Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature/organizations auth secret code #8

Merged
merged 10 commits into from
Jan 3, 2025

Conversation

SuperMuel
Copy link
Owner

@SuperMuel SuperMuel commented Jan 3, 2025

image

Previously, all workspaces were visible to all users. Here we implement a simple Organizations and Authentication feature with Secret Code.

  • Administrators can create Organisations in the database.
  • Each Organisation has a name and a secret code.
  • Each workspace is linked to an organisation.
  • Only users knowing the organisation’s secret code can access the workspaces linked to the organization.
  • The frontend’s landing page show a text input for the secret code. When users enter the secret code for an organization, they can use the app.
  • Each secret code is unique. (No 2 workspaces with the same secret code)

**Warning : This is highly insecure and should not be used to protect confidential data : **

  • Secret Codes are stored in plain text in both DB and maybe the browser
  • The front exchanges the secret code against the organization's ID. We wrongly assume that the org ID can't be guessed, and dangerously use it for authentication.

Once the frontend obtained the Organization ID, it must provide a X-Organization-ID header in each request which is verified in the backend before returning resources.

@SuperMuel SuperMuel merged commit 4d64456 into main Jan 3, 2025
1 check failed
SuperMuel added a commit that referenced this pull request Jan 3, 2025
* Update ingester docs for serperdev

* Organization management

* Mock frontend auth

* gen sdk

* Working auth on front

* Working authentication

* Filter workspace for organizatino

* Improved login

* Update docs

* fix imports
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant