@strapi/plugin-users-permissions 0.0.0-experimental.6340da17068c3bed7fb006e7bcc554c71129e282 → 0.0.0-experimental.63624e21eb5b0713345a0cf2f68f1c40eab427bc

package/dist/server/services/providers-registry.js

@@ -1,18 +1,15 @@
 'use strict';
 
 var require$$0 = require('assert');
-var require$$1 = require('jsonwebtoken');
-var require$$2 = require('url-join');
-var require$$3 = require('jwk-to-pem');
-var require$$4 = require('purest');
+var require$$1 = require('url-join');
+var verifyJwtWithJwks = require('../utils/verify-jwt-with-jwks.js');
+var providerHttp = require('../utils/provider-http.js');
+var oauth1 = require('../utils/oauth-connect/oauth1.js');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 var require$$0__default = /*#__PURE__*/_interopDefault(require$$0);
 var require$$1__default = /*#__PURE__*/_interopDefault(require$$1);
-var require$$2__default = /*#__PURE__*/_interopDefault(require$$2);
-var require$$3__default = /*#__PURE__*/_interopDefault(require$$3);
-var require$$4__default = /*#__PURE__*/_interopDefault(require$$4);
 
 var providersRegistry;
 var hasRequiredProvidersRegistry;
@@ -20,53 +17,10 @@ function requireProvidersRegistry() {
     if (hasRequiredProvidersRegistry) return providersRegistry;
     hasRequiredProvidersRegistry = 1;
     const { strict: assert } = require$$0__default.default;
-    const jwt = require$$1__default.default;
-    const urljoin = require$$2__default.default;
-    const jwkToPem = require$$3__default.default;
-    const getCognitoPayload = async ({ idToken, jwksUrl, purest })=>{
-        const { header: { kid }, payload } = jwt.decode(idToken, {
-            complete: true
-        });
-        if (!payload || !kid) {
-            throw new Error('The provided token is not valid');
-        }
-        const config = {
-            cognito: {
-                discovery: {
-                    origin: jwksUrl.origin,
-                    path: jwksUrl.pathname
-                }
-            }
-        };
-        try {
-            const cognito = purest({
-                provider: 'cognito',
-                config
-            });
-            // get the JSON Web Key (JWK) for the user pool
-            const { body: jwk } = await cognito('discovery').request();
-            // Get the key with the same Key ID as the provided token
-            const key = jwk.keys.find(({ kid: jwkKid })=>jwkKid === kid);
-            const pem = jwkToPem(key);
-            // https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-verifying-a-jwt.html
-            const decodedToken = await new Promise((resolve, reject)=>{
-                jwt.verify(idToken, pem, {
-                    algorithms: [
-                        'RS256'
-                    ]
-                }, (err, decodedToken)=>{
-                    if (err) {
-                        reject();
-                    }
-                    resolve(decodedToken);
-                });
-            });
-            return decodedToken;
-        } catch (err) {
-            throw new Error('There was an error verifying the token');
-        }
-    };
-    const initProviders = ({ baseURL, purest })=>({
+    const urljoin = require$$1__default.default;
+    const { verifyJwtWithJwks: verifyJwtWithJwks$1 } = verifyJwtWithJwks.__require();
+    const { bearerGet, fetchJson } = providerHttp.__require();
+    const initProviders = ({ baseURL })=>({
             email: {
                 enabled: true,
                 icon: 'envelope',
@@ -85,17 +39,15 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken }) {
-                    const discord = purest({
-                        provider: 'discord'
-                    });
-                    return discord.get('users/@me').auth(accessToken).request().then(({ body })=>{
-                        // Combine username and discriminator (if discriminator exists and not equal to 0)
-                        const username = body.discriminator && body.discriminator !== '0' ? `${body.username}#${body.discriminator}` : body.username;
-                        return {
-                            username,
-                            email: body.email
-                        };
-                    });
+                    const { body } = await bearerGet('https://discord.com/api/users/@me', accessToken);
+                    if (body.verified !== true) {
+                        throw new Error('Email not verified by Discord');
+                    }
+                    const username = body.discriminator && body.discriminator !== '0' ? `${body.username}#${body.discriminator}` : body.username;
+                    return {
+                        username,
+                        email: body.email
+                    };
                 }
             },
             facebook: {
@@ -110,15 +62,18 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken }) {
-                    const facebook = purest({
-                        provider: 'facebook'
+                    const { body } = await bearerGet('https://graph.facebook.com/me', accessToken, {
+                        qs: {
+                            fields: 'name,email'
+                        }
                     });
-                    return facebook.get('me').auth(accessToken).qs({
-                        fields: 'name,email'
-                    }).request().then(({ body })=>({
-                            username: body.name,
-                            email: body.email
-                        }));
+                    if (!body.email) {
+                        throw new Error('Email not verified by Facebook');
+                    }
+                    return {
