@strapi/plugin-users-permissions 0.0.0-experimental.6340da17068c3bed7fb006e7bcc554c71129e282 → 0.0.0-experimental.63624e21eb5b0713345a0cf2f68f1c40eab427bc

package/dist/server/services/providers-registry.mjs

@@ -1,8 +1,8 @@
 import require$$0 from 'assert';
-import require$$1 from 'jsonwebtoken';
-import require$$2 from 'url-join';
-import require$$3 from 'jwk-to-pem';
-import require$$4 from 'purest';
+import require$$1 from 'url-join';
+import { __require as requireVerifyJwtWithJwks } from '../utils/verify-jwt-with-jwks.mjs';
+import { __require as requireProviderHttp } from '../utils/provider-http.mjs';
+import { __require as requireOauth1 } from '../utils/oauth-connect/oauth1.mjs';
 
 var providersRegistry;
 var hasRequiredProvidersRegistry;
@@ -10,53 +10,10 @@ function requireProvidersRegistry() {
     if (hasRequiredProvidersRegistry) return providersRegistry;
     hasRequiredProvidersRegistry = 1;
     const { strict: assert } = require$$0;
-    const jwt = require$$1;
-    const urljoin = require$$2;
-    const jwkToPem = require$$3;
-    const getCognitoPayload = async ({ idToken, jwksUrl, purest })=>{
-        const { header: { kid }, payload } = jwt.decode(idToken, {
-            complete: true
-        });
-        if (!payload || !kid) {
-            throw new Error('The provided token is not valid');
-        }
-        const config = {
-            cognito: {
-                discovery: {
-                    origin: jwksUrl.origin,
-                    path: jwksUrl.pathname
-                }
-            }
-        };
-        try {
-            const cognito = purest({
-                provider: 'cognito',
-                config
-            });
-            // get the JSON Web Key (JWK) for the user pool
-            const { body: jwk } = await cognito('discovery').request();
-            // Get the key with the same Key ID as the provided token
-            const key = jwk.keys.find(({ kid: jwkKid })=>jwkKid === kid);
-            const pem = jwkToPem(key);
-            // https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-verifying-a-jwt.html
-            const decodedToken = await new Promise((resolve, reject)=>{
-                jwt.verify(idToken, pem, {
-                    algorithms: [
-                        'RS256'
-                    ]
-                }, (err, decodedToken)=>{
-                    if (err) {
-                        reject();
-                    }
-                    resolve(decodedToken);
-                });
-            });
-            return decodedToken;
-        } catch (err) {
-            throw new Error('There was an error verifying the token');
-        }
-    };
-    const initProviders = ({ baseURL, purest })=>({
+    const urljoin = require$$1;
+    const { verifyJwtWithJwks } = requireVerifyJwtWithJwks();
+    const { bearerGet, fetchJson } = requireProviderHttp();
+    const initProviders = ({ baseURL })=>({
             email: {
                 enabled: true,
                 icon: 'envelope',
@@ -75,17 +32,15 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken }) {
-                    const discord = purest({
-                        provider: 'discord'
-                    });
-                    return discord.get('users/@me').auth(accessToken).request().then(({ body })=>{
-                        // Combine username and discriminator (if discriminator exists and not equal to 0)
-                        const username = body.discriminator && body.discriminator !== '0' ? `${body.username}#${body.discriminator}` : body.username;
-                        return {
-                            username,
-                            email: body.email
-                        };
-                    });
+                    const { body } = await bearerGet('https://discord.com/api/users/@me', accessToken);
+                    if (body.verified !== true) {
+                        throw new Error('Email not verified by Discord');
+                    }
+                    const username = body.discriminator && body.discriminator !== '0' ? `${body.username}#${body.discriminator}` : body.username;
+                    return {
+                        username,
+                        email: body.email
+                    };
                 }
             },
             facebook: {
@@ -100,15 +55,18 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken }) {
-                    const facebook = purest({
-                        provider: 'facebook'
+                    const { body } = await bearerGet('https://graph.facebook.com/me', accessToken, {
+                        qs: {
+                            fields: 'name,email'
+                        }
                     });
-                    return facebook.get('me').auth(accessToken).qs({
-                        fields: 'name,email'
-                    }).request().then(({ body })=>({
-                            username: body.name,
-                            email: body.email
-                        }));
+                    if (!body.email) {
+                        throw new Error('Email not verified by Facebook');
+                    }
+                    return {
+                        username: body.name,
+                        email: body.email
+                    };
                 }
             },
             google: {
@@ -123,15 +81,15 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken }) {
-                    const google = purest({
-                        provider: 'google'
