Merge pull request #7094 from overleaf/jpa-redirect-admin-requests

[web] redirect admin users from admin endpoints to the admin domain

GitOrigin-RevId: a4bd7d4f998615efcb46ae9866868af9489c94f5

services/web/app/src/Features/Authorization/AuthorizationMiddleware.js

@@ -7,6 +7,19 @@ const AuthenticationController = require('../Authentication/AuthenticationContro
 const SessionManager = require('../Authentication/SessionManager')
 const TokenAccessHandler = require('../TokenAccess/TokenAccessHandler')
 const { expressify } = require('../../util/promises')
+const {
+  shouldRedirectToAdminDomain,
+} = require('../Helpers/AdminAuthorizationHelper')
+const { getSafeAdminDomainRedirect } = require('../Helpers/UrlHelper')
+
+function handleAdminDomainRedirect(req, res) {
+  if (shouldRedirectToAdminDomain(SessionManager.getSessionUser(req.session))) {
+    logger.warn({ req }, 'redirecting admin user to admin domain')
+    res.redirect(getSafeAdminDomainRedirect(req.originalUrl))
+    return true
+  }
+  return false
+}
 
 async function ensureUserCanReadMultipleProjects(req, res, next) {
   const projectIds = (req.query.project_ids || '').split(',')
@@ -137,6 +150,7 @@ async function ensureUserIsSiteAdmin(req, res, next) {
     logger.log({ userId }, 'allowing user admin access to site')
     return next()
   }
+  if (handleAdminDomainRedirect(req, res)) return
   logger.log({ userId }, 'denying user admin access to site')
   _redirectToRestricted(req, res, next)
 }
@@ -191,5 +205,6 @@ module.exports = {
   ),
   ensureUserCanAdminProject: expressify(ensureUserCanAdminProject),
   ensureUserIsSiteAdmin: expressify(ensureUserIsSiteAdmin),
+  handleAdminDomainRedirect,
   restricted,
 }

services/web/app/src/Features/Helpers/AdminAuthorizationHelper.js

@@ -2,7 +2,7 @@ const Settings = require('@overleaf/settings')
 
 module.exports = {
   hasAdminAccess,
-  shouldRedirectToAdminPanel,
+  shouldRedirectToAdminDomain,
 }
 
 function hasAdminAccess(user) {
@@ -11,8 +11,9 @@ function hasAdminAccess(user) {
   return Boolean(user.isAdmin)
 }
 
-function shouldRedirectToAdminPanel(user) {
+function shouldRedirectToAdminDomain(user) {
   if (Settings.adminPrivilegeAvailable) return false
+  if (!Settings.adminUrl) return false
   if (!user) return false
   return Boolean(user.isAdmin)
 }

services/web/app/src/Features/Helpers/UrlHelper.js

@@ -24,9 +24,14 @@ function getSafeRedirectPath(value) {
   return safePath
 }
 
-const UrlHelper = {
+function getSafeAdminDomainRedirect(path) {
+  return Settings.adminUrl + (getSafeRedirectPath(path) || '/')
+}
+
+module.exports = {
   getCanonicalURL,
   getSafeRedirectPath,
+  getSafeAdminDomainRedirect,
   wrapUrlWithProxy(url) {
     // TODO: Consider what to do for Community and Enterprise edition?
     if (!Settings.apis.linkedUrlProxy.url) {
@@ -42,5 +47,3 @@ const UrlHelper = {
     return url
   },
 }
-
-module.exports = UrlHelper

services/web/app/src/Features/TokenAccess/TokenAccessController.js

@@ -9,8 +9,8 @@ const { expressify } = require('../../util/promises')
 const AuthorizationManager = require('../Authorization/AuthorizationManager')
 const PrivilegeLevels = require('../Authorization/PrivilegeLevels')
 const {
-  shouldRedirectToAdminPanel,
-} = require('../Helpers/AdminAuthorizationHelper')
+  handleAdminDomainRedirect,
+} = require('../Authorization/AuthorizationMiddleware')
 
 const orderedPrivilegeLevels = [
   PrivilegeLevels.NONE,
@@ -86,11 +86,9 @@ async function tokenAccessPage(req, res, next) {
   if (!TokenAccessHandler.isValidToken(token)) {
     return next(new Errors.NotFoundError())
   }
-  if (shouldRedirectToAdminPanel(SessionManager.getSessionUser(req.session))) {
-    const path = TokenAccessHandler.isReadOnlyToken(token)
-      ? `/read/${token}`
-      : `/${token}`
-    return res.redirect(settings.adminUrl + path)
+  if (handleAdminDomainRedirect(req, res)) {
+    // Admin users do not join the project, but view it on the admin domain.
+    return
   }
   try {
     if (TokenAccessHandler.isReadOnlyToken(token)) {