@punch-in/strapi-admin 1.1.0 → 1.2.0

package/config/routes.json

@@ -94,9 +94,12 @@
       "handler": "authentication.ssoConnect"
     },
     {
-      "method": "GET",
-      "path": "/connect/:provider/callback",
-      "handler": "authentication.ssoCallback"
+      "method": "POST",
+      "path": "/sso/verify",
+      "handler": "authentication.ssoVerify",
+      "config": {
+        "policies": []
+      }
     },
     {
       "method": "GET",

package/controllers/authentication.js

@@ -2,6 +2,8 @@
 
 const passport = require('koa-passport');
 const compose = require('koa-compose');
+const crypto = require('crypto');
+const axios = require('axios');
 
 const {
   validateRegistrationInput,
@@ -179,97 +181,80 @@ module.exports = {
     };
   },
 
+  // Admin SSO now goes through the central Lambda (api.punch-in.co.uk),
+  // registered once per provider instead of once per tenant - see
+  // stripe-charge/strapi-charge/{sso.js,controllers/ssoController.js}.
+  // This instance's only remaining jobs are: (1) tell the login page which
+  // provider buttons to show, (2) hand the browser off with its own
+  // subdomain attached, (3) later, verify a provider-confirmed email
+  // against *this* tenant's admin_users - never creating one.
+
   async ssoProviders(ctx) {
-    ctx.body = strapi.admin.services.sso.getConfiguredProviders();
+    try {
+      const { data } = await axios.get(`${getCentralApiBase()}/sso/auth/providers`, {
+        timeout: 5000,
+      });
+      ctx.body = data;
+    } catch (err) {
+      strapi.log.error(`Failed to fetch SSO providers: ${err.message}`);
+      ctx.body = [];
+    }
   },
 
   async ssoConnect(ctx) {
     const { provider: providerUid } = ctx.params;
-    const provider = strapi.admin.services.sso.getProvider(providerUid);
+    const subdomain = process.env.SUBDOMAIN;
 
-    if (!provider) {
-      return ctx.notFound('Unknown or unconfigured SSO provider');
+    if (!subdomain) {
+      return ctx.badRequest('SUBDOMAIN is not configured on this Strapi instance');
     }
 
-    const redirectUri = getSsoCallbackUrl(ctx, providerUid);
-    const state = strapi.admin.services.sso.signState();
-
-    const authorizeUrl = new URL(provider.authorizeUrl);
-    authorizeUrl.searchParams.set('client_id', process.env[`${providerUid.toUpperCase()}_CLIENT_ID`]);
-    authorizeUrl.searchParams.set('redirect_uri', redirectUri);
-    authorizeUrl.searchParams.set('scope', provider.scope);
-    authorizeUrl.searchParams.set('response_type', 'code');
-    authorizeUrl.searchParams.set('state', state);
+    const url = new URL(`${getCentralApiBase()}/sso/auth/${providerUid}`);
+    url.searchParams.set('subdomain', subdomain);
 
-    ctx.redirect(authorizeUrl.toString());
+    ctx.redirect(url.toString());
   },
 
-  async ssoCallback(ctx) {
-    const { provider: providerUid } = ctx.params;
-    const { code, state, error } = ctx.query;
-    const adminLoginUrl = getAdminLoginUrl(ctx);
-    const fail = reason => ctx.redirect(`${adminLoginUrl}?ssoError=${encodeURIComponent(reason)}`);
-
-    if (error) return fail('access_denied');
-    if (!code) return fail('missing_code');
-    if (!strapi.admin.services.sso.verifyState(state)) return fail('invalid_state');
-
-    const provider = strapi.admin.services.sso.getProvider(providerUid);
-    if (!provider) return fail('unsupported_provider');
-
-    let email;
-    try {
-      const redirectUri = getSsoCallbackUrl(ctx, providerUid);
-      email = await provider.getVerifiedEmail(code, redirectUri);
-    } catch (err) {
-      strapi.log.error(`SSO callback error for ${providerUid}: ${err.message}`);
-      return fail('provider_error');
+  // POST /admin/sso/verify - called server-to-server by the central Lambda
+  // once it has a provider-verified email, authenticated the same way
+  // api/provider-connections' callback already is (X-Sync-Secret, constant-
+  // time compare). Read-only: an unmatched or inactive email is rejected,
+  // never used to create or activate an admin account.
+  async ssoVerify(ctx) {
+    const expected = process.env.SYNC_SECRET;
+    if (!expected) {
+      return ctx.internalServerError('SYNC_SECRET is not configured on this Strapi instance');
     }
 
-    if (!email) return fail('email_not_verified');
+    const provided = ctx.request.header['x-sync-secret'];
+    if (!secretsMatch(provided, expected)) {
+      return ctx.forbidden('Invalid sync secret');
+    }
 
