@dyrected/core 2.5.40 → 2.5.41

package/dist/server.js

@@ -5,13 +5,15 @@ import {
   executeFieldAfterRead,
   executeFieldBeforeChange,
   generateOpenApi,
+  getAdminAuthCollection,
+  getPublicAdminAuthConfig,
   initializeWorkflowDocument,
   materializeWorkflowDocument,
   normalizeConfig,
   runCollectionHooks,
   saveWorkflowDraft,
   transitionWorkflow
-} from "./chunk-YDOBB7MY.js";
+} from "./chunk-FCXE5CVC.js";
 
 // src/app.ts
 import { Hono } from "hono";
@@ -1616,13 +1618,371 @@ var AuthController = class {
   }
 };
 
-// src/controllers/preview.controller.ts
-import { SignJWT as SignJWT2, jwtVerify as jwtVerify2 } from "jose";
+// src/controllers/admin-auth.controller.ts
+import { randomBytes as randomBytes2 } from "crypto";
 import { TextEncoder as TextEncoder2 } from "util";
+import {
+  SignJWT as SignJWT2,
+  createRemoteJWKSet,
+  jwtVerify as jwtVerify2,
+  decodeJwt as decodeJwt2
+} from "jose";
+var AdminAuthController = class {
+  constructor(config) {
+    this.config = config;
+  }
+  config;
+  providers(c) {
+    return c.json(getPublicAdminAuthConfig(this.config.adminAuth));
+  }
+  async start(c) {
+    const provider = this.getProvider(c.req.param("provider"));
+    if (!provider) {
+      return c.json({ error: true, message: "Admin auth provider not found." }, 404);
+    }
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    const returnTo = this.normalizeReturnTo(c.req.query("returnTo"), c);
+    if (provider.type === "oidc") {
+      const redirectUrl = await this.buildOidcStartUrl(
+        provider,
+        returnTo,
+        siteId,
+        new URL(c.req.url).origin
+      );
+      return c.redirect(redirectUrl, 302);
+    }
+    if (!provider.startUrl) {
+      return c.json({ error: true, message: "This provider does not expose a start URL." }, 400);
+    }
+    const url = new URL(provider.startUrl);
+    url.searchParams.set("returnTo", returnTo);
+    if (siteId) url.searchParams.set("siteId", siteId);
+    url.searchParams.set("provider", provider.id);
+    return c.redirect(url.toString(), 302);
+  }
+  async callback(c) {
+    const provider = this.getProvider(c.req.param("provider"));
+    if (!provider) {
+      return c.json({ error: true, message: "Admin auth provider not found." }, 404);
+    }
+    try {
+      const exchange = await this.completeProviderAuth(provider, c);
+      const redirectUrl = new URL(exchange.returnTo);
+      redirectUrl.searchParams.set("dyrectedExternalToken", exchange.token);
+      redirectUrl.searchParams.set("dyrectedAdminCollection", exchange.collectionSlug);
+      return c.redirect(redirectUrl.toString(), 302);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "External authentication failed.";
+      const fallback = this.normalizeReturnTo(c.req.query("returnTo"), c);
+      const redirectUrl = new URL(fallback);
+      redirectUrl.searchParams.set("dyrectedExternalError", message);
+      return c.redirect(redirectUrl.toString(), 302);
+    }
+  }
+  async exchange(c) {
+    const provider = this.getProvider(c.req.param("provider"));
+    if (!provider) {
+      return c.json({ error: true, message: "Admin auth provider not found." }, 404);
+    }
+    try {
+      const exchange = await this.completeProviderAuth(provider, c);
+      return c.json({
+        token: exchange.token,
+        collectionSlug: exchange.collectionSlug,
+        providerId: provider.id
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "External authentication failed.";
+      const status = message === "Access denied for this site." ? 403 : 401;
+      return c.json({ error: true, message }, status);
+    }
+  }
+  async logout(c) {
+    return c.json({ success: true, message: "Logged out. Discard your token." });
+  }
+  getProvider(id) {
+    if (this.config.adminAuth?.mode !== "external") return void 0;
+    return this.config.adminAuth.providers.find((provider) => provider.id === id);
+  }
+  async completeProviderAuth(provider, c) {
+    const resolved = provider.type === "oidc" ? await this.resolveOidcIdentity(provider, c) : await this.resolveCustomIdentity(provider, c);
+    const identity = resolved.identity;
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    const adminCollection = getAdminAuthCollection(this.config);
+    if (!adminCollection?.auth) {
+      throw new Error("Admin auth collection is not configured.");
