@dyrected/core 2.5.40 → 2.5.41

package/dist/server.cjs

@@ -395,13 +395,15 @@ async function executeFieldBeforeChange(fields, data, originalDoc, user, db) {
     let updatedValue = value;
     if (field.hooks?.beforeChange) {
       for (const hook of field.hooks.beforeChange) {
-        updatedValue = await hook({
+        const typedHook = hook;
+        const hookArgs = {
           value: updatedValue,
           originalDoc: originalDoc ?? void 0,
           data: result,
           user,
           db
-        });
+        };
+        updatedValue = await typedHook(hookArgs);
       }
       result[field.name] = updatedValue;
     }
@@ -461,12 +463,14 @@ async function executeFieldAfterRead(fields, doc, user, db) {
     let updatedValue = value;
     if (field.hooks?.afterRead) {
       for (const hook of field.hooks.afterRead) {
-        updatedValue = await hook({
+        const typedHook = hook;
+        const hookArgs = {
           value: updatedValue,
           doc: result,
           user,
           db
-        });
+        };
+        updatedValue = await typedHook(hookArgs);
       }
       result[field.name] = updatedValue;
     }
@@ -2090,13 +2094,396 @@ var AuthController = class {
   }
 };
 
-// src/controllers/preview.controller.ts
-var import_jose2 = require("jose");
+// src/controllers/admin-auth.controller.ts
+var import_node_crypto2 = require("crypto");
 var import_node_util3 = require("util");
+var import_jose2 = require("jose");
+
+// src/utils/admin-auth.ts
+function getAdminAuthCollection(config) {
+  const requestedSlug = config.adminAuth?.collectionSlug;
+  if (requestedSlug) {
+    return config.collections.find((collection) => collection.slug === requestedSlug) ?? null;
+  }
+  return config.collections.find((collection) => collection.slug === "__admins") ?? config.collections.find((collection) => collection.auth) ?? null;
+}
+function getPublicAdminAuthConfig(adminAuth) {
+  const providers = (adminAuth?.providers ?? []).map((provider) => ({
+    id: provider.id,
+    type: provider.type,
+    displayName: provider.displayName || humanizeProviderName(provider.id, provider.type),
+    autoRedirect: provider.autoRedirect
+  }));
+  return {
+    mode: adminAuth?.mode ?? "local",
+    collectionSlug: adminAuth?.collectionSlug,
+    provisioningMode: adminAuth?.provisioningMode,
+    providers
+  };
+}
+function humanizeProviderName(id, type) {
+  const cleaned = id.replace(/[-_]+/g, " ").trim();
+  if (!cleaned) return type.toUpperCase();
+  return cleaned.replace(/\b\w/g, (char) => char.toUpperCase());
+}
+
+// src/controllers/admin-auth.controller.ts
+var AdminAuthController = class {
+  constructor(config) {
+    this.config = config;
+  }
+  config;
+  providers(c) {
+    return c.json(getPublicAdminAuthConfig(this.config.adminAuth));
+  }
+  async start(c) {
+    const provider = this.getProvider(c.req.param("provider"));
+    if (!provider) {
+      return c.json({ error: true, message: "Admin auth provider not found." }, 404);
+    }
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    const returnTo = this.normalizeReturnTo(c.req.query("returnTo"), c);
+    if (provider.type === "oidc") {
+      const redirectUrl = await this.buildOidcStartUrl(
+        provider,
+        returnTo,
+        siteId,
+        new URL(c.req.url).origin
+      );
+      return c.redirect(redirectUrl, 302);
+    }
+    if (!provider.startUrl) {
+      return c.json({ error: true, message: "This provider does not expose a start URL." }, 400);
+    }
+    const url = new URL(provider.startUrl);
+    url.searchParams.set("returnTo", returnTo);
+    if (siteId) url.searchParams.set("siteId", siteId);
+    url.searchParams.set("provider", provider.id);
+    return c.redirect(url.toString(), 302);
+  }
+  async callback(c) {
+    const provider = this.getProvider(c.req.param("provider"));
+    if (!provider) {
+      return c.json({ error: true, message: "Admin auth provider not found." }, 404);
+    }
+    try {
+      const exchange = await this.completeProviderAuth(provider, c);
+      const redirectUrl = new URL(exchange.returnTo);
+      redirectUrl.searchParams.set("dyrectedExternalToken", exchange.token);
+      redirectUrl.searchParams.set("dyrectedAdminCollection", exchange.collectionSlug);
+      return c.redirect(redirectUrl.toString(), 302);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "External authentication failed.";
+      const fallback = this.normalizeReturnTo(c.req.query("returnTo"), c);
+      const redirectUrl = new URL(fallback);
+      redirectUrl.searchParams.set("dyrectedExternalError", message);
+      return c.redirect(redirectUrl.toString(), 302);
+    }
+  }
+  async exchange(c) {
+    const provider = this.getProvider(c.req.param("provider"));
+    if (!provider) {
+      return c.json({ error: true, message: "Admin auth provider not found." }, 404);
+    }
+    try {
+      const exchange = await this.completeProviderAuth(provider, c);
+      return c.json({
+        token: exchange.token,
+        collectionSlug: exchange.collectionSlug,
+        providerId: provider.id
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "External authentication failed.";
+      const status = message === "Access denied for this site." ? 403 : 401;
+      return c.json({ error: true, message }, status);
+    }
+  }
+  async logout(c) {
+    return c.json({ success: true, message: "Logged out. Discard your token." });
+  }
+  getProvider(id) {
+    if (this.config.adminAuth?.mode !== "external") return void 0;
+    return this.config.adminAuth.providers.find((provider) => provider.id === id);
+  }
+  async completeProviderAuth(provider, c) {
+    const resolved = provider.type === "oidc" ? await this.resolveOidcIdentity(provider, c) : await this.resolveCustomIdentity(provider, c);
+    const identity = resolved.identity;
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    const adminCollection = getAdminAuthCollection(this.config);
+    if (!adminCollection?.auth) {
+      throw new Error("Admin auth collection is not configured.");
+    }
+    const db = c.get("config").db;
+    if (!db) throw new Error("Database not configured.");
+    let user = await this.findUserByExternalIdentity(db, adminCollection.slug, provider.id, identity.sub) ?? (identity.email ? (await db.find({
+      collection: adminCollection.slug,
+      where: { email: identity.email },
+      limit: 1
+    })).docs[0] : null);
+    const provisioningMode = this.config.adminAuth?.provisioningMode ?? "jit_plus_membership_management";
+    const allowJitProvisioning = provisioningMode !== "preprovisioned_only" && provider.allowJitProvisioning !== false;
+    if (!user && !allowJitProvisioning) {
+      throw new Error("This account has not been provisioned for admin access.");
+    }
+    const access = await this.resolveAccess(identity, provider.id, siteId, c, user);
+    if (!access.allowed) {
+      throw new Error("Access denied for this site.");
+    }
+    if (!user && allowJitProvisioning) {
+      user = await db.create({
+        collection: adminCollection.slug,
+        data: {
+          ...await this.buildUserData(identity, provider.id, access.roles, access.data),
+          password: await hashPassword((0, import_node_crypto2.randomBytes)(32).toString("hex"))
+        }
+      });
+    } else if (user) {
+      user = await db.update({
+        collection: adminCollection.slug,
+        id: user.id,
+        data: await this.buildUserData(identity, provider.id, access.roles, access.data)
+      });
+    }
+    if (!user?.email) {
+      throw new Error("Authenticated admin user is missing an email address.");
+    }
+    const token = await signCollectionToken({
+      sub: user.id,
+      email: user.email,
+      collection: adminCollection.slug,
+      providerId: provider.id,
+      authSource: "external"
+    });
+    return {
+      token,
+      collectionSlug: adminCollection.slug,
+      returnTo: resolved.returnTo
+    };
+  }
+  async resolveAccess(identity, providerId, siteId, c, user) {
+    const resolved = await this.config.adminAuth?.resolveAccess?.({
+      identity,
+      providerId,
+      siteId,
+      workspaceId: c.get("workspaceId"),
+      req: {
+        method: c.req.method,
+        path: c.req.path,
+        url: c.req.url,
+        headers: Object.fromEntries(c.req.raw.headers.entries())
+      },
+      user
+    });
+    if (resolved) return resolved;
+    return { allowed: true, roles: identity.roles, data: {} };
+  }
+  async buildUserData(identity, providerId, roles, extraData) {
+    return {
+      ...identity.email ? { email: identity.email } : {},
+      ...identity.name ? { name: identity.name } : {},
+      ...roles ? { roles } : {},
+      ...extraData ?? {},
+      authProvider: providerId,
