Secure-Selector · 원격 업무환경 접속 제어

1    @app.post("/v1/targets/{target_id}/leases", response_model=LeaseResponse, status_code=status.HTTP_201_CREATED)
2    async def acquire_lease(
3        target_id: str,
4        request: LeaseAcquireRequest,
5        idempotency_header: str | None = Header(default=None, alias="Idempotency-Key"),
6        principal: dict[str, Any] = Depends(current_principal),
7    ) -> LeaseResponse:
8        try:
9            value, _ticket, _ticket_expires, reused = app.state.store.acquire(
10                principal["id"], target_id, request.device_id, request.idempotency_key or idempotency_header
11            )
12        except KeyError as exc:
13            raise _error(status.HTTP_404_NOT_FOUND, str(exc.args[0])) from exc
14        except PermissionError as exc:
15            raise _error(status.HTTP_409_CONFLICT, str(exc)) from exc
16        except ValueError as exc:
17            raise _error(status.HTTP_409_CONFLICT, str(exc)) from exc
18        except RuntimeError as exc:
19            raise _error(status.HTTP_409_CONFLICT, str(exc)) from exc
20        except Exception as exc:
21            if _is_unique_violation(exc):
22                raise _error(status.HTTP_409_CONFLICT, "target_in_use") from exc
23            raise
24        response = _lease_model(value)
25        # Reused leases remain idempotent but still return the fresh short ticket.
26        if reused:
27            response.ticket = value.get("ticket")
28        return response

1    public String consume(Environment environment, TunnelRequest request,
2            String authenticatedUsername, TunnelRequestType type, String identifier)
3            throws GuacamoleException {
4
5        if (type != TunnelRequestType.CONNECTION)
6            throw new GuacamoleClientException("Workspace tunnels require a connection destination.");
7
8        String ticket = required(request, TICKET_PARAMETER);
9        String gatewayId = required(request, GATEWAY_PARAMETER);
10        String deviceId = required(request, DEVICE_PARAMETER);
11        String fencingToken = required(request, FENCING_PARAMETER);
12        if (!fencingToken.matches("[1-9][0-9]{0,18}"))
13            throw new GuacamoleClientException("Workspace fencing token is invalid.");
14// ... endpoint 검증·Control API consume 요청 중간 생략 ...
15        if (responseConnectionId == null || !identifier.equals(responseConnectionId)
16                || !gatewayId.equals(responseGatewayId)
17                || !dataSource.equals(responseDataSource)
18                || !deviceId.equals(responseDeviceId)
19                // userId is the canonical Control API display identity and
20                // need not equal the external Gateway username. The explicit
21                // authUsername echo is the value that must match exactly.
22                || responseUserId == null
23                || !authenticatedUsername.equals(responseAuthUsername)
24                || responseFencingToken == null || !responseFencingToken.canConvertToLong()
25                || responseFencingToken.asLong() != Long.parseLong(fencingToken))
26            throw new GuacamoleClientException("Workspace ticket connection binding was rejected.");
27
28        return responseConnectionId;
29    }

1  const revoke = (session: GuacamoleAuthSession): Promise<boolean> => {
2    const token = session.authToken;
3    const pendingSession = pending.get(token);
4    if (completed.has(token) && pendingSession && pendingSession !== session) {
5      // A distinct pending object represents a newer request that was queued
6      // before the completed marker became visible. Keep that boundary
7      // addressable instead of treating it as the late duplicate.
8      completed.delete(token);
9    }
10    if (completed.has(token)) {
11      if (pendingSession === session) pending.delete(token);
12      return Promise.resolve(true);
13    }
14    pending.set(token, session);
15
16    const existingRequest = inFlight.get(token);
17    if (existingRequest) return existingRequest;
18
19    const request = revokeSession(session)
20      .then(() => {
21        if (pending.get(token) === session) {
22          pending.delete(token);
23          completed.add(token);
24        }
25        return true;
26      })
27      .catch(() => false)
28      .finally(() => {
29        if (inFlight.get(token) === request) inFlight.delete(token);
30      });
31
32    inFlight.set(token, request);
33    return request;
34  };