+    }
+    const db = c.get("config").db;
+    if (!db) throw new Error("Database not configured.");
+    let user = await this.findUserByExternalIdentity(db, adminCollection.slug, provider.id, identity.sub) ?? (identity.email ? (await db.find({
+      collection: adminCollection.slug,
+      where: { email: identity.email },
+      limit: 1
+    })).docs[0] : null);
+    const provisioningMode = this.config.adminAuth?.provisioningMode ?? "jit_plus_membership_management";
+    const allowJitProvisioning = provisioningMode !== "preprovisioned_only" && provider.allowJitProvisioning !== false;
+    if (!user && !allowJitProvisioning) {
+      throw new Error("This account has not been provisioned for admin access.");
+    }
+    const access = await this.resolveAccess(identity, provider.id, siteId, c, user);
+    if (!access.allowed) {
+      throw new Error("Access denied for this site.");
+    }
+    if (!user && allowJitProvisioning) {
+      user = await db.create({
+        collection: adminCollection.slug,
+        data: {
+          ...await this.buildUserData(identity, provider.id, access.roles, access.data),
+          password: await hashPassword(randomBytes2(32).toString("hex"))
+        }
+      });
+    } else if (user) {
+      user = await db.update({
+        collection: adminCollection.slug,
+        id: user.id,
+        data: await this.buildUserData(identity, provider.id, access.roles, access.data)
+      });
+    }
+    if (!user?.email) {
+      throw new Error("Authenticated admin user is missing an email address.");
+    }
+    const token = await signCollectionToken({
+      sub: user.id,
+      email: user.email,
+      collection: adminCollection.slug,
+      providerId: provider.id,
+      authSource: "external"
+    });
+    return {
+      token,
+      collectionSlug: adminCollection.slug,
+      returnTo: resolved.returnTo
+    };
+  }
+  async resolveAccess(identity, providerId, siteId, c, user) {
+    const resolved = await this.config.adminAuth?.resolveAccess?.({
+      identity,
+      providerId,
+      siteId,
+      workspaceId: c.get("workspaceId"),
+      req: {
+        method: c.req.method,
+        path: c.req.path,
+        url: c.req.url,
+        headers: Object.fromEntries(c.req.raw.headers.entries())
+      },
+      user
+    });
+    if (resolved) return resolved;
+    return { allowed: true, roles: identity.roles, data: {} };
+  }
+  async buildUserData(identity, providerId, roles, extraData) {
+    return {
+      ...identity.email ? { email: identity.email } : {},
+      ...identity.name ? { name: identity.name } : {},
+      ...roles ? { roles } : {},
+      ...extraData ?? {},
+      authProvider: providerId,
+      externalSubject: identity.sub,
+      authSource: "external",
+      lastLoginAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  async findUserByExternalIdentity(db, collection, providerId, externalSubject) {
+    const result = await db.find({
+      collection,
+      where: {
+        authProvider: providerId,
+        externalSubject
+      },
+      limit: 1
+    });
+    return result.docs[0] ?? null;
+  }
+  async buildOidcStartUrl(provider, returnTo, siteId, origin) {
+    const discovery = await this.getOidcDiscovery(provider);
+    const nonce = randomBytes2(16).toString("hex");
+    const state = await this.signState({
+      providerId: provider.id,
+      returnTo,
+      siteId,
+      nonce
+    });
+    const url = new URL(provider.authorizationEndpoint || discovery.authorization_endpoint);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", provider.clientId);
+    url.searchParams.set("redirect_uri", provider.redirectUri || this.defaultCallbackPath(provider.id, origin));
+    url.searchParams.set("scope", (provider.scopes ?? ["openid", "profile", "email"]).join(" "));
+    url.searchParams.set("state", state);
+    url.searchParams.set("nonce", nonce);
+    return url.toString();
+  }
+  async resolveOidcIdentity(provider, c) {
+    const code = c.req.query("code");
+    const state = c.req.query("state");
+    if (!code || !state) throw new Error("Missing OIDC callback parameters.");
+    const parsedState = await this.verifyState(state, provider.id);
+    const discovery = await this.getOidcDiscovery(provider);
+    const redirectUri = provider.redirectUri || this.defaultCallbackPath(provider.id, new URL(c.req.url).origin);