+                        username: body.name,
+                        email: body.email
+                    };
                 }
             },
             google: {
@@ -133,15 +88,15 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken }) {
-                    const google = purest({
-                        provider: 'google'
-                    });
-                    return google.query('oauth').get('tokeninfo').qs({
-                        accessToken
-                    }).request().then(({ body })=>({
-                            username: body.email.split('@')[0],
-                            email: body.email
-                        }));
+                    const { body } = await fetchJson(`https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(accessToken)}`);
+                    const verified = body.verified_email ?? body.email_verified;
+                    if (verified !== true && verified !== 'true') {
+                        throw new Error('Email not verified by Google');
+                    }
+                    return {
+                        username: body.email.split('@')[0],
+                        email: body.email
+                    };
                 }
             },
             github: {
@@ -157,27 +112,33 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken }) {
-                    const github = purest({
-                        provider: 'github',
-                        defaults: {
-                            headers: {
-                                'user-agent': 'strapi'
-                            }
+                    const { body: userBody } = await bearerGet('https://api.github.com/user', accessToken, {
+                        headers: {
+                            'user-agent': 'strapi'
+                        }
+                    });
+                    const { body: emailBody } = await bearerGet('https://api.github.com/user/emails', accessToken, {
+                        headers: {
+                            'user-agent': 'strapi'
                         }
                     });
-                    const { body: userBody } = await github.get('user').auth(accessToken).request();
-                    // This is the public email on the github profile
                     if (userBody.email) {
+                        const verifiedPublicEmail = Array.isArray(emailBody) ? emailBody.find((entry)=>entry.email === userBody.email && entry.verified === true) : null;
+                        if (!verifiedPublicEmail) {
+                            throw new Error('Email not verified by GitHub');
+                        }
                         return {
                             username: userBody.login,
                             email: userBody.email
                         };
                     }
-                    // Get the email with Github's user/emails API
-                    const { body: emailBody } = await github.get('user/emails').auth(accessToken).request();
+                    const primaryEmail = Array.isArray(emailBody) ? emailBody.find((email)=>email.primary === true) : null;
+                    if (!primaryEmail || primaryEmail.verified !== true) {
+                        throw new Error('Email not verified by GitHub');
+                    }
                     return {
                         username: userBody.login,
-                        email: Array.isArray(emailBody) ? emailBody.find((email)=>email.primary === true).email : null
+                        email: primaryEmail.email
                     };
                 }
             },
@@ -193,13 +154,11 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken }) {
-                    const microsoft = purest({
-                        provider: 'microsoft'
-                    });
-                    return microsoft.get('me').auth(accessToken).request().then(({ body })=>({
-                            username: body.userPrincipalName,
-                            email: body.userPrincipalName
-                        }));
+                    const { body } = await bearerGet('https://graph.microsoft.com/v1.0/me', accessToken);
+                    return {
+                        username: body.userPrincipalName,
+                        email: body.userPrincipalName
+                    };
                 }
             },
             twitter: {
@@ -210,23 +169,31 @@ function requireProvidersRegistry() {
                     secret: '',
                     callbackUrl: `${baseURL}/twitter/callback`
                 },
-                async authCallback ({ accessToken, query, providers }) {
-                    const twitter = purest({
-                        provider: 'twitter',
-                        defaults: {
-                            oauth: {
-                                consumer_key: providers.twitter.key,
-                                consumer_secret: providers.twitter.secret
-                            }
+                async authCallback ({ accessToken, providers, grantResponse }) {
+                    const accessSecret = grantResponse?.access_secret;
+                    const screenName = grantResponse?.raw?.screen_name;
+                    if (!accessSecret) {
+                        throw new Error('Twitter authentication requires a completed OAuth session');
+                    }
+                    const { twitterGet } = oauth1.__require();
+                    const { body } = await twitterGet({
+                        url: 'https://api.twitter.com/1.1/account/verify_credentials.json',
+                        accessToken,
+                        accessCredential: accessSecret,