+      externalSubject: identity.sub,
+      authSource: "external",
+      lastLoginAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  async findUserByExternalIdentity(db, collection, providerId, externalSubject) {
+    const result = await db.find({
+      collection,
+      where: {
+        authProvider: providerId,
+        externalSubject
+      },
+      limit: 1
+    });
+    return result.docs[0] ?? null;
+  }
+  async buildOidcStartUrl(provider, returnTo, siteId, origin) {
+    const discovery = await this.getOidcDiscovery(provider);
+    const nonce = (0, import_node_crypto2.randomBytes)(16).toString("hex");
+    const state = await this.signState({
+      providerId: provider.id,
+      returnTo,
+      siteId,
+      nonce
+    });
+    const url = new URL(provider.authorizationEndpoint || discovery.authorization_endpoint);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", provider.clientId);
+    url.searchParams.set("redirect_uri", provider.redirectUri || this.defaultCallbackPath(provider.id, origin));
+    url.searchParams.set("scope", (provider.scopes ?? ["openid", "profile", "email"]).join(" "));
+    url.searchParams.set("state", state);
+    url.searchParams.set("nonce", nonce);
+    return url.toString();
+  }
+  async resolveOidcIdentity(provider, c) {
+    const code = c.req.query("code");
+    const state = c.req.query("state");
+    if (!code || !state) throw new Error("Missing OIDC callback parameters.");
+    const parsedState = await this.verifyState(state, provider.id);
+    const discovery = await this.getOidcDiscovery(provider);
+    const redirectUri = provider.redirectUri || this.defaultCallbackPath(provider.id, new URL(c.req.url).origin);
+    const tokenResponse = await fetch(provider.tokenEndpoint || discovery.token_endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: redirectUri,
+        client_id: provider.clientId,
+        client_secret: provider.clientSecret
+      })
+    });
+    if (!tokenResponse.ok) {
+      throw new Error("OIDC token exchange failed.");
+    }
+    const tokenBody = await tokenResponse.json();
+    const idToken = tokenBody.id_token;
+    let claims = {};
+    if (idToken) {
+      const jwks = (0, import_jose2.createRemoteJWKSet)(new URL(discovery.jwks_uri));
+      const { payload } = await (0, import_jose2.jwtVerify)(idToken, jwks, {
+        issuer: provider.issuer,
+        audience: provider.clientId
+      });
+      if (parsedState.nonce && payload.nonce !== parsedState.nonce) {
+        throw new Error("OIDC nonce verification failed.");
+      }
+      claims = payload;
+    } else if (tokenBody.access_token && (provider.userInfoEndpoint || discovery.userinfo_endpoint)) {
+      const userInfo = await fetch(provider.userInfoEndpoint || discovery.userinfo_endpoint, {
+        headers: { Authorization: `Bearer ${tokenBody.access_token}` }
+      });
+      if (!userInfo.ok) throw new Error("OIDC userinfo request failed.");
+      claims = await userInfo.json();
+    } else {
+      throw new Error("OIDC provider did not return usable identity claims.");
+    }
+    return {
+      identity: this.mapClaims(claims, provider.claimMapping),
+      returnTo: parsedState.returnTo
+    };
+  }
+  async resolveCustomIdentity(provider, c) {
+    const body = c.req.method === "POST" ? await c.req.json().catch(() => ({})) : {};
+    const tokenParam = provider.tokenParam || "token";
+    const token = body?.[tokenParam] || c.req.query(tokenParam);
+    if (!token) {
+      throw new Error(`Missing ${tokenParam} for external auth exchange.`);
+    }
+    let claims;
+    if (provider.secret) {
+      const secret = new import_node_util3.TextEncoder().encode(provider.secret);
+      const verified = await (0, import_jose2.jwtVerify)(token, secret, {
+        issuer: provider.issuer,
+        audience: provider.audience
+      });
+      claims = verified.payload;
+    } else if (provider.jwksUri) {
+      const jwks = (0, import_jose2.createRemoteJWKSet)(new URL(provider.jwksUri));
+      const verified = await (0, import_jose2.jwtVerify)(token, jwks, {
+        issuer: provider.issuer,
+        audience: provider.audience
+      });
+      claims = verified.payload;
+    } else {
+      claims = (0, import_jose2.decodeJwt)(token);
+      if (provider.issuer && claims.iss !== provider.issuer) {
+        throw new Error("External auth issuer mismatch.");
