@punch-in/strapi-admin 1.0.9 → 1.1.0

package/admin/src/containers/AuthPage/index.js

@@ -87,6 +87,59 @@ const AuthPage = ({ hasAdmin, setHasAdmin }) => {
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [authType]);
 
+  // Lands here after a full-page round trip through an SSO provider
+  // (controllers/authentication.js's ssoCallback). The token in the URL is
+  // a normal admin JWT for an *existing* admin the provider's verified
+  // email matched - nothing was created. Fetch the profile it belongs to,
+  // persist it the same way a password login does, then drop both params
+  // from the URL so the JWT doesn't linger in browser history.
+  useEffect(() => {
+    const ssoToken = query.get('ssoToken');
+    const ssoError = query.get('ssoError');
+
+    if (!ssoToken && !ssoError) return;
+
+    window.history.replaceState(null, '', window.location.pathname);
+
+    if (ssoError) {
+      const messages = {
+        access_denied: 'Sign-in was cancelled.',
+        no_admin_account: 'No admin account exists for that email address.',
+        email_not_verified: "That provider didn't return a verified email address.",
+      };
+
+      strapi.notification.toggle({
+        type: 'warning',
+        message: messages[ssoError] || 'Single sign-on failed. Please try again.',
+      });
+      return;
+    }
+
+    const completeSsoLogin = async () => {
+      try {
+        const {
+          data: { data: user },
+        } = await axios.get(`${strapi.backendURL}/admin/users/me`, {
+          headers: { Authorization: `Bearer ${ssoToken}` },
+          cancelToken: source.token,
+        });
+
+        auth.setToken(ssoToken, false);
+        auth.setUserInfo(user, false);
+
+        push('/');
+      } catch (err) {
+        strapi.notification.toggle({
+          type: 'warning',
+          message: 'Single sign-on failed. Please try again.',
+        });
+      }
+    };
+
+    completeSsoLogin();
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+
   const handleChange = ({ target: { name, value } }) => {
     dispatch({
       type: 'ON_CHANGE',

package/config/routes.json

@@ -83,6 +83,21 @@
       "path": "/reset-password",
       "handler": "authentication.resetPassword"
     },
+    {
+      "method": "GET",
+      "path": "/providers",
+      "handler": "authentication.ssoProviders"
+    },
+    {
+      "method": "GET",
+      "path": "/connect/:provider",
+      "handler": "authentication.ssoConnect"
+    },
+    {
+      "method": "GET",
+      "path": "/connect/:provider/callback",
+      "handler": "authentication.ssoCallback"
+    },
     {
       "method": "GET",
       "path": "/webhooks",

package/controllers/authentication.js

@@ -179,96 +179,97 @@ module.exports = {
     };
   },
 
-  async getProviders(ctx) {
-    try {
-      // Mock providers - in a real implementation, these would come from configuration
-      const providers = [
-        {
-          uid: 'google',
-          displayName: 'Google',
-          icon: 'https://developers.google.com/identity/images/g-logo.png',
-        },
-        {
-          uid: 'github',
-          displayName: 'GitHub',
-          icon: 'https://github.githubassets.com/images/modules/logos_page/GitHub-Mark.png',
-        },
-        {
-          uid: 'microsoft',
-          displayName: 'Microsoft',
-          icon: 'https://upload.wikimedia.org/wikipedia/commons/4/44/Microsoft_logo.svg',
-        },
-        {
-          uid: 'facebook',
-          displayName: 'Facebook',
-          icon: 'https://upload.wikimedia.org/wikipedia/commons/5/51/Facebook_f_logo_%282019%29.svg',
-        },
-        {
-          uid: 'linkedin',
-          displayName: 'LinkedIn',
-          icon: 'https://upload.wikimedia.org/wikipedia/commons/c/ca/LinkedIn_logo_initials.png',
-        },
-      ];
+  async ssoProviders(ctx) {
+    ctx.body = strapi.admin.services.sso.getConfiguredProviders();
+  },
 
-      ctx.body = providers;
-    } catch (err) {
-      ctx.badRequest(null, 'An error occurred while retrieving providers');
+  async ssoConnect(ctx) {
+    const { provider: providerUid } = ctx.params;
+    const provider = strapi.admin.services.sso.getProvider(providerUid);
+
+    if (!provider) {
+      return ctx.notFound('Unknown or unconfigured SSO provider');
     }
-  },
 
