oidc cookie cleanup handler (#13097)

Co-authored-by: Andrei Rykov <[email protected]>

6 files changed, 103 insertions, 47 deletions

diff --git a/ydb/mvp/oidc_proxy/oidc_cleanup_page.cpp b/ydb/mvp/oidc_proxy/oidc_cleanup_page.cpp
new file mode 100644
index 00000000000..11934694e73
--- /dev/null
+++ b/ydb/mvp/oidc_proxy/oidc_cleanup_page.cpp
@@ -0,0 +1,44 @@
+#include "openid_connect.h"
+#include "oidc_session_create.h"
+#include "oidc_cleanup_page.h"
+
+namespace NMVP::NOIDC {
+
+THandlerCleanup::THandlerCleanup(const NActors::TActorId& sender,
+                                 const NHttp::THttpIncomingRequestPtr& request,
+                                 const NActors::TActorId& httpProxyId,
+                                 const TOpenIdConnectSettings& settings,
+                                 const TString& cookieName)
+    : Sender(sender)
+    , Request(request)
+    , HttpProxyId(httpProxyId)
+    , Settings(settings)
+    , CookieName(cookieName)
+{}
+
+void THandlerCleanup::Bootstrap() {
+    BLOG_D("Clear cookie: (" << CookieName << ")");
+
+    NHttp::THeadersBuilder responseHeaders;
+    responseHeaders.Set("Set-Cookie", ClearSecureCookie(CookieName));
+    SetCORS(Request, &responseHeaders);
+
+    ReplyAndPassAway(Request->CreateResponse("200", "OK", responseHeaders));
+}
+
+void THandlerCleanup::ReplyAndPassAway(NHttp::THttpOutgoingResponsePtr httpResponse) {
+    Send(Sender, new NHttp::TEvHttpProxy::TEvHttpOutgoingResponse(std::move(httpResponse)));
+    PassAway();
+}
+
+TCleanupPageHandler::TCleanupPageHandler(const NActors::TActorId& httpProxyId, const TOpenIdConnectSettings& settings)
+    : TBase(&TCleanupPageHandler::StateWork)
+    , HttpProxyId(httpProxyId)
+    , Settings(settings)
+{}
+
+void TCleanupPageHandler::Handle(NHttp::TEvHttpProxy::TEvHttpIncomingRequest::TPtr event) {
+    Register(new THandlerCleanup(event->Sender, event->Get()->Request, HttpProxyId, Settings, CreateNameSessionCookie(Settings.ClientId)));
+}
+
+} // NMVP::NOIDC
diff --git a/ydb/mvp/oidc_proxy/oidc_cleanup_page.h b/ydb/mvp/oidc_proxy/oidc_cleanup_page.h
new file mode 100644
index 00000000000..8e2fe0cb562
--- /dev/null
+++ b/ydb/mvp/oidc_proxy/oidc_cleanup_page.h
@@ -0,0 +1,49 @@
+#pragma once
+
+#include "oidc_settings.h"
+#include "context.h"
+#include <ydb/library/actors/core/events.h>
+
+namespace NMVP::NOIDC {
+
+class THandlerCleanup : public NActors::TActorBootstrapped<THandlerCleanup> {
+private:
+    using TBase = NActors::TActorBootstrapped<THandlerCleanup>;
+
+protected:
+    const NActors::TActorId Sender;
+    const NHttp::THttpIncomingRequestPtr Request;
+    NActors::TActorId HttpProxyId;
+    const TOpenIdConnectSettings Settings;
+    const TString CookieName;
+
+public:
+    THandlerCleanup(const NActors::TActorId& sender,
+                    const NHttp::THttpIncomingRequestPtr& request,
+                    const NActors::TActorId& httpProxyId,
+                    const TOpenIdConnectSettings& settings,
+                    const TString& cookieName);
+
+    void Bootstrap();
+    void ReplyAndPassAway(NHttp::THttpOutgoingResponsePtr httpResponse);
+};
+
+class TCleanupPageHandler : public NActors::TActor<TCleanupPageHandler> {
+    using TBase = NActors::TActor<TCleanupPageHandler>;
+
+    const NActors::TActorId HttpProxyId;
+    const TOpenIdConnectSettings Settings;
+
+public:
+    TCleanupPageHandler(const NActors::TActorId& httpProxyId, const TOpenIdConnectSettings& settings);
+    void Handle(NHttp::TEvHttpProxy::TEvHttpIncomingRequest::TPtr event);
+
+    STFUNC(StateWork) {
+        switch (ev->GetTypeRewrite()) {
+            hFunc(NHttp::TEvHttpProxy::TEvHttpIncomingRequest, Handle);
+            cFunc(NActors::TEvents::TEvPoisonPill::EventType, PassAway);
+        }
+    }
+};
+
+} // NMVP::NOIDC
diff --git a/ydb/mvp/oidc_proxy/oidc_client.cpp b/ydb/mvp/oidc_proxy/oidc_client.cpp
index 0277b80ebda..bd473beb071 100644
--- a/ydb/mvp/oidc_proxy/oidc_client.cpp
+++ b/ydb/mvp/oidc_proxy/oidc_client.cpp
@@ -1,6 +1,7 @@
 #include "oidc_client.h"
 #include "oidc_protected_page_handler.h"
 #include "oidc_session_create_handler.h"
+#include "oidc_cleanup_page.h"
 #include "oidc_impersonate_start_page_nebius.h"
 #include "oidc_impersonate_stop_page_nebius.h"
 
@@ -15,6 +16,12 @@ void InitOIDC(NActors::TActorSystem& actorSystem,
                          )
                      );
 
