fix: session creation - checking tenant for user by tamassoltesz · Pull Request #1063 · supertokens/supertokens-core

tamassoltesz · 2024-10-18T23:37:42Z

Summary of change

When creating a session for a userId which is known by ST, check if the user is part of that tenant.

Related issues

Link to issue1 here
Link to issue1 here

Test Plan

(Write your test plan here. If you changed any code, please provide us with clear instructions on how you verified your
changes work. Bonus points for screenshots and videos!)

Documentation changes

(If relevant, please create a PR in our docs repo, or create a checklist here
highlighting the necessary changes)

Checklist for important updates

sattvikc · 2024-11-05T05:38:38Z

build.gradle

 //}

-version = "9.2.3"
+version = "9.2.4"


should be 9.3.1 ?

sattvikc · 2024-11-05T05:39:08Z

coreDriverInterfaceSupported.json

    "5.0",
-    "5.1"
+    "5.1",
+    "5.2"


Needs updating ?

sattvikc · 2024-11-05T05:39:31Z

CHANGELOG.md

+- Adds support for CDI 5.2
+- In CDI 5.2, when creating a new session for a known user, checks if the user is a member of that tenant.


Should be 5.3 ?

sattvikc · 2024-11-05T05:40:10Z

src/main/java/io/supertokens/session/Session.java

 import io.supertokens.storageLayer.StorageLayer;
 import io.supertokens.useridmapping.UserIdMapping;
 import io.supertokens.useridmapping.UserIdType;
+import io.supertokens.utils.SemVer;


we avoid using SemVer in this layer

sattvikc · 2024-11-05T05:41:51Z

src/main/java/io/supertokens/session/Session.java

                                                            @Nonnull JsonObject userDataInDatabase,
                                                            boolean enableAntiCsrf, AccessToken.VERSION version,
-                                                            boolean useStaticKey)
+                                                            boolean useStaticKey, SemVer semVer)


Instead of passing semVer here, pass a boolean that indicates whether to check the user tenant or not.

sattvikc · 2024-11-05T05:42:29Z

src/main/java/io/supertokens/session/Session.java

                recipeUserId = userIdMappings.get(recipeUserId);
            }
+
+            if(semVer!= null && semVer.greaterThanOrEqualTo(SemVer.v5_2)) {


simply use a boolean whether to do this check or not

sattvikc · 2024-11-05T05:44:43Z

CHANGELOG.md

+
+- Adds support for CDI 5.2
+- In CDI 5.2, when creating a new session for a known user, checks if the user is a member of that tenant.
+  If not, returns UNAUTHORISED.


I don't think UNAUTHORISED is the right thing to return here. You may want to add a different status like USER_DOES_NOT_BELONG_TO_TENANT_ERROR.

sattvikc · 2024-11-05T14:17:08Z

CHANGELOG.md


 CREATE INDEX oauth_logout_challenges_time_created_index ON oauth_logout_challenges(time_created ASC, app_id ASC);
 ```
+>>>>>>> origin/master


merge error?

it is. Sorry I missed this

sattvikc · 2024-11-05T14:18:44Z

src/main/java/io/supertokens/webserver/api/session/SessionAPI.java

            super.sendJsonResponse(200, result, resp);
        } catch (AccessTokenPayloadError e) {
            throw new ServletException(new BadRequestException(e.getMessage()));
+        } catch (UnauthorisedException e) {


catching Unauthorised and returning a different status could get confusing. Create a new exception type for this.

fix: session creation - checking tenant for user

880f22f

tamassoltesz requested review from rishabhpoddar and sattvikc October 18, 2024 23:37

tamassoltesz changed the base branch from 9.2 to 9.3 November 4, 2024 07:58

sattvikc requested changes Nov 5, 2024

View reviewed changes

chore: merging master to feature branch

6c87f28

sattvikc requested changes Nov 5, 2024

View reviewed changes

tamassoltesz added 2 commits November 5, 2024 15:42

fix: review fixes

d2f7e53

chore: changing versions in build file and in changelog

ed671b4

BoomchainLabs approved these changes Jun 26, 2025

View reviewed changes

tamassoltesz closed this Feb 23, 2026

		- Adds support for CDI 5.2
		- In CDI 5.2, when creating a new session for a known user, checks if the user is a member of that tenant.

Comments

Conversation

tamassoltesz commented Oct 18, 2024

Summary of change

Related issues

Test Plan

Documentation changes

Checklist for important updates

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants