Method acceptOAuth2LoginRequest

consent/handler.go:430–504

swagger:route PUT /admin/oauth2/auth/requests/login/accept oAuth2 acceptOAuth2LoginRequest # Accept OAuth 2.0 Login Request When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, Ory asks the login provider to authenticate the subject and then tell the Ory OAuth2 Service abou

(w http.ResponseWriter, r *http.Request)

//	Extensions:
//	  x-ory-ratelimit-bucket: hydra-admin-low
func (h *Handler) acceptOAuth2LoginRequest(w http.ResponseWriter, r *http.Request) {
	var err error
	ctx, span := h.r.Tracer(r.Context()).Tracer().Start(r.Context(), "consent.acceptOAuth2LoginRequest")
	defer otelx.End(span, &err)

	challenge := cmp.Or(
		r.URL.Query().Get("login_challenge"),
		r.URL.Query().Get("challenge"),
	)
	if challenge == "" {
		h.r.Writer().WriteError(w, r, errors.WithStack(fosite.ErrInvalidRequest.WithHint(`Query parameter 'challenge' is not defined but should have been.`)))
		return
	}

	var payload flow.HandledLoginRequest
	if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
		h.r.Writer().WriteError(w, r, errors.WithStack(fosite.ErrInvalidRequest.WithWrap(err).WithHintf("Unable to decode body because: %s", err)))
		return
	}

	if payload.Subject == "" {
		h.r.Writer().WriteError(w, r, errors.WithStack(fosite.ErrInvalidRequest.WithHint("Field 'subject' must not be empty.")))
		return
	}

	f, err := flow.DecodeFromLoginChallenge(ctx, h.r, challenge)
	if err != nil {
		h.r.Writer().WriteError(w, r, err)
		return
	} else if f.Subject != "" && payload.Subject != f.Subject {
		// The subject that was confirmed by the login screen does not match what we
		// remembered in the session cookie. We handle this gracefully by redirecting the
		// original authorization request URL, but attaching "prompt=login" to the query.
		// This forces the user to log in again.
		requestURL, err := url.Parse(f.RequestURL)
		if err != nil {
			h.r.Writer().WriteError(w, r, err)
			return
		}
		h.r.Writer().Write(w, r, &flow.OAuth2RedirectTo{
			RedirectTo: urlx.SetQuery(requestURL, url.Values{"prompt": {"login"}}).String(),
		})
		return
	}

	if f.LoginSkip {
		payload.Remember = true // If skip is true remember is also true to allow consecutive calls as the same user!
	} else {
		f.LoginAuthenticatedAt = sqlxx.NullTime(time.Now().UTC().
			// Rounding is important to avoid SQL time synchronization issues in e.g. MySQL!
			Truncate(time.Second))
	}

	if err := f.HandleLoginRequest(&payload); err != nil {
		h.r.Writer().WriteError(w, r, errors.WithStack(err))
		return
	}