+    actorSystem.Send(httpProxyId, new NHttp::TEvHttpProxy::TEvRegisterHandler(
+                         "/auth/cleanup",
+                         actorSystem.Register(new TCleanupPageHandler(httpProxyId, settings))
+                         )
+                     );
+
     if (settings.AccessServiceType == NMvp::nebius_v1) {
         actorSystem.Send(httpProxyId, new NHttp::TEvHttpProxy::TEvRegisterHandler(
                             "/impersonate/start",
diff --git a/ydb/mvp/oidc_proxy/oidc_impersonate_stop_page_nebius.cpp b/ydb/mvp/oidc_proxy/oidc_impersonate_stop_page_nebius.cpp
index 214b9b07dcf..417411dd796 100644
--- a/ydb/mvp/oidc_proxy/oidc_impersonate_stop_page_nebius.cpp
+++ b/ydb/mvp/oidc_proxy/oidc_impersonate_stop_page_nebius.cpp
@@ -1,35 +1,10 @@
 #include "openid_connect.h"
 #include "oidc_session_create.h"
+#include "oidc_cleanup_page.h"
 #include "oidc_impersonate_stop_page_nebius.h"
 
 namespace NMVP::NOIDC {
 
-THandlerImpersonateStop::THandlerImpersonateStop(const NActors::TActorId& sender,
-                                                 const NHttp::THttpIncomingRequestPtr& request,
-                                                 const NActors::TActorId& httpProxyId,
-                                                 const TOpenIdConnectSettings& settings)
-    : Sender(sender)
-    , Request(request)
-    , HttpProxyId(httpProxyId)
-    , Settings(settings)
-{}
-
-void THandlerImpersonateStop::Bootstrap() {
-    TString impersonatedCookieName = CreateNameImpersonatedCookie(Settings.ClientId);
-    BLOG_D("Clear impersonated cookie: (" << impersonatedCookieName << ")");
-
-    NHttp::THeadersBuilder responseHeaders;
-    responseHeaders.Set("Set-Cookie", ClearSecureCookie(impersonatedCookieName));
-    SetCORS(Request, &responseHeaders);
-
-    ReplyAndPassAway(Request->CreateResponse("200", "OK", responseHeaders));
-}
-
-void THandlerImpersonateStop::ReplyAndPassAway(NHttp::THttpOutgoingResponsePtr httpResponse) {
-    Send(Sender, new NHttp::TEvHttpProxy::TEvHttpOutgoingResponse(std::move(httpResponse)));
-    PassAway();
-}
-
 TImpersonateStopPageHandler::TImpersonateStopPageHandler(const NActors::TActorId& httpProxyId, const TOpenIdConnectSettings& settings)
     : TBase(&TImpersonateStopPageHandler::StateWork)
     , HttpProxyId(httpProxyId)
@@ -37,7 +12,7 @@ TImpersonateStopPageHandler::TImpersonateStopPageHandler(const NActors::TActorId
 {}
 
 void TImpersonateStopPageHandler::Handle(NHttp::TEvHttpProxy::TEvHttpIncomingRequest::TPtr event) {
-    Register(new THandlerImpersonateStop(event->Sender, event->Get()->Request, HttpProxyId, Settings));
+    Register(new THandlerCleanup(event->Sender, event->Get()->Request, HttpProxyId, Settings, CreateNameImpersonatedCookie(Settings.ClientId)));
 }
 
 } // NMVP::NOIDC
diff --git a/ydb/mvp/oidc_proxy/oidc_impersonate_stop_page_nebius.h b/ydb/mvp/oidc_proxy/oidc_impersonate_stop_page_nebius.h
index f298ef7147a..9e8091d7199 100644
--- a/ydb/mvp/oidc_proxy/oidc_impersonate_stop_page_nebius.h
+++ b/ydb/mvp/oidc_proxy/oidc_impersonate_stop_page_nebius.h
@@ -6,26 +6,6 @@
 
 namespace NMVP::NOIDC {
 
-class THandlerImpersonateStop : public NActors::TActorBootstrapped<THandlerImpersonateStop> {
-private:
-    using TBase = NActors::TActorBootstrapped<THandlerImpersonateStop>;
-
-protected:
-    const NActors::TActorId Sender;
-    const NHttp::THttpIncomingRequestPtr Request;
-    NActors::TActorId HttpProxyId;
-    const TOpenIdConnectSettings Settings;
-
-public:
-    THandlerImpersonateStop(const NActors::TActorId& sender,
-                            const NHttp::THttpIncomingRequestPtr& request,
-                            const NActors::TActorId& httpProxyId,
-                            const TOpenIdConnectSettings& settings);
-
-    void Bootstrap();
-    void ReplyAndPassAway(NHttp::THttpOutgoingResponsePtr httpResponse);
-};
-
 class TImpersonateStopPageHandler : public NActors::TActor<TImpersonateStopPageHandler> {
     using TBase = NActors::TActor<TImpersonateStopPageHandler>;
 
diff --git a/ydb/mvp/oidc_proxy/ya.make b/ydb/mvp/oidc_proxy/ya.make
index 61b522f7563..d812fa27a5b 100644
--- a/ydb/mvp/oidc_proxy/ya.make
+++ b/ydb/mvp/oidc_proxy/ya.make
@@ -10,6 +10,7 @@ SRCS(
     oidc_client.cpp
     openid_connect.cpp
     oidc_settings.cpp
+    oidc_cleanup_page.cpp
     oidc_impersonate_start_page_nebius.cpp
     oidc_impersonate_stop_page_nebius.cpp
     oidc_protected_page_handler.cpp