@punch-in/strapi-admin 1.0.9 → 1.2.0

package/admin/src/containers/AuthPage/index.js

@@ -87,6 +87,59 @@ const AuthPage = ({ hasAdmin, setHasAdmin }) => {
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [authType]);
 
+  // Lands here after a full-page round trip through an SSO provider
+  // (controllers/authentication.js's ssoCallback). The token in the URL is
+  // a normal admin JWT for an *existing* admin the provider's verified
+  // email matched - nothing was created. Fetch the profile it belongs to,
+  // persist it the same way a password login does, then drop both params
+  // from the URL so the JWT doesn't linger in browser history.
+  useEffect(() => {
+    const ssoToken = query.get('ssoToken');
+    const ssoError = query.get('ssoError');
+
+    if (!ssoToken && !ssoError) return;
+
+    window.history.replaceState(null, '', window.location.pathname);
+
+    if (ssoError) {
+      const messages = {
+        access_denied: 'Sign-in was cancelled.',
+        no_admin_account: 'No admin account exists for that email address.',
+        email_not_verified: "That provider didn't return a verified email address.",
+      };
+
+      strapi.notification.toggle({
+        type: 'warning',
+        message: messages[ssoError] || 'Single sign-on failed. Please try again.',
+      });
+      return;
+    }
+
+    const completeSsoLogin = async () => {
+      try {
+        const {
+          data: { data: user },
+        } = await axios.get(`${strapi.backendURL}/admin/users/me`, {
+          headers: { Authorization: `Bearer ${ssoToken}` },
+          cancelToken: source.token,
+        });
+
+        auth.setToken(ssoToken, false);
+        auth.setUserInfo(user, false);
+
+        push('/');
+      } catch (err) {
+        strapi.notification.toggle({
+          type: 'warning',
+          message: 'Single sign-on failed. Please try again.',
+        });
+      }
+    };
+
+    completeSsoLogin();
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+
   const handleChange = ({ target: { name, value } }) => {
     dispatch({
       type: 'ON_CHANGE',

package/config/routes.json

@@ -83,6 +83,24 @@
       "path": "/reset-password",
       "handler": "authentication.resetPassword"
     },
+    {
+      "method": "GET",
+      "path": "/providers",
+      "handler": "authentication.ssoProviders"
+    },
+    {
+      "method": "GET",
+      "path": "/connect/:provider",
+      "handler": "authentication.ssoConnect"
+    },
+    {
+      "method": "POST",
+      "path": "/sso/verify",
+      "handler": "authentication.ssoVerify",
+      "config": {
+        "policies": []
+      }
+    },
     {
       "method": "GET",
       "path": "/webhooks",

package/controllers/authentication.js

@@ -2,6 +2,8 @@
 
 const passport = require('koa-passport');
 const compose = require('koa-compose');
+const crypto = require('crypto');
+const axios = require('axios');
 
 const {
   validateRegistrationInput,
@@ -179,96 +181,80 @@ module.exports = {
     };
   },
 
-  async getProviders(ctx) {
-    try {
-      // Mock providers - in a real implementation, these would come from configuration
-      const providers = [
-        {
-          uid: 'google',
-          displayName: 'Google',
-          icon: 'https://developers.google.com/identity/images/g-logo.png',
-        },
-        {
-          uid: 'github',
-          displayName: 'GitHub',
-          icon: 'https://github.githubassets.com/images/modules/logos_page/GitHub-Mark.png',
-        },
-        {
-          uid: 'microsoft',
-          displayName: 'Microsoft',
-          icon: 'https://upload.wikimedia.org/wikipedia/commons/4/44/Microsoft_logo.svg',
-        },
-        {
-          uid: 'facebook',
-          displayName: 'Facebook',
-          icon: 'https://upload.wikimedia.org/wikipedia/commons/5/51/Facebook_f_logo_%282019%29.svg',
-        },
-        {
-          uid: 'linkedin',
-          displayName: 'LinkedIn',
-          icon: 'https://upload.wikimedia.org/wikipedia/commons/c/ca/LinkedIn_logo_initials.png',
-        },
-      ];
+  // Admin SSO now goes through the central Lambda (api.punch-in.co.uk),
+  // registered once per provider instead of once per tenant - see
+  // stripe-charge/strapi-charge/{sso.js,controllers/ssoController.js}.
+  // This instance's only remaining jobs are: (1) tell the login page which
+  // provider buttons to show, (2) hand the browser off with its own
+  // subdomain attached, (3) later, verify a provider-confirmed email
+  // against *this* tenant's admin_users - never creating one.
 
-      ctx.body = providers;
+  async ssoProviders(ctx) {
+    try {
+      const { data } = await axios.get(`${getCentralApiBase()}/sso/auth/providers`, {
+        timeout: 5000,
+      });
+      ctx.body = data;
     } catch (err) {
-      ctx.badRequest(null, 'An error occurred while retrieving providers');
+      strapi.log.error(`Failed to fetch SSO providers: ${err.message}`);
+      ctx.body = [];
     }
   },
 