+    const tokenResponse = await fetch(provider.tokenEndpoint || discovery.token_endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: redirectUri,
+        client_id: provider.clientId,
+        client_secret: provider.clientSecret
+      })
+    });
+    if (!tokenResponse.ok) {
+      throw new Error("OIDC token exchange failed.");
+    }
+    const tokenBody = await tokenResponse.json();
+    const idToken = tokenBody.id_token;
+    let claims = {};
+    if (idToken) {
+      const jwks = createRemoteJWKSet(new URL(discovery.jwks_uri));
+      const { payload } = await jwtVerify2(idToken, jwks, {
+        issuer: provider.issuer,
+        audience: provider.clientId
+      });
+      if (parsedState.nonce && payload.nonce !== parsedState.nonce) {
+        throw new Error("OIDC nonce verification failed.");
+      }
+      claims = payload;
+    } else if (tokenBody.access_token && (provider.userInfoEndpoint || discovery.userinfo_endpoint)) {
+      const userInfo = await fetch(provider.userInfoEndpoint || discovery.userinfo_endpoint, {
+        headers: { Authorization: `Bearer ${tokenBody.access_token}` }
+      });
+      if (!userInfo.ok) throw new Error("OIDC userinfo request failed.");
+      claims = await userInfo.json();
+    } else {
+      throw new Error("OIDC provider did not return usable identity claims.");
+    }
+    return {
+      identity: this.mapClaims(claims, provider.claimMapping),
+      returnTo: parsedState.returnTo
+    };
+  }
+  async resolveCustomIdentity(provider, c) {
+    const body = c.req.method === "POST" ? await c.req.json().catch(() => ({})) : {};
+    const tokenParam = provider.tokenParam || "token";
+    const token = body?.[tokenParam] || c.req.query(tokenParam);
+    if (!token) {
+      throw new Error(`Missing ${tokenParam} for external auth exchange.`);
+    }
+    let claims;
+    if (provider.secret) {
+      const secret = new TextEncoder2().encode(provider.secret);
+      const verified = await jwtVerify2(token, secret, {
+        issuer: provider.issuer,
+        audience: provider.audience
+      });
+      claims = verified.payload;
+    } else if (provider.jwksUri) {
+      const jwks = createRemoteJWKSet(new URL(provider.jwksUri));
+      const verified = await jwtVerify2(token, jwks, {
+        issuer: provider.issuer,
+        audience: provider.audience
+      });
+      claims = verified.payload;
+    } else {
+      claims = decodeJwt2(token);
+      if (provider.issuer && claims.iss !== provider.issuer) {
+        throw new Error("External auth issuer mismatch.");
+      }
+      if (provider.audience) {
+        const aud = claims.aud;
+        const matches = Array.isArray(aud) ? aud.includes(provider.audience) : aud === provider.audience;
+        if (!matches) throw new Error("External auth audience mismatch.");
+      }
+    }
+    return {
+      identity: this.mapClaims(claims, provider.claimMapping),
+      returnTo: this.normalizeReturnTo(
+        body?.returnTo || c.req.query("returnTo"),
+        c
+      )
+    };
+  }
+  mapClaims(claims, mapping) {
+    const subKey = mapping?.sub || "sub";
+    const emailKey = mapping?.email || "email";
+    const nameKey = mapping?.name || "name";
+    const rolesKey = mapping?.roles;
+    const groupsKey = mapping?.groups;
+    const siteIdsKey = mapping?.siteIds;
+    const workspaceIdsKey = mapping?.workspaceIds;
+    const sub = claims[subKey];
+    if (typeof sub !== "string" || !sub) {
+      throw new Error("External identity is missing a subject.");
+    }
+    return {
+      sub,
+      email: this.readStringClaim(claims[emailKey]),
+      name: this.readStringClaim(claims[nameKey]),
+      roles: this.readStringArrayClaim(rolesKey ? claims[rolesKey] : void 0),
+      groups: this.readStringArrayClaim(groupsKey ? claims[groupsKey] : void 0),
+      siteIds: this.readStringArrayClaim(siteIdsKey ? claims[siteIdsKey] : void 0),
+      workspaceIds: this.readStringArrayClaim(workspaceIdsKey ? claims[workspaceIdsKey] : void 0),
+      rawClaims: claims
+    };
+  }
+  readStringClaim(value) {
+    return typeof value === "string" ? value : void 0;
+  }
+  readStringArrayClaim(value) {
+    if (!value) return void 0;
+    if (Array.isArray(value)) {
+      return value.filter((entry) => typeof entry === "string");
+    }
+    if (typeof value === "string") return [value];