+                        consumerKey: providers.twitter.key,
+                        clientCredential: providers.twitter.secret,
+                        qs: {
+                            include_email: 'true',
+                            screen_name: screenName
                         }
                     });
-                    return twitter.get('account/verify_credentials').auth(accessToken, query.access_secret).qs({
-                        screen_name: query['raw[screen_name]'],
-                        include_email: 'true'
-                    }).request().then(({ body })=>({
-                            username: body.screen_name,
-                            email: body.email
-                        }));
+                    if (!body.email) {
+                        throw new Error('Email not verified by Twitter');
+                    }
+                    return {
+                        username: body.screen_name,
+                        email: body.email
+                    };
                 }
             },
             instagram: {
@@ -241,15 +208,15 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken }) {
-                    const instagram = purest({
-                        provider: 'instagram'
+                    const { body } = await bearerGet('https://graph.instagram.com/me', accessToken, {
+                        qs: {
+                            fields: 'id,username'
+                        }
                     });
-                    return instagram.get('me').auth(accessToken).qs({
-                        fields: 'id,username'
-                    }).request().then(({ body })=>({
-                            username: body.username,
-                            email: `${body.username}@strapi.io`
-                        }));
+                    return {
+                        username: body.username,
+                        email: `${body.username}@strapi.io`
+                    };
                 }
             },
             vk: {
@@ -263,17 +230,25 @@ function requireProvidersRegistry() {
                         'email'
                     ]
                 },
-                async authCallback ({ accessToken, query }) {
-                    const vk = purest({
-                        provider: 'vk'
+                async authCallback ({ accessToken, grantResponse }) {
+                    const email = grantResponse?.raw?.email;
+                    const userId = grantResponse?.raw?.user_id;
+                    if (!email || !userId) {
+                        throw new Error('VK authentication requires a completed OAuth session');
+                    }
+                    const { body } = await bearerGet('https://api.vk.com/method/users.get', accessToken, {
+                        qs: {
+                            user_ids: userId,
+                            v: '5.122'
+                        }
                     });
-                    return vk.get('users').auth(accessToken).qs({
-                        id: query.raw.user_id,
-                        v: '5.122'
-                    }).request().then(({ body })=>({
-                            username: `${body.response[0].last_name} ${body.response[0].first_name}`,
-                            email: query.raw.email
-                        }));
+                    if (!body.response?.[0]) {
+                        throw new Error('Invalid VK access token');
+                    }
+                    return {
+                        username: `${body.response[0].last_name} ${body.response[0].first_name}`,
+                        email
+                    };
                 }
             },
             twitch: {
@@ -288,25 +263,19 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken, providers }) {
-                    const twitch = purest({
-                        provider: 'twitch',
-                        config: {
-                            twitch: {
-                                default: {
-                                    origin: 'https://api.twitch.tv',
-                                    path: 'helix/{path}',
-                                    headers: {
-                                        Authorization: 'Bearer {auth}',
-                                        'Client-Id': '{auth}'
-                                    }
-                                }
-                            }
+                    const { body } = await bearerGet('https://api.twitch.tv/helix/users', accessToken, {
+                        headers: {
+                            'Client-Id': providers.twitch.key
                         }
                     });
-                    return twitch.get('users').auth(accessToken, providers.twitch.key).request().then(({ body })=>({
-                            username: body.data[0].login,
-                            email: body.data[0].email
-                        }));
+                    const email = body.data?.[0]?.email;
+                    if (!email) {
+                        throw new Error('Email not verified by Twitch');
+                    }
+                    return {
+                        username: body.data[0].login,
+                        email
+                    };
                 }
             },
             linkedin: {
@@ -322,14 +291,14 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken }) {
-                    const linkedIn = purest({
-                        provider: 'linkedin'
-                    });
-                    const { body: { localizedFirstName } } = await linkedIn.get('me').auth(accessToken).request();
