From 9b76333b226d1e62580a0503499248ab3910ca51 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E2=80=9CNaeel=E2=80=9D?= <tazet@narod.ru>
Date: Tue, 9 Jun 2026 21:59:26 +0400
Subject: [PATCH] =?UTF-8?q?bump=200.5.30=20=E2=80=94=20restore=20state=20c?=
 =?UTF-8?q?heck,=20clean=20code?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 package.json       |  2 +-
 src/routes/oidc.js | 16 +++++-----------
 2 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/package.json b/package.json
index f039df6..710051d 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ipwhitelist",
-  "version": "0.5.29",
+  "version": "0.5.30",
   "description": "IP WhiteList microservice for cloud provider",
   "main": "server.js",
   "scripts": {
diff --git a/src/routes/oidc.js b/src/routes/oidc.js
index 41de05b..d5fdae5 100644
--- a/src/routes/oidc.js
+++ b/src/routes/oidc.js
@@ -32,15 +32,11 @@ function createRouter({ auth, doubleCsrfProtection, generateCsrfToken, authLimit
   router.get('/callback', async (req, res) => {
     const { code, state } = req.query;
 
-    // ⚠️ ВРЕМЕННО: проверка state отключена для тестирования (2026-06-09)
-    // 🔮 Вернуть когда заработает SSO на managed
     // Проверка state (защита от CSRF на callback)
-    // if (!state || state !== req.session.oidcState) {
-    //   return res.status(403).send('Invalid state parameter');
-    // }
-    // delete req.session.oidcState;
-
-    if (req.session) delete req.session.oidcState;
+    if (!state || state !== req.session.oidcState) {
+      return res.status(403).send('Invalid state parameter');
+    }
+    delete req.session.oidcState;
 
     if (!code) {
       return res.status(400).send('Missing authorization code');
@@ -48,9 +44,7 @@ function createRouter({ auth, doubleCsrfProtection, generateCsrfToken, authLimit
 
     try {
       // Обмен code на токен (через IAM / Keycloak)
-      const tokenData = await auth.exchangeCode(code).catch(e => {
-        throw new Error('Code exchange failed: ' + (e.message || e) + ' [KC_BASE_URL=' + process.env.KC_BASE_URL + ', code=' + (code || '').slice(0, 8) + '...]');
-      });
+      const tokenData = await auth.exchangeCode(code);
       const accessToken = tokenData.accessToken;
 
       if (!accessToken) throw new Error('No access_token in response');