-  async providerLogin(ctx) {
-    try {
-      const { provider } = ctx.params;
-      
-      // This is where you would implement the actual OAuth flow
-      // For now, we'll just redirect to the provider's OAuth URL
-      const providerUrls = {
-        google: `https://accounts.google.com/oauth/authorize?client_id=${process.env.GOOGLE_CLIENT_ID}&redirect_uri=${process.env.GOOGLE_REDIRECT_URI}&scope=openid%20email%20profile&response_type=code`,
-        github: `https://github.com/login/oauth/authorize?client_id=${process.env.GITHUB_CLIENT_ID}&redirect_uri=${process.env.GITHUB_REDIRECT_URI}&scope=user:email`,
-        microsoft: `https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=${process.env.MICROSOFT_CLIENT_ID}&redirect_uri=${process.env.MICROSOFT_REDIRECT_URI}&scope=openid%20email%20profile&response_type=code`,
-        facebook: `https://www.facebook.com/v18.0/dialog/oauth?client_id=${process.env.FACEBOOK_CLIENT_ID}&redirect_uri=${process.env.FACEBOOK_REDIRECT_URI}&scope=email%20public_profile&response_type=code`,
-        linkedin: `https://www.linkedin.com/oauth/v2/authorization?client_id=${process.env.LINKEDIN_CLIENT_ID}&redirect_uri=${process.env.LINKEDIN_REDIRECT_URI}&scope=r_liteprofile%20r_emailaddress&response_type=code`,
-      };
+    const redirectUri = getSsoCallbackUrl(ctx, providerUid);
+    const state = strapi.admin.services.sso.signState();
 
-      const authUrl = providerUrls[provider];
-      
-      if (!authUrl) {
-        return ctx.badRequest(null, 'Provider not supported');
-      }
+    const authorizeUrl = new URL(provider.authorizeUrl);
+    authorizeUrl.searchParams.set('client_id', process.env[`${providerUid.toUpperCase()}_CLIENT_ID`]);
+    authorizeUrl.searchParams.set('redirect_uri', redirectUri);
+    authorizeUrl.searchParams.set('scope', provider.scope);
+    authorizeUrl.searchParams.set('response_type', 'code');
+    authorizeUrl.searchParams.set('state', state);
 
-      ctx.redirect(authUrl);
-    } catch (err) {
-      ctx.badRequest(null, 'An error occurred while connecting to provider');
-    }
+    ctx.redirect(authorizeUrl.toString());
   },
 
-  async getProviderLoginOptions(ctx) {
-    try {
-      // Mock provider login options - in a real implementation, these would come from configuration
-      const options = {
-        autoRegister: true,
-        defaultRole: 'authenticated',
-      };
+  async ssoCallback(ctx) {
+    const { provider: providerUid } = ctx.params;
+    const { code, state, error } = ctx.query;
+    const adminLoginUrl = getAdminLoginUrl(ctx);
+    const fail = reason => ctx.redirect(`${adminLoginUrl}?ssoError=${encodeURIComponent(reason)}`);
 
-      ctx.body = {
-        data: options,
-      };
-    } catch (err) {
-      ctx.badRequest(null, 'An error occurred while retrieving provider login options');
-    }
-  },
+    if (error) return fail('access_denied');
+    if (!code) return fail('missing_code');
+    if (!strapi.admin.services.sso.verifyState(state)) return fail('invalid_state');
+
+    const provider = strapi.admin.services.sso.getProvider(providerUid);
+    if (!provider) return fail('unsupported_provider');
 
-  async updateProviderLoginOptions(ctx) {
+    let email;
     try {
-      const input = ctx.request.body;
-      
-      // In a real implementation, you would validate and save these options
-      // For now, we'll just return the input as confirmation
-      ctx.body = {
-        data: input,
-      };
+      const redirectUri = getSsoCallbackUrl(ctx, providerUid);
+      email = await provider.getVerifiedEmail(code, redirectUri);
     } catch (err) {
-      ctx.badRequest(null, 'An error occurred while updating provider login options');
+      strapi.log.error(`SSO callback error for ${providerUid}: ${err.message}`);
+      return fail('provider_error');
     }
+
+    if (!email) return fail('email_not_verified');
+
+    // Read-only lookup - an unrecognized or inactive email is rejected,
+    // never used to create or activate an admin account.
+    const user = await strapi.admin.services.auth.findActiveAdminByVerifiedEmail(email);
+
+    if (!user) {
+      strapi.eventHub.emit('admin.auth.error', {
+        error: new Error('No matching active admin account for SSO email'),
+        provider: providerUid,
+      });
+      return fail('no_admin_account');
+    }
+
+    strapi.eventHub.emit('admin.auth.success', { user, provider: providerUid });
+
+    const token = strapi.admin.services.token.createJwtToken(user);
+    ctx.redirect(`${adminLoginUrl}?ssoToken=${encodeURIComponent(token)}`);
   },
 };
+
+// The provider must redirect back to this exact URI - derived from the
+// incoming request rather than strapi.config.server.url (which isn't
+// reliably populated per-tenant), so it matches whatever host the browser
+// is actually talking to.
+function getBackendOrigin(ctx) {
+  return `${ctx.request.protocol}://${ctx.request.header.host}`;
+}
+
+function getSsoCallbackUrl(ctx, providerUid) {
+  return `${getBackendOrigin(ctx)}/admin/connect/${providerUid}/callback`;
+}
+
+// The admin panel frontend is served separately from this API (see
+// config/server.js's serveAdminPanel: false) - ADMIN_PANEL_URL is an
+// explicit override, SUBDOMAIN is what the tenant CloudFormation stack
+// already provisions (see api/provider-connections), and same-origin is
+// the fallback for local/single-host setups.
+function getAdminLoginUrl(ctx) {
+  const base = process.env.ADMIN_PANEL_URL
+    ? process.env.ADMIN_PANEL_URL.replace(/\/$/, '')
+    : process.env.SUBDOMAIN
+    ? `https://${process.env.SUBDOMAIN}-admin.punch-in.co.uk`
+    : getBackendOrigin(ctx);
+
+  return `${base}/auth/login`;
+}

