firecmsco / firecms

Awesome Firebase/Firestore-based CMS. The missing admin panel for your Firebase project!
https://firecms.co
Other
1.13k stars 185 forks source link

Access Control Issue: Inconsistent Login Blocking #585

Closed DanishMehmoodTintash closed 8 months ago

DanishMehmoodTintash commented 9 months ago

Issue Description

I've implemented access control checks in the authenticator function. If a user without access attempts to log in, the authenticator correctly blocks the user. However, if a valid user with access logs in after an unauthorized user in the same browser session, the login page displays an error stating the user is not allowed to access, even though the valid user is successfully logged in behind the scenes. Upon refreshing the page, the user gains access without the need to log in again.

Steps to Reproduce

  1. Log in with an unauthorized user.
  2. Log in with an authorized user without refreshing/closing the browser or session.
  3. Observe the error on the login page.
  4. Refresh the page and notice the access is granted without re-entering credentials.

Expected Behavior

The login page should accurately reflect the current authorized user's status without requiring a page refresh. It should immediately grant access to authorized users and block unauthorized users.

Additional Information

OskarGroth commented 9 months ago

Upon refreshing the page, the user gains access without the need to log in again.

Probably related issue: when doing a fresh login with OAuth, I get the popup and sign in but nothing happens on the login page. I have to force refresh to get into the dashboard. It seems that the user is set but authVerified is not, preventing canAccessMainView from flipping to true.

I think this line is wrong:

https://github.com/firecmsco/firecms/blob/029f3f641be99d6241a4ad827190e8a4ccea5cbe/lib/src/firebase_app/hooks/useValidateAuthenticator.tsx#L114

It should probably be delegateUser not !delegateUser, but hard to tell without comments.

fgatti675 commented 8 months ago

This should be fixed in version 2.2.1 :)

DanishMehmoodTintash commented 7 months ago

@fgatti675 When are you planning to release version 2.2.1?