-                    const { body: { elements } } = await linkedIn.get('emailAddress?q=members&projection=(elements*(handle~))').auth(accessToken).request();
-                    const email = elements[0]['handle~'];
+                    const { body: profileBody } = await bearerGet('https://api.linkedin.com/v2/me', accessToken);
+                    const { body: emailBody } = await bearerGet('https://api.linkedin.com/v2/emailAddress?q=members&projection=(elements*(handle~))', accessToken);
+                    const email = emailBody.elements[0]?.['handle~'];
+                    if (!email?.emailAddress) {
+                        throw new Error('Email not verified by LinkedIn');
+                    }
                     return {
-                        username: localizedFirstName,
+                        username: profileBody.localizedFirstName,
                         email: email.emailAddress
                     };
                 }
@@ -348,14 +317,19 @@ function requireProvidersRegistry() {
                         'profile'
                     ]
                 },
-                async authCallback ({ query, providers }) {
+                async authCallback ({ providers, grantResponse }) {
                     const jwksUrl = new URL(providers.cognito.jwksurl);
-                    const idToken = query.id_token;
-                    const tokenPayload = await getCognitoPayload({
+                    const idToken = grantResponse?.id_token;
+                    if (!idToken) {
+                        throw new Error('Cognito authentication requires a completed OAuth session');
+                    }
+                    const tokenPayload = await verifyJwtWithJwks$1({
                         idToken,
-                        jwksUrl,
-                        purest
+                        jwksUrl
                     });
+                    if (tokenPayload.email_verified !== true) {
+                        throw new Error('Email not verified by Cognito');
+                    }
                     return {
                         username: tokenPayload['cognito:username'],
                         email: tokenPayload.email
@@ -374,26 +348,15 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken }) {
-                    const reddit = purest({
-                        provider: 'reddit',
-                        config: {
-                            reddit: {
-                                default: {
-                                    origin: 'https://oauth.reddit.com',
-                                    path: 'api/{version}/{path}',
-                                    version: 'v1',
-                                    headers: {
-                                        Authorization: 'Bearer {auth}',
-                                        'user-agent': 'strapi'
-                                    }
-                                }
-                            }
+                    const { body } = await bearerGet('https://oauth.reddit.com/api/v1/me', accessToken, {
+                        headers: {
+                            'user-agent': 'strapi'
                         }
                     });
-                    return reddit.get('me').auth(accessToken).request().then(({ body })=>({
-                            username: body.name,
-                            email: `${body.name}@strapi.io`
-                        }));
+                    return {
+                        username: body.name,
+                        email: `${body.name}@strapi.io`
+                    };
                 }
             },
             auth0: {
@@ -411,17 +374,16 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken, providers }) {
-                    const auth0 = purest({
-                        provider: 'auth0'
-                    });
-                    return auth0.get('userinfo').subdomain(providers.auth0.subdomain).auth(accessToken).request().then(({ body })=>{
-                        const username = body.username || body.nickname || body.name || body.email.split('@')[0];
-                        const email = body.email || `${username.replace(/\s+/g, '.')}@strapi.io`;
-                        return {
-                            username,
-                            email
-                        };
-                    });
+                    const { body } = await bearerGet(`https://${providers.auth0.subdomain}.auth0.com/userinfo`, accessToken);
+                    if (body.email && body.email_verified !== true) {
+                        throw new Error('Email not verified by Auth0');
+                    }
+                    const username = body.username || body.nickname || body.name || body.email.split('@')[0];
+                    const email = body.email || `${username.replace(/\s+/g, '.')}@strapi.io`;
+                    return {
+                        username,
+                        email
+                    };
                 }
             },
             cas: {
@@ -437,21 +399,20 @@ function requireProvidersRegistry() {
                     subdomain: 'my.subdomain.com/cas'
                 },
                 async authCallback ({ accessToken, providers }) {
-                    const cas = purest({
-                        provider: 'cas'
-                    });
-                    return cas.get('oidc/profile').subdomain(providers.cas.subdomain).auth(accessToken).request().then(({ body })=>{
-                        // CAS attribute may be in body.attributes or "FLAT", depending on CAS config
-                        const username = body.attributes ? body.attributes.strapiusername || body.id || body.sub : body.strapiusername || body.id || body.sub;