-    // Read-only lookup - an unrecognized or inactive email is rejected,
-    // never used to create or activate an admin account.
+    const { email, provider } = ctx.request.body || {};
     const user = await strapi.admin.services.auth.findActiveAdminByVerifiedEmail(email);
 
     if (!user) {
       strapi.eventHub.emit('admin.auth.error', {
         error: new Error('No matching active admin account for SSO email'),
-        provider: providerUid,
+        provider: provider || 'sso',
       });
-      return fail('no_admin_account');
+      return ctx.notFound('No matching active admin account');
     }
 
-    strapi.eventHub.emit('admin.auth.success', { user, provider: providerUid });
+    strapi.eventHub.emit('admin.auth.success', { user, provider: provider || 'sso' });
 
-    const token = strapi.admin.services.token.createJwtToken(user);
-    ctx.redirect(`${adminLoginUrl}?ssoToken=${encodeURIComponent(token)}`);
+    ctx.body = { token: strapi.admin.services.token.createJwtToken(user) };
   },
 };
 
-// The provider must redirect back to this exact URI - derived from the
-// incoming request rather than strapi.config.server.url (which isn't
-// reliably populated per-tenant), so it matches whatever host the browser
-// is actually talking to.
-function getBackendOrigin(ctx) {
-  return `${ctx.request.protocol}://${ctx.request.header.host}`;
-}
-
-function getSsoCallbackUrl(ctx, providerUid) {
-  return `${getBackendOrigin(ctx)}/admin/connect/${providerUid}/callback`;
+function getCentralApiBase() {
+  return (process.env.PUNCHIN_INTEGRATIONS_API_BASE || 'https://api.punch-in.co.uk').replace(/\/$/, '');
 }
 
-// The admin panel frontend is served separately from this API (see
-// config/server.js's serveAdminPanel: false) - ADMIN_PANEL_URL is an
-// explicit override, SUBDOMAIN is what the tenant CloudFormation stack
-// already provisions (see api/provider-connections), and same-origin is
-// the fallback for local/single-host setups.
-function getAdminLoginUrl(ctx) {
-  const base = process.env.ADMIN_PANEL_URL
-    ? process.env.ADMIN_PANEL_URL.replace(/\/$/, '')
-    : process.env.SUBDOMAIN
-    ? `https://${process.env.SUBDOMAIN}-admin.punch-in.co.uk`
-    : getBackendOrigin(ctx);
-
-  return `${base}/auth/login`;
+function secretsMatch(provided, expected) {
+  if (!provided || !expected) return false;
+  const a = Buffer.from(provided);
+  const b = Buffer.from(expected);
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
 }

package/package.json

@@ -139,5 +139,5 @@
     "develop:ce": "STRAPI_DISABLE_EE=true webpack-dev-server --config webpack.config.dev.js",
     "test": "echo \"no tests yet\""
   },
-  "version": "1.1.0"
+  "version": "1.2.0"
 }

