From 7483a4b05b45f93c5f87950c27f8090b4fd53c3d Mon Sep 17 00:00:00 2001
From: Your Name <you@example.com>
Date: Wed, 9 Sep 2026 22:14:00 +0930
Subject: [PATCH] Scope DangerZone OIDC sudo bypass to OIDC-registered users

---
 app/Http/Middleware/DangerZone.php            |  7 ++-
 tests/Feature/Security/DangerZoneOidcTest.php | 58 +++++++++++++++++++
 2 files changed, 63 insertions(+), 2 deletions(-)
 create mode 100644 tests/Feature/Security/DangerZoneOidcTest.php

diff --git a/app/Http/Middleware/DangerZone.php b/app/Http/Middleware/DangerZone.php
index c132e9740..a57b73ebb 100644
--- a/app/Http/Middleware/DangerZone.php
+++ b/app/Http/Middleware/DangerZone.php
@@ -17,8 +17,11 @@ class DangerZone
      */
     public function handle($request, Closure $next)
     {
-        if (config('remote-auth.oidc.enabled')) {
-            // Skip for OIDC/LDAP
+        // Only OIDC-registered users have a random unknown password and cannot
+        // complete sudo-mode password confirmation. Bypassing on the instance
+        // flag alone would drop sudo protection for local users (who have real
+        // passwords) on any OIDC-enabled instance.
+        if (config('remote-auth.oidc.enabled') && $request->user() && $request->user()->register_source === 'oidc') {
             return $next($request);
         }
 
diff --git a/tests/Feature/Security/DangerZoneOidcTest.php b/tests/Feature/Security/DangerZoneOidcTest.php
new file mode 100644
index 000000000..8f4dec999
--- /dev/null
+++ b/tests/Feature/Security/DangerZoneOidcTest.php
@@ -0,0 +1,58 @@
+<?php
+
+use App\Http\Middleware\DangerZone;
+use App\Models\User;
+use Illuminate\Foundation\Testing\LazilyRefreshDatabase;
+use Illuminate\Http\Request;
+use Illuminate\Session\Store;
+use Illuminate\Session\ArraySessionHandler;
+
+uses(LazilyRefreshDatabase::class);
+
+/*
+|--------------------------------------------------------------------------
+| DangerZone OIDC bypass is per-user
+|--------------------------------------------------------------------------
+|
+| The DangerZone middleware must only skip sudo mode for OIDC-registered users
+| (who have a random unknown password), not for every user on an OIDC-enabled
+| instance. Local users have real passwords and must still confirm sudo mode.
+|
+| Note: this middleware class is not currently wired to the `dangerzone` alias
+| (which maps to Laravel's RequirePassword), so this exercises the class
+| directly to guard its logic should it be reused.
+|
+*/
+
+function runDangerZone(User $user): mixed
+{
+    config(['remote-auth.oidc.enabled' => true]);
+
+    $request = Request::create('/settings/security', 'GET');
+    $request->setLaravelSession(new Store('test', new ArraySessionHandler(120)));
+    $request->setUserResolver(fn () => $user);
+
+    return (new DangerZone)->handle($request, function ($req) {
+        return response('passed-through', 200);
+    });
+}
+
+it('still requires sudo mode for a local user on an OIDC instance', function () {
+    $user = User::factory()->create(['register_source' => 'web']);
+    $user->refresh();
+
+    $response = runDangerZone($user);
+
+    expect($response->isRedirect())->toBeTrue();
+    expect($response->headers->get('Location'))->toContain('/i/auth/sudo');
+});
+
+it('bypasses sudo mode for an OIDC-registered user', function () {
+    $user = User::factory()->create(['register_source' => 'oidc']);
+    $user->refresh();
+
+    $response = runDangerZone($user);
+
+    expect($response->getStatusCode())->toBe(200);
+    expect($response->getContent())->toBe('passed-through');
+});