@punch-in/strapi-admin 1.2.14 → 1.2.15

package/admin/src/containers/AuthPage/components/Login/BaseLogin.js

@@ -1,5 +1,5 @@
 import React, { useReducer, useEffect } from 'react';
-import { Checkbox, Button, Flex, Padded, Separator } from '@punch-in/buffet-modern-core';
+import { Checkbox, Button, Flex } from '@punch-in/buffet-modern-core';
 import { LoadingIndicator } from '@punch-in/buffet-modern-styles';
 import { useIntl } from 'react-intl';
 import { get } from 'lodash';
@@ -99,31 +99,33 @@ const Login = ({ children, formErrors, modifiedData, onChange, onSubmit, request
             </form>
             {children}
           </Box>
-          {/* SSO Providers Section */}
-          {!isLoading && providers.length > 0 && (
-            <>
-              <Separator />
-              <Padded top bottom size="smd">
-                <BaselineAlignment top size="3px" />
-              </Padded>
-              <div style={{ 
-                background: '#d2e9fe', 
-                padding: '1.4rem', 
-                boxShadow: 'rgb(221, 221, 221) 12px 12px 9px 0px' }}>
-                <Flex flexWrap="wrap" justifyContent="center" alignItems="center">
-                  <div>{formatMessage({ id: 'Auth.components.sso.info' })}: </div>
-                  {providers.map(provider => (
-                    <div key={provider.uid} style={{ padding: '5px 4px' }}>
-                      <ProviderButton provider={provider} />
-                    </div>
-                  ))}
-                </Flex>
-              </div>
-            </>
-          )}
         </BaselineAlignment>
       </Section>
+      {/* Forgot password link, directly below the login form */}
       <AuthLink label="Auth.link.forgot-password" to="/auth/forgot-password" />
+      {/* SSO Providers Section - pinned to the bottom of the viewport */}
+      {!isLoading && providers.length > 0 && (
+        <div
+          style={{
+            position: 'fixed',
+            left: 0,
+            right: 0,
+            bottom: 0,
+            background: '#d2e9fe',
+            padding: '1.4rem',
+            boxShadow: 'rgb(221, 221, 221) 0px -6px 9px 0px',
+          }}
+        >
+          <Flex flexWrap="wrap" justifyContent="center" alignItems="center">
+            <div>{formatMessage({ id: 'Auth.components.sso.info' })}: </div>
+            {providers.map(provider => (
+              <div key={provider.uid} style={{ padding: '5px 4px' }}>
+                <ProviderButton provider={provider} />
+              </div>
+            ))}
+          </Flex>
+        </div>
+      )}
     </>
   );
 };

package/controllers/authentication.js

@@ -167,7 +167,10 @@ module.exports = {
       return ctx.badRequest('ValidationError', err);
     }
 
-    strapi.admin.services.auth.forgotPassword(input);
+    // Awaited: in Lambda, un-awaited async work is frozen once the response
+    // returns, so the email send (SES invoke) would often never run. Still
+    // 204 whether or not the address matched an account - no existence leak.
+    await strapi.admin.services.auth.forgotPassword(input);
 
     ctx.status = 204;
   },

package/package.json

@@ -139,5 +139,5 @@
     "develop:ce": "STRAPI_DISABLE_EE=true webpack-dev-server --config webpack.config.dev.js",
     "test": "echo \"no tests yet\""
   },
-  "version": "1.2.14"
+  "version": "1.2.15"
 }

package/services/auth.js

@@ -3,6 +3,12 @@
 const bcrypt = require('bcryptjs');
 const _ = require('lodash');
 const { getAbsoluteAdminUrl } = require('strapi-utils');
+const { LambdaClient, InvokeCommand } = require('@aws-sdk/client-lambda');
+
+// SDK v3 client-lambda is preinstalled by the Node.js 18+ Lambda managed
+// runtime, so it does not need to be bundled in the strapi-lambda layer.
+// See controllers/authentication.js for the same pattern (SSO providers).
+const lambdaClient = new LambdaClient({});
 
 /**
  * hashes a password
@@ -77,10 +83,26 @@ const forgotPassword = async ({ email } = {}) => {
   const resetPasswordToken = strapi.admin.services.token.createToken();
   await strapi.admin.services.user.updateById(user.id, { resetPasswordToken });
 
-  // Send an email to the admin.
-  const url = `${getAbsoluteAdminUrl(
-    strapi.config
+  // getAbsoluteAdminUrl now resolves to the tenant's real admin SPA origin
+  // (ADMIN_URL in prod-stack-*.yaml), not localhost.
+  const url = `${_.trimEnd(
+    getAbsoluteAdminUrl(strapi.config),
+    '/'
   )}/auth/reset-password?code=${resetPasswordToken}`;
+
+  // ADMIN_EMAIL_MODE=invoke: this Lambda's VPC has no internet route, so the
+  // email is sent by the central AdminEmailFunction, reached via a direct SDK
+  // invoke (features/API-REDESIGN.md). Anything else keeps the old
+  // strapi-plugin-email path for local/dev.
+  if (process.env.ADMIN_EMAIL_MODE === 'invoke') {
+    return sendAdminEmailViaInvoke({
+      kind: 'forgot-password',
+      to: user.email,
+      firstname: user.firstname,
+      url,
+    });
+  }
+
   return strapi.plugins.email.services.email
     .sendTemplatedEmail(
       {
@@ -100,6 +122,42 @@ const forgotPassword = async ({ email } = {}) => {
     });
 };
 
+// Invokes stripe-charge's AdminEmailFunction (see features/API-REDESIGN.md).
+// Errors are logged, never surfaced to the caller - a forgot-password request
+// returns 204 whether or not the email actually went out.
+const sendAdminEmailViaInvoke = async payload => {
+  const functionName = process.env.ADMIN_EMAIL_FUNCTION_NAME;
+  if (!functionName) {
+    strapi.log.error('ADMIN_EMAIL_FUNCTION_NAME is not configured');
+    return;
+  }
+
+  try {
+    const response = await lambdaClient.send(
+      new InvokeCommand({
+        FunctionName: functionName,
+        InvocationType: 'RequestResponse',
+        Payload: Buffer.from(JSON.stringify(payload)),
+      })
+    );
+
+    if (response.FunctionError) {
+      throw new Error(
+        `AdminEmailFunction returned ${response.FunctionError}: ${Buffer.from(
+          response.Payload
+        ).toString('utf8')}`
+      );
+    }
+
+    const result = JSON.parse(Buffer.from(response.Payload).toString('utf8'));
+    if (!result.ok) {
+      strapi.log.error(`AdminEmailFunction rejected request: ${result.error}`);
+    }
+  } catch (err) {
+    strapi.log.error(`Failed to invoke AdminEmailFunction: ${err.message}`);
+  }
+};
+
 /**
  * Reset a user password
  * @param {Object} param params