-  async providerLogin(ctx) {
-    try {
-      const { provider } = ctx.params;
-      
-      // This is where you would implement the actual OAuth flow
-      // For now, we'll just redirect to the provider's OAuth URL
-      const providerUrls = {
-        google: `https://accounts.google.com/oauth/authorize?client_id=${process.env.GOOGLE_CLIENT_ID}&redirect_uri=${process.env.GOOGLE_REDIRECT_URI}&scope=openid%20email%20profile&response_type=code`,
-        github: `https://github.com/login/oauth/authorize?client_id=${process.env.GITHUB_CLIENT_ID}&redirect_uri=${process.env.GITHUB_REDIRECT_URI}&scope=user:email`,
-        microsoft: `https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=${process.env.MICROSOFT_CLIENT_ID}&redirect_uri=${process.env.MICROSOFT_REDIRECT_URI}&scope=openid%20email%20profile&response_type=code`,
-        facebook: `https://www.facebook.com/v18.0/dialog/oauth?client_id=${process.env.FACEBOOK_CLIENT_ID}&redirect_uri=${process.env.FACEBOOK_REDIRECT_URI}&scope=email%20public_profile&response_type=code`,
-        linkedin: `https://www.linkedin.com/oauth/v2/authorization?client_id=${process.env.LINKEDIN_CLIENT_ID}&redirect_uri=${process.env.LINKEDIN_REDIRECT_URI}&scope=r_liteprofile%20r_emailaddress&response_type=code`,
-      };
-
-      const authUrl = providerUrls[provider];
-      
-      if (!authUrl) {
-        return ctx.badRequest(null, 'Provider not supported');
-      }
+  async ssoConnect(ctx) {
+    const { provider: providerUid } = ctx.params;
+    const subdomain = process.env.SUBDOMAIN;
 
-      ctx.redirect(authUrl);
-    } catch (err) {
-      ctx.badRequest(null, 'An error occurred while connecting to provider');
+    if (!subdomain) {
+      return ctx.badRequest('SUBDOMAIN is not configured on this Strapi instance');
     }
+
+    const url = new URL(`${getCentralApiBase()}/sso/auth/${providerUid}`);
+    url.searchParams.set('subdomain', subdomain);
+
+    ctx.redirect(url.toString());
   },
 
-  async getProviderLoginOptions(ctx) {
-    try {
-      // Mock provider login options - in a real implementation, these would come from configuration
-      const options = {
-        autoRegister: true,
-        defaultRole: 'authenticated',
-      };
+  // POST /admin/sso/verify - called server-to-server by the central Lambda
+  // once it has a provider-verified email, authenticated the same way
+  // api/provider-connections' callback already is (X-Sync-Secret, constant-
+  // time compare). Read-only: an unmatched or inactive email is rejected,
+  // never used to create or activate an admin account.
+  async ssoVerify(ctx) {
+    const expected = process.env.SYNC_SECRET;
+    if (!expected) {
+      return ctx.internalServerError('SYNC_SECRET is not configured on this Strapi instance');
+    }
 
-      ctx.body = {
-        data: options,
-      };
-    } catch (err) {
-      ctx.badRequest(null, 'An error occurred while retrieving provider login options');
+    const provided = ctx.request.header['x-sync-secret'];
+    if (!secretsMatch(provided, expected)) {
+      return ctx.forbidden('Invalid sync secret');
     }
-  },
 
-  async updateProviderLoginOptions(ctx) {
-    try {
-      const input = ctx.request.body;
-      
-      // In a real implementation, you would validate and save these options
-      // For now, we'll just return the input as confirmation
-      ctx.body = {
-        data: input,
-      };
-    } catch (err) {
-      ctx.badRequest(null, 'An error occurred while updating provider login options');
+    const { email, provider } = ctx.request.body || {};
+    const user = await strapi.admin.services.auth.findActiveAdminByVerifiedEmail(email);
+
+    if (!user) {
+      strapi.eventHub.emit('admin.auth.error', {
+        error: new Error('No matching active admin account for SSO email'),
+        provider: provider || 'sso',
+      });
+      return ctx.notFound('No matching active admin account');
     }
+
+    strapi.eventHub.emit('admin.auth.success', { user, provider: provider || 'sso' });
+
+    ctx.body = { token: strapi.admin.services.token.createJwtToken(user) };
   },
 };
+
+function getCentralApiBase() {
+  return (process.env.PUNCHIN_INTEGRATIONS_API_BASE || 'https://api.punch-in.co.uk').replace(/\/$/, '');
+}
+
+function secretsMatch(provided, expected) {
+  if (!provided || !expected) return false;
+  const a = Buffer.from(provided);
+  const b = Buffer.from(expected);
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+}

package/package.json

@@ -139,5 +139,5 @@
     "develop:ce": "STRAPI_DISABLE_EE=true webpack-dev-server --config webpack.config.dev.js",
     "test": "echo \"no tests yet\""
   },
-  "version": "1.0.9"
+  "version": "1.2.0"
 }

package/services/auth.js

@@ -45,6 +45,23 @@ const checkCredentials = async ({ email, password }) => {
   return [null, user];
 };
 
+/**
+ * Look up an existing, active admin by a *verified* email address for SSO
+ * login. Deliberately read-only - unlike checkCredentials, this must never
+ * create, activate, or otherwise modify an admin_users row. An email with
+ * no matching account, or matching an inactive one, yields no session.
+ * @param {string} email - email already verified by the SSO provider
+ */
+const findActiveAdminByVerifiedEmail = async email => {
+  if (!email) return null;
+
+  const user = await strapi.query('user', 'admin').findOne({ email });
+  if (!user) return null;
+  if (!(user.isActive === true)) return null;
+
+  return user;
+};
+
 /**
  * Send an email to the user if it exists or do nothing
  * @param {Object} param params
@@ -106,6 +123,7 @@ const resetPassword = async ({ resetPasswordToken, password } = {}) => {
 
 module.exports = {
   checkCredentials,
+  findActiveAdminByVerifiedEmail,
   validatePassword,
   hashPassword,
   forgotPassword,