package/package.json

@@ -139,5 +139,5 @@
     "develop:ce": "STRAPI_DISABLE_EE=true webpack-dev-server --config webpack.config.dev.js",
     "test": "echo \"no tests yet\""
   },
-  "version": "1.0.9"
+  "version": "1.1.0"
 }

package/services/auth.js

@@ -45,6 +45,23 @@ const checkCredentials = async ({ email, password }) => {
   return [null, user];
 };
 
+/**
+ * Look up an existing, active admin by a *verified* email address for SSO
+ * login. Deliberately read-only - unlike checkCredentials, this must never
+ * create, activate, or otherwise modify an admin_users row. An email with
+ * no matching account, or matching an inactive one, yields no session.
+ * @param {string} email - email already verified by the SSO provider
+ */
+const findActiveAdminByVerifiedEmail = async email => {
+  if (!email) return null;
+
+  const user = await strapi.query('user', 'admin').findOne({ email });
+  if (!user) return null;
+  if (!(user.isActive === true)) return null;
+
+  return user;
+};
+
 /**
  * Send an email to the user if it exists or do nothing
  * @param {Object} param params
@@ -106,6 +123,7 @@ const resetPassword = async ({ resetPasswordToken, password } = {}) => {
 
 module.exports = {
   checkCredentials,
+  findActiveAdminByVerifiedEmail,
   validatePassword,
   hashPassword,
   forgotPassword,