-                        const email = body.attributes ? body.attributes.strapiemail || body.attributes.email : body.strapiemail || body.email;
-                        if (!username || !email) {
-                            strapi.log.warn(`CAS Response Body did not contain required attributes: ${JSON.stringify(body)}`);
-                        }
-                        return {
-                            username,
-                            email
-                        };
-                    });
+                    const { body } = await bearerGet(`https://${providers.cas.subdomain}/oidc/profile`, accessToken);
+                    const username = body.attributes ? body.attributes.strapiusername || body.id || body.sub : body.strapiusername || body.id || body.sub;
+                    const email = body.attributes ? body.attributes.strapiemail || body.attributes.email : body.strapiemail || body.email;
+                    const emailVerified = body.email_verified ?? body.attributes?.email_verified;
+                    if (!username || !email) {
+                        strapi.log.warn(`CAS Response Body did not contain required attributes: ${JSON.stringify(body)}`);
+                    }
+                    if (email && emailVerified !== true) {
+                        throw new Error('Email not verified by CAS');
+                    }
+                    return {
+                        username,
+                        email
+                    };
                 }
             },
             patreon: {
@@ -467,29 +428,15 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken }) {
-                    const patreon = purest({
-                        provider: 'patreon',
-                        config: {
-                            patreon: {
-                                default: {
-                                    origin: 'https://www.patreon.com',
-                                    path: 'api/oauth2/{path}',
-                                    headers: {
-                                        authorization: 'Bearer {auth}'
-                                    }
-                                }
-                            }
-                        }
-                    });
-                    return patreon.get('v2/identity').auth(accessToken).qs(new URLSearchParams({
-                        'fields[user]': 'full_name,email'
-                    }).toString()).request().then(({ body })=>{
-                        const patreonData = body.data.attributes;
-                        return {
-                            username: patreonData.full_name,
-                            email: patreonData.email
-                        };
-                    });
+                    const { body } = await bearerGet('https://www.patreon.com/api/oauth2/v2/identity?fields[user]=full_name,email,is_email_verified', accessToken);
+                    const patreonData = body.data.attributes;
+                    if (patreonData.is_email_verified !== true) {
+                        throw new Error('Email not verified by Patreon');
+                    }
+                    return {
+                        username: patreonData.full_name,
+                        email: patreonData.email
+                    };
                 }
             },
             keycloak: {
@@ -507,29 +454,24 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken, providers }) {
-                    const keycloak = purest({
-                        provider: 'keycloak'
-                    });
-                    return keycloak.subdomain(providers.keycloak.subdomain).get('protocol/openid-connect/userinfo').auth(accessToken).request().then(({ body })=>{
-                        return {
-                            username: body.preferred_username,
-                            email: body.email
-                        };
-                    });
+                    const { body } = await bearerGet(`https://${providers.keycloak.subdomain}/protocol/openid-connect/userinfo`, accessToken);
+                    if (body.email_verified !== true) {
+                        throw new Error('Email not verified by Keycloak');
+                    }
+                    return {
+                        username: body.preferred_username,
+                        email: body.email
+                    };
                 }
             }
         });
     providersRegistry = ()=>{
-        const purest = require$$4__default.default;
         const apiPrefix = strapi.config.get('api.rest.prefix');
         const baseURL = urljoin(strapi.config.server.url, apiPrefix, 'auth');
         const authProviders = initProviders({
-            baseURL,
-            purest
+            baseURL
         });
-        /**
-	   * @public
-	   */ return {
+        return {
             getAll () {
                 return authProviders;
             },
@@ -542,16 +484,14 @@ function requireProvidersRegistry() {
             remove (name) {
                 delete authProviders[name];
             },
-            /**
-	     * @internal
-	     */ async run ({ provider, accessToken, query, providers }) {
+            async run ({ provider, accessToken, query, providers, grantResponse }) {
                 const authProvider = authProviders[provider];
                 assert(authProvider, 'Unknown auth provider');
                 return authProvider.authCallback({
                     accessToken,
                     query,
                     providers,
-                    purest
+                    grantResponse
                 });
             }
         };