+ * facility that registered its domain is a fact about the facility, and the reply carries nothing
+ * about whether the address itself has an account. Throttled per address, since it is a lookup
+ * anyone may make. */
+export async function POST(req: NextRequest) {
+  const csrf = sameOriginJson(req);
+  if (csrf) return NextResponse.json({ error: csrf }, { status: 403 });
+  if (!allow("sso-lookup:" + clientIp(req.headers), 60, 15 * 60 * 1000)) return NextResponse.json({ sso: false });
+  if (!ssoConfigured()) return NextResponse.json({ sso: false });
+  let body: { email?: unknown };
+  try { body = await req.json(); } catch { return NextResponse.json({ error: "Bad request" }, { status: 400 }); }
+  const email = String(body.email ?? "").trim().toLowerCase().slice(0, 160);
+  const f = await facilityForEmail(email);
+  if (!f) return NextResponse.json({ sso: false });
+  return NextResponse.json({ sso: true, required: f.ssoRequired, facility: f.name });
+}