@reflagged/shell 1.3.0 → 1.3.2

package/README.md

@@ -46,9 +46,39 @@ import { loadAppConfig } from '@reflagged/shell/config'
 import { OIDC_COOKIE, loadOidcEnv } from '@reflagged/shell/auth/oidc-config'
 import { verifySessionCookie } from '@reflagged/shell/auth/oidc-cookie'
 import { refreshAccessToken } from '@reflagged/shell/auth/oidc-refresh'
-import { nextauthStrategy } from '@reflagged/shell/auth/nextauth-strategy'
+import { nextauthStrategy, createOidcStrategy } from '@reflagged/shell/auth/nextauth-strategy'
 ```
 
+### Mapping the platform's role onto your own (`roleForNewUser`)
+
+`nextauthStrategy` is `createOidcStrategy()` with no options — the role a
+newly created account gets is `RFLGD_DEFAULT_USER_ROLE` (or `admin` for the
+very first account). Call `createOidcStrategy` directly to decide that role
+yourself from the platform's view of the person, using the workspace role
+the platform put in the session:
+
+```ts
+import { createOidcStrategy, type NewUserContext } from '@reflagged/shell/auth/nextauth-strategy'
+
+function roleForNewUser({ orgRole, isFirstUser }: NewUserContext): string {
+  if (isFirstUser) return 'admin'
+  // org_role is three-valued, not two: 'owner' | 'admin' | 'member' when a
+  // membership row exists (both 'owner' and 'admin' administer the
+  // workspace), or a *platform* role — 'superadmin' | 'reflagged_admin' |
+  // 'tenant_admin' | 'member' — when it does not. Check for 'owner' as well
+  // as 'admin': the person who books an instance is always created as
+  // 'owner', never 'admin'.
+  return orgRole === 'owner' || orgRole === 'admin' ? 'workspace-admin' : 'member'
+}
+
+export const oidcStrategy = createOidcStrategy({ roleForNewUser })
+```
+
+This callback runs only when an account is created, never on later
+sign-ins — see `NewUserContext`'s doc comments in
+`src/lib/auth/nextauth-strategy.ts` for the full contract, including the
+`isFirstUser` branch and the `null` case for standalone operation.
+
 ### Per-app route files + middleware
 
 Each app keeps thin wrappers that re-export the handlers:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reflagged/shell",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "description": "Shared app shell for Reflagged services — OIDC auth, SSO, app switcher",
   "type": "module",
   "sideEffects": false,

package/src/lib/api/oidc-callback.ts

@@ -18,6 +18,20 @@ export async function GET(req: Request): Promise<NextResponse> {
   if (!env) return NextResponse.json({ error: 'oidc-not-configured' }, { status: 500 })
 
   const url = new URL(req.url)
+
+  // The provider may come back without a code: `error=access_denied` when the
+  // account is not a member of this service instance, `error=server_error`
+  // when it is unwell. validateAuthResponse() throws on these, and an
+  // unhandled throw is a 500 that swallows the one sentence the person
+  // needs. Answer it before anything else — no state cookie is required to
+  // say "no".
+  const providerError = url.searchParams.get('error')
+  if (providerError) {
+    const res = deniedResponse(providerError, url.searchParams.get('error_description'))
+    res.cookies.delete(OIDC_STATE_COOKIE)
+    return res
+  }
+
   const stateCookie = req.headers
     .get('cookie')
     ?.split(';')
@@ -97,3 +111,54 @@ export async function GET(req: Request): Promise<NextResponse> {
   res.cookies.delete(OIDC_STATE_COOKIE)
   return res
 }
+
+const escapeHtml = (v: string): string =>
+  v.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`)
+
+/**
+ * A readable page for a sign-in the provider refused. 403 for access_denied
+ * (the account exists, the instance is not theirs), 400 for anything else.
+ * The description is the provider's own sentence and arrives via the URL,
+ * so it is escaped — anyone can craft a callback link.
+ */
+export function deniedResponse(error: string, description: string | null): NextResponse {
+  const status = error === 'access_denied' ? 403 : 400
+  const headline =
+    error === 'access_denied' ? 'Kein Zugriff auf diese Anwendung' : 'Anmeldung fehlgeschlagen'
+  const detail =
+    description?.trim() ||
+    (error === 'access_denied'
+      ? 'Ihr Account ist dieser Anwendung nicht zugeordnet.'
+      : `Der Anmeldedienst hat die Anmeldung abgelehnt (${error}).`)
+  const html = `<!doctype html>
+<html lang="de">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(headline)}</title>
+<style>
+  body { margin: 0; min-height: 100vh; display: grid; place-items: center;
+    font-family: system-ui, -apple-system, sans-serif; background: #f6f5f2; color: #1a1a1a; }
+  main { max-width: 32rem; padding: 2rem; }
+  h1 { font-size: 1.25rem; margin: 0 0 .75rem; }
+  p { margin: 0 0 1rem; line-height: 1.5; }
+  small { color: #666; }
+  a { color: #8a7648; }
+</style>
+</head>
+<body>
+<main>
+  <h1>${escapeHtml(headline)}</h1>
+  <p>${escapeHtml(detail)}</p>
+  <p>Bitten Sie eine Administratorin oder einen Administrator Ihrer Organisation, Ihren Account für diese Anwendung freizuschalten.</p>
+  <p><a href="/">Zur Startseite</a></p>
+  <p><small>Fehlercode: ${escapeHtml(error)}</small></p>
+</main>
+</body>
+</html>
+`
+  return new NextResponse(html, {
+    status,
+    headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' },
+  })
+}

package/src/lib/auth/nextauth-strategy.ts

@@ -7,7 +7,18 @@ import { verifySessionCookie } from './oidc-cookie'
 
 /** What the platform knows about a person signing in for the first time. */
 export type NewUserContext = {
-  /** Role in the current workspace ('admin' | 'member'), null without claims. */
+  /**
+   * Role in the current workspace, when a membership row exists for it:
+   * 'owner' | 'admin' | 'member'. When no membership row exists, the
+   * platform substitutes a *platform* role instead — 'superadmin' |
+   * 'reflagged_admin' | 'tenant_admin' | 'member' — a second, unrelated
+   * vocabulary in the same field (rflgd-base `src/lib/oidc/provider.ts:163`,
+   * `org_role: orgRole ?? userRole ?? null`). Only `null` without any claims
+   * at all. Callers that special-case 'admin' should check 'owner' too —
+   * rflgd-base always creates the booking person's membership with
+   * 'owner', never 'admin' (`src/lib/access/service-access.ts:20` treats
+   * both as equally privileged).
+   */
   orgRole: string | null
   /** Role on the platform itself, null without claims. */
   platformRole: string | null