fix: device flow - mark codes as already used at the right time

panva · Apr 16, 2019 · 7b913fd · 7b913fd
1 parent 7c14f5b
commit 7b913fd
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 5 deletions.
diff --git a/lib/actions/code_verification.js b/lib/actions/code_verification.js
@@ -95,9 +95,6 @@ module.exports = {
         throw new AbortedError();
       }
 
-      code.inFlight = true;
-      await code.save();
-
       if (!confirm) {
         const client = await ctx.oidc.provider.Client.find(code.clientId);
         if (!client) {
@@ -116,6 +113,9 @@ module.exports = {
         return;
       }
 
+      code.inFlight = true;
+      await code.save();
+
       await next();
     },
 

diff --git a/lib/helpers/initialize_app.js b/lib/helpers/initialize_app.js
@@ -199,7 +199,6 @@ module.exports = function initializeApp() {
     post('device_authorization', routes.device_authorization, error(this, 'device_authorization.error'), tokenCors, ...deviceAuthorization);
     options('cors.device_authorization', routes.device_authorization, tokenCors);
 
-    // TODO: cancel inside interaction doesn't assign this to the code
     const postCodeVerification = getAuthorization(this, 'code_verification');
     get('code_verification', routes.code_verification, error(this, 'code_verification.error'), ...codeVerification.get);
     post('code_verification', routes.code_verification, error(this, 'code_verification.error'), ...codeVerification.post, ...postCodeVerification);

diff --git a/lib/shared/error_handler.js b/lib/shared/error_handler.js
@@ -37,7 +37,6 @@ module.exports = function getErrorHandler(provider, eventName) {
         const secret = crypto.randomBytes(24).toString('hex');
         ctx.oidc.session.state = { secret };
 
-        // TODO: cancelled inside resume renders "There was an error processing your request"
         await userCodeInputSource(ctx, formHtml.input(provider.pathFor('code_verification'), secret, err.userCode, charset), out, err);
         if (err instanceof ReRenderError) { // render without emit
           return;