+      }
+      if (provider.audience) {
+        const aud = claims.aud;
+        const matches = Array.isArray(aud) ? aud.includes(provider.audience) : aud === provider.audience;
+        if (!matches) throw new Error("External auth audience mismatch.");
+      }
+    }
+    return {
+      identity: this.mapClaims(claims, provider.claimMapping),
+      returnTo: this.normalizeReturnTo(
+        body?.returnTo || c.req.query("returnTo"),
+        c
+      )
+    };
+  }
+  mapClaims(claims, mapping) {
+    const subKey = mapping?.sub || "sub";
+    const emailKey = mapping?.email || "email";
+    const nameKey = mapping?.name || "name";
+    const rolesKey = mapping?.roles;
+    const groupsKey = mapping?.groups;
+    const siteIdsKey = mapping?.siteIds;
+    const workspaceIdsKey = mapping?.workspaceIds;
+    const sub = claims[subKey];
+    if (typeof sub !== "string" || !sub) {
+      throw new Error("External identity is missing a subject.");
+    }
+    return {
+      sub,
+      email: this.readStringClaim(claims[emailKey]),
+      name: this.readStringClaim(claims[nameKey]),
+      roles: this.readStringArrayClaim(rolesKey ? claims[rolesKey] : void 0),
+      groups: this.readStringArrayClaim(groupsKey ? claims[groupsKey] : void 0),
+      siteIds: this.readStringArrayClaim(siteIdsKey ? claims[siteIdsKey] : void 0),
+      workspaceIds: this.readStringArrayClaim(workspaceIdsKey ? claims[workspaceIdsKey] : void 0),
+      rawClaims: claims
+    };
+  }
+  readStringClaim(value) {
+    return typeof value === "string" ? value : void 0;
+  }
+  readStringArrayClaim(value) {
+    if (!value) return void 0;
+    if (Array.isArray(value)) {
+      return value.filter((entry) => typeof entry === "string");
+    }
+    if (typeof value === "string") return [value];
+    return void 0;
+  }
+  async getOidcDiscovery(provider) {
+    const discoveryUrl = new URL(
+      provider.issuer.replace(/\/$/, "") + "/.well-known/openid-configuration"
+    );
+    const response = await fetch(discoveryUrl.toString());
+    if (!response.ok) throw new Error("Failed to load OIDC discovery document.");
+    return response.json();
+  }
+  defaultCallbackPath(providerId, origin = "") {
+    return `${origin}/api/admin/auth/${providerId}/callback`;
+  }
+  async signState(payload) {
+    return new import_jose2.SignJWT(payload).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime("15m").sign(this.getStateSecret());
+  }
+  async verifyState(token, providerId) {
+    const { payload } = await (0, import_jose2.jwtVerify)(token, this.getStateSecret());
+    const state = payload;
+    if (state.providerId !== providerId) {
+      throw new Error("OIDC state verification failed.");
+    }
+    return state;
+  }
+  getStateSecret() {
+    const secret = process.env.DYRECTED_JWT_SECRET || process.env.JWT_SECRET;
+    if (!secret) {
+      throw new Error("[dyrected/core] DYRECTED_JWT_SECRET is not set.");
+    }
+    return new import_node_util3.TextEncoder().encode(secret);
+  }
+  normalizeReturnTo(returnTo, c) {
+    if (returnTo) return returnTo;
+    const url = new URL(c.req.url);
+    return `${url.origin}/admin`;
+  }
+};
+
+// src/controllers/preview.controller.ts
+var import_jose3 = require("jose");
+var import_node_util4 = require("util");
 var PreviewController = class {
   getSecret() {
     const secret = process.env.DYRECTED_JWT_SECRET || process.env.JWT_SECRET || "dyrected-preview-secret-change-me";
-    return new import_node_util3.TextEncoder().encode(secret);
+    return new import_node_util4.TextEncoder().encode(secret);
   }
   /**
    * POST /api/preview-token
@@ -2107,7 +2494,7 @@ var PreviewController = class {
     if (!body?.collectionSlug || !body?.data) {
       return c.json({ error: true, message: "collectionSlug and data are required." }, 400);
     }
-    const token = await new import_jose2.SignJWT({
+    const token = await new import_jose3.SignJWT({
       collectionSlug: body.collectionSlug,
       documentId: body.documentId,
       data: body.data
@@ -2125,7 +2512,7 @@ var PreviewController = class {
       return c.json({ error: true, message: "token query parameter is required." }, 400);
     }
     try {
-      const { payload } = await (0, import_jose2.jwtVerify)(token, this.getSecret());
+      const { payload } = await (0, import_jose3.jwtVerify)(token, this.getSecret());
       return c.json(payload);
