@adonis-agora/authkit-server 0.68.1 → 0.68.2

package/build/host/views/account/orgs.edge

@@ -20,14 +20,17 @@
           @if(org.isActive)
             <span>{{ t('account.orgs.active_badge') }}</span>
             <form method="POST" action="{{ accountPaths?.orgs ?? '/account/orgs' }}/deactivate">
+              <input type="hidden" name="_csrf" value="{{ csrfToken }}">
               <button>{{ t('account.orgs.deactivate') }}</button>
             </form>
           @else
             <form method="POST" action="{{ accountPaths?.orgs ?? '/account/orgs' }}/{{ org.id }}/activate">
+              <input type="hidden" name="_csrf" value="{{ csrfToken }}">
               <button>{{ t('account.orgs.activate') }}</button>
             </form>
           @end
           <form method="POST" action="{{ accountPaths?.orgs ?? '/account/orgs' }}/{{ org.id }}/leave">
+            <input type="hidden" name="_csrf" value="{{ csrfToken }}">
             <button>{{ t('account.orgs.leave') }}</button>
           </form>
         </div>
@@ -40,6 +43,7 @@
         <div>
           {{ t('account.orgs.invitation_from', { orgName: inv.orgName, role: inv.role }) }}
           <form method="POST" action="{{ accountPaths?.orgs ?? '/account/orgs' }}/invitations/{{ inv.id }}/accept">
+            <input type="hidden" name="_csrf" value="{{ csrfToken }}">
             <button>{{ t('account.orgs.invitation_accept') }}</button>
           </form>
         </div>
@@ -49,6 +53,7 @@
     @if(allowSelfCreate)
       <h2>{{ t('account.orgs.create_section') }}</h2>
       <form method="POST" action="{{ accountPaths?.orgs ?? '/account/orgs' }}">
+        <input type="hidden" name="_csrf" value="{{ csrfToken }}">
         <input name="name" placeholder="{{ t('account.orgs.create_name_label') }}">
         <input name="slug" placeholder="{{ t('account.orgs.create_slug_label') }}">
         <button>{{ t('account.orgs.create_submit') }}</button>

package/build/src/host/controllers/account_orgs_controller.js

@@ -24,7 +24,11 @@ export default class AccountOrgsController {
         const messages = cfg.messages;
         if (!supportsOrganizations(store)) {
             return cfg.render
-                ? cfg.render(ctx, 'account/orgs', { supported: false, messages })
+                ? cfg.render(ctx, 'account/orgs', {
+                    supported: false,
+                    messages,
+                    csrfToken: ctx.request.csrfToken,
+                })
                 : response.notFound();
         }
         const accountId = session.get(ACCOUNT_SESSION_KEY);
@@ -54,6 +58,7 @@ export default class AccountOrgsController {
             allowSelfCreate: cfg.organizations.allowSelfCreate,
             availableRoles: cfg.organizations.roles,
             messages,
+            csrfToken: ctx.request.csrfToken,
         };
         return cfg.render ? cfg.render(ctx, 'account/orgs', props) : response.notFound();
     }
@@ -252,6 +257,7 @@ export default class AccountOrgsController {
             invitation,
             token: params.token,
             messages: cfg.messages,
+            csrfToken: ctx.request.csrfToken,
         };
         return cfg.render
             ? cfg.render(ctx, 'account/orgs', { ...props, subview: 'accept-invitation' })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "0.68.1",
+  "version": "0.68.2",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",