package/services/sso.js

@@ -0,0 +1,185 @@
+'use strict';
+
+/**
+ * Admin-panel SSO login.
+ *
+ * This intentionally never creates or modifies admin_users - it only ever
+ * verifies that the caller controls an email address (via the provider's
+ * own OAuth token exchange + profile/userinfo endpoint) and, if that email
+ * matches an existing *active* admin, mints a normal admin session for
+ * them. An email with no matching admin is rejected outright.
+ *
+ * Each provider needs its own OAuth app registered in that provider's
+ * developer console, with the callback URL
+ * "<this Strapi instance's public origin>/admin/connect/<uid>/callback"
+ * registered as an allowed redirect URI. Credentials are read from env
+ * vars named "<UID>_CLIENT_ID" / "<UID>_CLIENT_SECRET".
+ */
+
+const axios = require('axios');
+const crypto = require('crypto');
+
+const envVar = (uid, suffix) => process.env[`${uid.toUpperCase()}_CLIENT_${suffix}`];
+
+const PROVIDERS = {
+  google: {
+    displayName: 'Google',
+    icon: 'https://developers.google.com/identity/images/g-logo.png',
+    scope: 'openid email',
+    authorizeUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
+    async getVerifiedEmail(code, redirectUri) {
+      const { data: tokenData } = await axios.post('https://oauth2.googleapis.com/token', {
+        code,
+        client_id: envVar('google', 'ID'),
+        client_secret: envVar('google', 'SECRET'),
+        redirect_uri: redirectUri,
+        grant_type: 'authorization_code',
+      });
+
+      if (!tokenData.access_token) return null;
+
+      const { data: profile } = await axios.get(
+        'https://openidconnect.googleapis.com/v1/userinfo',
+        { headers: { Authorization: `Bearer ${tokenData.access_token}` } }
+      );
+
+      return profile.email_verified === true ? profile.email : null;
+    },
+  },
+
+  github: {
+    displayName: 'GitHub',
+    icon: 'https://github.githubassets.com/images/modules/logos_page/GitHub-Mark.png',
+    scope: 'user:email',
+    authorizeUrl: 'https://github.com/login/oauth/authorize',
+    async getVerifiedEmail(code, redirectUri) {
+      const { data: tokenData } = await axios.post(
+        'https://github.com/login/oauth/access_token',
+        {
+          code,
+          client_id: envVar('github', 'ID'),
+          client_secret: envVar('github', 'SECRET'),
+          redirect_uri: redirectUri,
+        },
+        { headers: { Accept: 'application/json' } }
+      );
+
+      if (!tokenData.access_token) return null;
+
+      const { data: emails } = await axios.get('https://api.github.com/user/emails', {
+        headers: {
+          Authorization: `token ${tokenData.access_token}`,
+          'User-Agent': 'punch-in-admin-sso',
+        },
+      });
+
+      const primary = Array.isArray(emails) && emails.find(e => e.primary && e.verified);
+      return primary ? primary.email : null;
+    },
+  },
+
+  facebook: {
+    displayName: 'Facebook',
+    icon: 'https://upload.wikimedia.org/wikipedia/commons/5/51/Facebook_f_logo_%282019%29.svg',
+    scope: 'email',
+    authorizeUrl: 'https://www.facebook.com/v18.0/dialog/oauth',
+    async getVerifiedEmail(code, redirectUri) {
+      const { data: tokenData } = await axios.get(
+        'https://graph.facebook.com/v18.0/oauth/access_token',
+        {
+          params: {
+            code,
+            client_id: envVar('facebook', 'ID'),
+            client_secret: envVar('facebook', 'SECRET'),
+            redirect_uri: redirectUri,
+          },
+        }
+      );
+
+      if (!tokenData.access_token) return null;
+
+      const { data: profile } = await axios.get('https://graph.facebook.com/me', {
+        params: { fields: 'id,email', access_token: tokenData.access_token },
+      });
+
+      // Facebook's platform only ever returns `email` for accounts with a
+      // confirmed address, so its mere presence here is the verification.
+      return profile.email || null;
+    },
+  },
+
+  linkedin: {
+    displayName: 'LinkedIn',
+    icon: 'https://upload.wikimedia.org/wikipedia/commons/c/ca/LinkedIn_logo_initials.png',
+    scope: 'openid email profile',
+    authorizeUrl: 'https://www.linkedin.com/oauth/v2/authorization',
+    async getVerifiedEmail(code, redirectUri) {
+      const params = new URLSearchParams({
+        grant_type: 'authorization_code',
+        code,
+        redirect_uri: redirectUri,
+        client_id: envVar('linkedin', 'ID'),
+        client_secret: envVar('linkedin', 'SECRET'),
+      });
+
+      const { data: tokenData } = await axios.post(
+        'https://www.linkedin.com/oauth/v2/accessToken',
+        params.toString(),
+        { headers: { 'Content-Type': 'application/x-www-form-urlencoded' } }
+      );
+
+      if (!tokenData.access_token) return null;
+
+      const { data: profile } = await axios.get('https://api.linkedin.com/v2/userinfo', {
+        headers: { Authorization: `Bearer ${tokenData.access_token}` },
+      });
+
+      return profile.email_verified === true ? profile.email : null;
+    },
+  },
+};
+
+const isConfigured = uid => Boolean(envVar(uid, 'ID') && envVar(uid, 'SECRET'));
+
+const getConfiguredProviders = () =>
+  Object.entries(PROVIDERS)
+    .filter(([uid]) => isConfigured(uid))
+    .map(([uid, p]) => ({ uid, displayName: p.displayName, icon: p.icon }));
+
+const getProvider = uid => (isConfigured(uid) ? PROVIDERS[uid] : null);
+
+// Stateless CSRF protection for the OAuth `state` param: HMAC-signed with
+// the same secret used for admin JWTs, so no server-side session/store is
+// needed to verify it came from a connect() call we actually issued.
+const STATE_MAX_AGE_MS = 10 * 60 * 1000;
+
+const signState = () => {
+  const { secret } = strapi.admin.services.token.getTokenOptions();
+  const timestamp = Date.now().toString();
+  const hmac = crypto.createHmac('sha256', secret).update(timestamp).digest('hex');
+  return `${timestamp}.${hmac}`;
+};
+
+const verifyState = state => {
+  if (typeof state !== 'string') return false;
+
+  const [timestamp, hmac] = state.split('.');
+  if (!timestamp || !hmac) return false;
+
+  const age = Date.now() - Number(timestamp);
+  if (!Number.isFinite(age) || age < 0 || age > STATE_MAX_AGE_MS) return false;
+
+  const { secret } = strapi.admin.services.token.getTokenOptions();
+  const expected = crypto.createHmac('sha256', secret).update(timestamp).digest('hex');
+
+  const a = Buffer.from(hmac);
+  const b = Buffer.from(expected);
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+};
+
+module.exports = {
+  getConfiguredProviders,
+  getProvider,
+  signState,
+  verifyState,
+};