ThreadCount
344b1701dd
Uniform stock management for healthcare linen rooms. Licensed under the GNU AGPL v3.
27 lines
1.5 KiB
TypeScript
27 lines
1.5 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { sameOriginJson } from "@/lib/csrf";
|
|
import { allow, clientIp } from "@/lib/ratelimit";
|
|
import { facilityForEmail, ssoConfigured } from "@/lib/sso";
|
|
|
|
export const dynamic = "force-dynamic";
|
|
|
|
/* Does this address belong to a facility that signs in with single sign-on?
|
|
*
|
|
* Asked by the Log in box once an address is typed, so the box can offer "Continue with single
|
|
* sign-on" before anyone reaches for a password. It answers about a DOMAIN, never a person: a
|
|
* facility that registered its domain is a fact about the facility, and the reply carries nothing
|
|
* about whether the address itself has an account. Throttled per address, since it is a lookup
|
|
* anyone may make. */
|
|
export async function POST(req: NextRequest) {
|
|
const csrf = sameOriginJson(req);
|
|
if (csrf) return NextResponse.json({ error: csrf }, { status: 403 });
|
|
if (!allow("sso-lookup:" + clientIp(req.headers), 60, 15 * 60 * 1000)) return NextResponse.json({ sso: false });
|
|
if (!ssoConfigured()) return NextResponse.json({ sso: false });
|
|
let body: { email?: unknown };
|
|
try { body = await req.json(); } catch { return NextResponse.json({ error: "Bad request" }, { status: 400 }); }
|
|
const email = String(body.email ?? "").trim().toLowerCase().slice(0, 160);
|
|
const f = await facilityForEmail(email);
|
|
if (!f) return NextResponse.json({ sso: false });
|
|
return NextResponse.json({ sso: true, required: f.ssoRequired, facility: f.name });
|
|
}
|