     } catch (err) {
       return c.json({ error: true, message: "Invalid or expired preview token." }, 401);
@@ -3110,6 +3497,9 @@ function registerRoutes(app, config) {
       if (dynamic.admin) {
         config.admin = { ...config.admin, ...dynamic.admin };
       }
+      if (dynamic.adminAuth) {
+        config.adminAuth = { ...config.adminAuth, ...dynamic.adminAuth };
+      }
     }
     const user = c.get("user");
     const accessArgs = { user, req: c.req, doc: null };
@@ -3198,7 +3588,8 @@ function registerRoutes(app, config) {
     return c.json({
       collections: filteredCollections,
       globals: filteredGlobals,
-      admin: config.admin || {}
+      admin: config.admin || {},
+      adminAuth: getPublicAdminAuthConfig(config.adminAuth)
     });
   });
   app.get("/api/dyrected/options/:collection/:field", optionalAuth(), async (c) => {
@@ -3390,6 +3781,12 @@ function registerRoutes(app, config) {
       app.delete(`${prefix}/media/:id`, accessGate(col, "delete"), (c) => mediaController.delete(c));
     }
   }
+  const adminAuthController = new AdminAuthController(config);
+  app.get("/api/admin/auth/providers", (c) => adminAuthController.providers(c));
+  app.get("/api/admin/auth/:provider/start", (c) => adminAuthController.start(c));
+  app.get("/api/admin/auth/:provider/callback", (c) => adminAuthController.callback(c));
+  app.post("/api/admin/auth/:provider/exchange", (c) => adminAuthController.exchange(c));
+  app.post("/api/admin/logout", (c) => adminAuthController.logout(c));
   for (const collection of config.collections) {
     if (!collection.auth) continue;
     const path = `/api/collections/${collection.slug}`;
@@ -3625,6 +4022,10 @@ function normalizeConfig(config) {
   const globals = config?.globals || [];
   const needsAudit = collections.some((col) => col.audit);
   const needsWorkflow = collections.some((col) => col.workflow);
+  const adminAuthCollectionSlug = getAdminAuthCollection({
+    collections,
+    adminAuth: config.adminAuth
+  })?.slug;
   const normalizedCollections = collections.map((col) => {
     let fields = col.fields || [];
     const existingFieldNames = new Set(fields.map((f) => f.name));
@@ -3711,6 +4112,39 @@ function normalizeConfig(config) {
         return field;
       });
     }
+    if (adminAuthCollectionSlug && col.slug === adminAuthCollectionSlug && config.adminAuth?.mode === "external") {
+      const externalAdminFields = [
+        {
+          name: "authProvider",
+          type: "text",
+          label: "Auth Provider",
+          admin: { readOnly: true, hidden: true }
+        },
+        {
+          name: "externalSubject",
+          type: "text",
+          label: "External Subject",
+          admin: { readOnly: true, hidden: true }
+        },
+        {
+          name: "authSource",
+          type: "text",
+          label: "Auth Source",
+          admin: { readOnly: true, hidden: true }
+        },
+        {
+          name: "lastLoginAt",
+          type: "date",
+          label: "Last Login At",
+          admin: { readOnly: true, hidden: true }
+        }
+      ];
+      for (const field of externalAdminFields) {
+        if (!existingFieldNames.has(field.name)) {
+          fields = [...fields, field];
+        }
+      }
+    }
     const updatedFieldNames = new Set(fields.map((f) => f.name));
     const fieldsToInject = SYSTEM_FIELDS.filter((f) => !updatedFieldNames.has(f.name));
     return {

package/dist/server.d.cts

@@ -1,7 +1,7 @@
 import * as hono_types from 'hono/types';
 import * as hono from 'hono';
 import { Hono, Context } from 'hono';
-import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './index-CdQwnbfh.cjs';
+import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './index-DfkPT4NR.cjs';
 import * as hono_utils_http_status from 'hono/utils/http-status';
 import * as hono_utils_types from 'hono/utils/types';
 import 'lucide-react';

package/dist/server.d.ts

@@ -1,7 +1,7 @@
 import * as hono_types from 'hono/types';
 import * as hono from 'hono';
 import { Hono, Context } from 'hono';
-import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './index-CdQwnbfh.js';
+import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './index-DfkPT4NR.js';
 import * as hono_utils_http_status from 'hono/utils/http-status';
 import * as hono_utils_types from 'hono/utils/types';
 import 'lucide-react';