package/services/sso.js

@@ -1,185 +0,0 @@
-'use strict';
-
-/**
- * Admin-panel SSO login.
- *
- * This intentionally never creates or modifies admin_users - it only ever
- * verifies that the caller controls an email address (via the provider's
- * own OAuth token exchange + profile/userinfo endpoint) and, if that email
- * matches an existing *active* admin, mints a normal admin session for
- * them. An email with no matching admin is rejected outright.
- *
- * Each provider needs its own OAuth app registered in that provider's
- * developer console, with the callback URL
- * "<this Strapi instance's public origin>/admin/connect/<uid>/callback"
- * registered as an allowed redirect URI. Credentials are read from env
- * vars named "<UID>_CLIENT_ID" / "<UID>_CLIENT_SECRET".
- */
-
-const axios = require('axios');
-const crypto = require('crypto');
-
-const envVar = (uid, suffix) => process.env[`${uid.toUpperCase()}_CLIENT_${suffix}`];
-
-const PROVIDERS = {
-  google: {
-    displayName: 'Google',
-    icon: 'https://developers.google.com/identity/images/g-logo.png',
-    scope: 'openid email',
-    authorizeUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
-    async getVerifiedEmail(code, redirectUri) {
-      const { data: tokenData } = await axios.post('https://oauth2.googleapis.com/token', {
-        code,
-        client_id: envVar('google', 'ID'),
-        client_secret: envVar('google', 'SECRET'),
-        redirect_uri: redirectUri,
-        grant_type: 'authorization_code',
-      });
-
-      if (!tokenData.access_token) return null;
-
-      const { data: profile } = await axios.get(
-        'https://openidconnect.googleapis.com/v1/userinfo',
-        { headers: { Authorization: `Bearer ${tokenData.access_token}` } }
-      );
-
-      return profile.email_verified === true ? profile.email : null;
-    },
-  },
-
-  github: {
-    displayName: 'GitHub',
-    icon: 'https://github.githubassets.com/images/modules/logos_page/GitHub-Mark.png',
-    scope: 'user:email',
-    authorizeUrl: 'https://github.com/login/oauth/authorize',
-    async getVerifiedEmail(code, redirectUri) {
-      const { data: tokenData } = await axios.post(
-        'https://github.com/login/oauth/access_token',
-        {
-          code,
-          client_id: envVar('github', 'ID'),
-          client_secret: envVar('github', 'SECRET'),
-          redirect_uri: redirectUri,
-        },
-        { headers: { Accept: 'application/json' } }
-      );
-
-      if (!tokenData.access_token) return null;
-
-      const { data: emails } = await axios.get('https://api.github.com/user/emails', {
-        headers: {
-          Authorization: `token ${tokenData.access_token}`,
-          'User-Agent': 'punch-in-admin-sso',
-        },
-      });
-
-      const primary = Array.isArray(emails) && emails.find(e => e.primary && e.verified);
-      return primary ? primary.email : null;
-    },
-  },
-
-  facebook: {
-    displayName: 'Facebook',
-    icon: 'https://upload.wikimedia.org/wikipedia/commons/5/51/Facebook_f_logo_%282019%29.svg',
-    scope: 'email',
-    authorizeUrl: 'https://www.facebook.com/v18.0/dialog/oauth',
-    async getVerifiedEmail(code, redirectUri) {
-      const { data: tokenData } = await axios.get(
-        'https://graph.facebook.com/v18.0/oauth/access_token',
-        {
-          params: {
-            code,
-            client_id: envVar('facebook', 'ID'),
-            client_secret: envVar('facebook', 'SECRET'),
-            redirect_uri: redirectUri,
-          },
-        }
-      );
-
-      if (!tokenData.access_token) return null;
-
-      const { data: profile } = await axios.get('https://graph.facebook.com/me', {
-        params: { fields: 'id,email', access_token: tokenData.access_token },
-      });
-
-      // Facebook's platform only ever returns `email` for accounts with a
-      // confirmed address, so its mere presence here is the verification.
-      return profile.email || null;
-    },
-  },
-
-  linkedin: {
-    displayName: 'LinkedIn',
-    icon: 'https://upload.wikimedia.org/wikipedia/commons/c/ca/LinkedIn_logo_initials.png',
-    scope: 'openid email profile',
-    authorizeUrl: 'https://www.linkedin.com/oauth/v2/authorization',
-    async getVerifiedEmail(code, redirectUri) {
-      const params = new URLSearchParams({
-        grant_type: 'authorization_code',
-        code,
-        redirect_uri: redirectUri,
-        client_id: envVar('linkedin', 'ID'),
-        client_secret: envVar('linkedin', 'SECRET'),
-      });
-
-      const { data: tokenData } = await axios.post(
-        'https://www.linkedin.com/oauth/v2/accessToken',
-        params.toString(),
-        { headers: { 'Content-Type': 'application/x-www-form-urlencoded' } }
-      );
-
-      if (!tokenData.access_token) return null;
-
-      const { data: profile } = await axios.get('https://api.linkedin.com/v2/userinfo', {
-        headers: { Authorization: `Bearer ${tokenData.access_token}` },
-      });
-
-      return profile.email_verified === true ? profile.email : null;
-    },
-  },
-};
-
-const isConfigured = uid => Boolean(envVar(uid, 'ID') && envVar(uid, 'SECRET'));
-
-const getConfiguredProviders = () =>
-  Object.entries(PROVIDERS)
-    .filter(([uid]) => isConfigured(uid))
-    .map(([uid, p]) => ({ uid, displayName: p.displayName, icon: p.icon }));
-
-const getProvider = uid => (isConfigured(uid) ? PROVIDERS[uid] : null);
-
-// Stateless CSRF protection for the OAuth `state` param: HMAC-signed with
-// the same secret used for admin JWTs, so no server-side session/store is
-// needed to verify it came from a connect() call we actually issued.
-const STATE_MAX_AGE_MS = 10 * 60 * 1000;
-
-const signState = () => {
-  const { secret } = strapi.admin.services.token.getTokenOptions();
-  const timestamp = Date.now().toString();
-  const hmac = crypto.createHmac('sha256', secret).update(timestamp).digest('hex');
-  return `${timestamp}.${hmac}`;
-};
-
-const verifyState = state => {
-  if (typeof state !== 'string') return false;
-
-  const [timestamp, hmac] = state.split('.');
-  if (!timestamp || !hmac) return false;
-
-  const age = Date.now() - Number(timestamp);
-  if (!Number.isFinite(age) || age < 0 || age > STATE_MAX_AGE_MS) return false;
-
-  const { secret } = strapi.admin.services.token.getTokenOptions();
-  const expected = crypto.createHmac('sha256', secret).update(timestamp).digest('hex');
-
-  const a = Buffer.from(hmac);
-  const b = Buffer.from(expected);
-  return a.length === b.length && crypto.timingSafeEqual(a, b);
-};
-
-module.exports = {
-  getConfiguredProviders,
-  getProvider,
-  signState,
-  verifyState,
-};