fix: skip the origin check for bearer-transport auth requests

Bearer transport reads no cookies, so a cross-site request has no session
to ride on. The JS, Go and Rust adapters apply the check to cookie
sessions only; this matches them. Cookie sessions on the guard keep it.

Closes #28

Author: Bccorb

README.md

@@ -145,7 +145,9 @@ while cookies are `SameSite=None` and only for methods other than `GET`, `HEAD`
 - With no `Sec-Fetch-Site`, an `Origin: null` answers 403, and when `allowed_origins` is set any
   other `Origin` must be on it. A request with neither header passes.
 
-A bearer token is never attached by a browser, so it is not checked.
+A bearer token is never attached by a browser, so it is not checked. For the same reason the auth
+routes skip the check on a bearer-transport request (`x-seamless-auth-transport: bearer`), which
+reads no cookies.
 
 `User.organization_id` is the active organization, from the `org_id` claim of the verified access
 token, or `None` when the session has none. Like `User.roles`, it never comes from the cookie.

src/seamless_auth/_adapter.py

@@ -326,11 +326,14 @@ def handle(self, request: AuthRequest) -> AuthResponse:
             return _json_response(500, {"error": "internal_error"})
 
     def _handle(self, request: AuthRequest) -> AuthResponse:
-        blocked = self._check_origin(request.method, request.headers)
-        if blocked is not None:
-            return self._write(blocked, bearer=False)
-
         bearer = (request.headers.get(TRANSPORT_HEADER) or "").lower() == "bearer"
+        # Bearer transport reads no cookies, so a cross-site request has nothing of the
+        # user's to ride on. A custom header also needs a CORS preflight to be sent.
+        if not bearer:
+            blocked = self._check_origin(request.method, request.headers)
+            if blocked is not None:
+                return self._write(blocked, bearer=False)
+
         forwarded = self._forwarded(request)
         method = request.method.upper()
         # Matched on segments, as manifest routes are, so /logout/ and //logout are

tests/test_adapter.py

@@ -531,6 +531,22 @@ def test_cross_site_state_changes_are_blocked(api: FakeApi) -> None:
     assert r.status == 400
 
 
+def test_bearer_transport_skips_the_origin_check(api: FakeApi) -> None:
+    api.on("POST", "/login", respond(400, {"error": "invalid_request"}))
+    adapter = api.adapter(allowed_origins=["https://app.example"])
+    for headers in ({"sec-fetch-site": "cross-site"}, {"origin": "null"}):
+        r = call(
+            adapter,
+            "POST",
+            "/login",
+            body="{}",
+            headers={"x-seamless-auth-transport": "bearer", **headers},
+        )
+        assert r.status == 400, r.text
+        r = call(adapter, "POST", "/login", body="{}", headers=headers)
+        assert (r.status, r.body) == (403, {"error": "cross_site_request_blocked"})
+
+
 APP = "https://app.example"
 ORIGIN_CASES = [
     # (allowlist, same_site, method, sec-fetch-site, origin, blocked)