search

beyond-all-reason / teiserver

Middleware server for online gaming
https://www.beyondallreason.info/
MIT License
61 stars 53 forks source link

Live endpoints that require authentication are piped through the :protected pipeline #498

Closed bigbluejay9 closed 1 month ago

bigbluejay9 commented 1 month ago

As detailed in https://github.com/beyond-all-reason/teiserver/issues/175#issuecomment-2385399045, live endpoints that redirect to '/login' on mount cannot set the _redirected_to cookie. Therefore, when unlogged in users try to access a live endpoint, they will be redirected to '/login', and upon logging in be redirected to '/' instead of their original destination.

This change ensures that all live endpoints use the :protected pipeline, which can redirect users back to their original destination once they completed logging in.

Added a bunch of tests to verify that the live endpoints require authentication. Added a specific test to ensure that users are redirected back to the edit password page when they complete logging in (the original reported issue in #175).

Addresses #175

bigbluejay9 commented 1 month ago

The _live_tests.exs tests might be excessive. LMK if you'd like me to remove them.