+    return void 0;
+  }
+  async getOidcDiscovery(provider) {
+    const discoveryUrl = new URL(
+      provider.issuer.replace(/\/$/, "") + "/.well-known/openid-configuration"
+    );
+    const response = await fetch(discoveryUrl.toString());
+    if (!response.ok) throw new Error("Failed to load OIDC discovery document.");
+    return response.json();
+  }
+  defaultCallbackPath(providerId, origin = "") {
+    return `${origin}/api/admin/auth/${providerId}/callback`;
+  }
+  async signState(payload) {
+    return new SignJWT2(payload).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime("15m").sign(this.getStateSecret());
+  }
+  async verifyState(token, providerId) {
+    const { payload } = await jwtVerify2(token, this.getStateSecret());
+    const state = payload;
+    if (state.providerId !== providerId) {
+      throw new Error("OIDC state verification failed.");
+    }
+    return state;
+  }
+  getStateSecret() {
+    const secret = process.env.DYRECTED_JWT_SECRET || process.env.JWT_SECRET;
+    if (!secret) {
+      throw new Error("[dyrected/core] DYRECTED_JWT_SECRET is not set.");
+    }
+    return new TextEncoder2().encode(secret);
+  }
+  normalizeReturnTo(returnTo, c) {
+    if (returnTo) return returnTo;
+    const url = new URL(c.req.url);
+    return `${url.origin}/admin`;
+  }
+};
+
+// src/controllers/preview.controller.ts
+import { SignJWT as SignJWT3, jwtVerify as jwtVerify3 } from "jose";
+import { TextEncoder as TextEncoder3 } from "util";
 var PreviewController = class {
   getSecret() {
     const secret = process.env.DYRECTED_JWT_SECRET || process.env.JWT_SECRET || "dyrected-preview-secret-change-me";
-    return new TextEncoder2().encode(secret);
+    return new TextEncoder3().encode(secret);
   }
   /**
    * POST /api/preview-token
@@ -1633,7 +1993,7 @@ var PreviewController = class {
     if (!body?.collectionSlug || !body?.data) {
       return c.json({ error: true, message: "collectionSlug and data are required." }, 400);
     }
-    const token = await new SignJWT2({
+    const token = await new SignJWT3({
       collectionSlug: body.collectionSlug,
       documentId: body.documentId,
       data: body.data
@@ -1651,7 +2011,7 @@ var PreviewController = class {
       return c.json({ error: true, message: "token query parameter is required." }, 400);
     }
     try {
-      const { payload } = await jwtVerify2(token, this.getSecret());
+      const { payload } = await jwtVerify3(token, this.getSecret());
       return c.json(payload);
     } catch (err) {
       return c.json({ error: true, message: "Invalid or expired preview token." }, 401);
@@ -1811,6 +2171,9 @@ function registerRoutes(app, config) {
       if (dynamic.admin) {
         config.admin = { ...config.admin, ...dynamic.admin };
       }
+      if (dynamic.adminAuth) {
+        config.adminAuth = { ...config.adminAuth, ...dynamic.adminAuth };
+      }
     }
     const user = c.get("user");
     const accessArgs = { user, req: c.req, doc: null };
@@ -1899,7 +2262,8 @@ function registerRoutes(app, config) {
     return c.json({
       collections: filteredCollections,
       globals: filteredGlobals,
-      admin: config.admin || {}
+      admin: config.admin || {},
+      adminAuth: getPublicAdminAuthConfig(config.adminAuth)
     });
   });
   app.get("/api/dyrected/options/:collection/:field", optionalAuth(), async (c) => {
@@ -2091,6 +2455,12 @@ function registerRoutes(app, config) {
       app.delete(`${prefix}/media/:id`, accessGate(col, "delete"), (c) => mediaController.delete(c));
     }
   }
+  const adminAuthController = new AdminAuthController(config);
+  app.get("/api/admin/auth/providers", (c) => adminAuthController.providers(c));
+  app.get("/api/admin/auth/:provider/start", (c) => adminAuthController.start(c));
+  app.get("/api/admin/auth/:provider/callback", (c) => adminAuthController.callback(c));
+  app.post("/api/admin/auth/:provider/exchange", (c) => adminAuthController.exchange(c));
+  app.post("/api/admin/logout", (c) => adminAuthController.logout(c));
   for (const collection of config.collections) {
     if (!collection.auth) continue;
     const path = `/api/collections/${collection.slug}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dyrected/core",
-  "version": "2.5.40",
+  "version": "2.5.41",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",