search

p2-inc / keycloak-orgs

Single realm, multi-tenancy for SaaS apps
Other
367 stars 65 forks source link

Invitation required action: when selecting no organization to accept, a NPE is thrown #64

Closed mweibel closed 1 year ago

mweibel commented 1 year ago

If you invite a user to an organization and that user unchecks the organization and clicks on "Accept" (with no organization to accept), this throws an NPE:

keycloak-0 keycloak 2023-04-19 12:18:57,320 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (executor-thread-218) Uncaught server error: java.lang.NullPointerException: Cannot invoke "java.util.List.contains(Object)" because "selected" is null
keycloak-0 keycloak     at io.phasetwo.service.auth.invitation.InvitationRequiredAction.lambda$processAction$0(InvitationRequiredAction.java:86)
keycloak-0 keycloak     at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.accept(ForEachOps.java:183)
keycloak-0 keycloak     at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
keycloak-0 keycloak     at java.base/java.util.Iterator.forEachRemaining(Iterator.java:133)
keycloak-0 keycloak     at java.base/java.util.Spliterators$IteratorSpliterator.forEachRemaining(Spliterators.java:1845)
keycloak-0 keycloak     at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
keycloak-0 keycloak     at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
keycloak-0 keycloak     at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:150)

https://github.com/p2-inc/keycloak-orgs/blob/a13228f7369d5dd10308efac2b4c6235a9709510/src/main/java/io/phasetwo/service/auth/invitation/InvitationRequiredAction.java#L86

I assume we'd need to add selected != null && to this condition, so otherwise the organization invite gets revoked which would be the right thing to do. I'm not 100% sure of the implications though, that's why I didn't create a PR right away.

xgp commented 1 year ago

@mweibel Good catch. I think your analysis is exactly right. Please do a PR if you have the time. Otherwise, I'll fix over the weekend.