log

apps/api/src/oidc/oidc-interaction.controller.ts

@@ -2,6 +2,9 @@ import { Body, Controller, Get, Param, Post, Req, Res, UnauthorizedException } f
 import { ConfigService } from '@nestjs/config';
 import { Request, Response } from 'express';
 import type { Interaction } from 'oidc-provider';
+import { ApplicationErrorCategory, ApplicationErrorCode } from '../application-error-log/application-error-codes';
+import { ApplicationErrorLoggerService } from '../application-error-log/application-error-logger.service';
+import { RequestContextService } from '../common/request-context.service';
 import { OidcProviderService } from './oidc-provider.service';
 
 @Controller('interaction')
@@ -9,11 +12,28 @@ export class OidcInteractionController {
   constructor(
     private readonly oidc: OidcProviderService,
     private readonly config: ConfigService,
+    private readonly applicationErrorLogger: ApplicationErrorLoggerService,
+    private readonly requestContext: RequestContextService,
   ) {}
 
   @Get(':uid')
   async view(@Param('uid') uid: string, @Req() request: Request, @Res() response: Response) {
-    const details = await this.oidc.interactionDetails(request, response);
+    let details: Interaction;
+    try {
+      details = await this.oidc.interactionDetails(request, response);
+    } catch (error) {
+      await this.logInteractionSessionError(error, uid, request);
+      response
+        .status(400)
+        .send(
+          this.page(
+            'Anmeldung abgelaufen',
+            '<p class="message error" role="alert">Die SSO-Anmeldung ist abgelaufen oder konnte nicht zugeordnet werden. Bitte starten Sie die Anmeldung erneut aus der Anwendung.</p>',
+          ),
+        );
+      return;
+    }
+
     if (details.uid !== uid) {
       response.status(400).send(this.page('Ungueltige Anfrage', '<p>Die OIDC-Interaktion ist ungueltig.</p>'));
       return;
@@ -194,4 +214,33 @@ export class OidcInteractionController {
   private isInvalidCredentialsError(error: unknown): boolean {
     return error instanceof UnauthorizedException && error.message === 'Ungueltige Zugangsdaten.';
   }
+
+  private async logInteractionSessionError(error: unknown, uid: string, request: Request): Promise<void> {
+    const cookieHeader = request.headers.cookie ?? '';
+    await this.applicationErrorLogger.log({
+      error,
+      category: ApplicationErrorCategory.OIDC,
+      code: ApplicationErrorCode.OIDC_INTERACTION_SESSION_NOT_FOUND,
+      module: 'OidcModule',
+      service: OidcInteractionController.name,
+      operation: 'viewInteraction',
+      requestContext: {
+        ...this.requestContext.get(),
+        method: request.method,
+        path: request.originalUrl || request.url,
+        statusCode: 400,
+      },
+      context: {
+        uid,
+        hasCookieHeader: Boolean(cookieHeader),
+        hasInteractionCookie: /(?:^|;\s*)_interaction=/.test(cookieHeader),
+        forwardedProto: request.headers['x-forwarded-proto'],
+        forwardedHost: request.headers['x-forwarded-host'],
+        host: request.headers.host,
+        referer: request.headers.referer,
+        userAgent: request.headers['user-agent'],
+      },
+      handled: true,
+    });
+  }
 }