-                    });
-                    return google.query('oauth').get('tokeninfo').qs({
-                        accessToken
-                    }).request().then(({ body })=>({
-                            username: body.email.split('@')[0],
-                            email: body.email
-                        }));
+                    const { body } = await fetchJson(`https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(accessToken)}`);
+                    const verified = body.verified_email ?? body.email_verified;
+                    if (verified !== true && verified !== 'true') {
+                        throw new Error('Email not verified by Google');
+                    }
+                    return {
+                        username: body.email.split('@')[0],
+                        email: body.email
+                    };
                 }
             },
             github: {
@@ -147,27 +105,33 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken }) {
-                    const github = purest({
-                        provider: 'github',
-                        defaults: {
-                            headers: {
-                                'user-agent': 'strapi'
-                            }
+                    const { body: userBody } = await bearerGet('https://api.github.com/user', accessToken, {
+                        headers: {
+                            'user-agent': 'strapi'
+                        }
+                    });
+                    const { body: emailBody } = await bearerGet('https://api.github.com/user/emails', accessToken, {
+                        headers: {
+                            'user-agent': 'strapi'
                         }
                     });
-                    const { body: userBody } = await github.get('user').auth(accessToken).request();
-                    // This is the public email on the github profile
                     if (userBody.email) {
+                        const verifiedPublicEmail = Array.isArray(emailBody) ? emailBody.find((entry)=>entry.email === userBody.email && entry.verified === true) : null;
+                        if (!verifiedPublicEmail) {
+                            throw new Error('Email not verified by GitHub');
+                        }
                         return {
                             username: userBody.login,
                             email: userBody.email
                         };
                     }
-                    // Get the email with Github's user/emails API
-                    const { body: emailBody } = await github.get('user/emails').auth(accessToken).request();
+                    const primaryEmail = Array.isArray(emailBody) ? emailBody.find((email)=>email.primary === true) : null;
+                    if (!primaryEmail || primaryEmail.verified !== true) {
+                        throw new Error('Email not verified by GitHub');
+                    }
                     return {
                         username: userBody.login,
-                        email: Array.isArray(emailBody) ? emailBody.find((email)=>email.primary === true).email : null
+                        email: primaryEmail.email
                     };
                 }
             },
@@ -183,13 +147,11 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken }) {
-                    const microsoft = purest({
-                        provider: 'microsoft'
-                    });
-                    return microsoft.get('me').auth(accessToken).request().then(({ body })=>({
-                            username: body.userPrincipalName,
-                            email: body.userPrincipalName
-                        }));
+                    const { body } = await bearerGet('https://graph.microsoft.com/v1.0/me', accessToken);
+                    return {
+                        username: body.userPrincipalName,
+                        email: body.userPrincipalName
+                    };
                 }
             },
             twitter: {
@@ -200,23 +162,31 @@ function requireProvidersRegistry() {
                     secret: '',
                     callbackUrl: `${baseURL}/twitter/callback`
                 },
-                async authCallback ({ accessToken, query, providers }) {
-                    const twitter = purest({
-                        provider: 'twitter',
-                        defaults: {
-                            oauth: {
-                                consumer_key: providers.twitter.key,
-                                consumer_secret: providers.twitter.secret
-                            }
+                async authCallback ({ accessToken, providers, grantResponse }) {
+                    const accessSecret = grantResponse?.access_secret;
+                    const screenName = grantResponse?.raw?.screen_name;
+                    if (!accessSecret) {
+                        throw new Error('Twitter authentication requires a completed OAuth session');
+                    }
+                    const { twitterGet } = requireOauth1();
+                    const { body } = await twitterGet({
+                        url: 'https://api.twitter.com/1.1/account/verify_credentials.json',
+                        accessToken,
+                        accessCredential: accessSecret,
+                        consumerKey: providers.twitter.key,
+                        clientCredential: providers.twitter.secret,
+                        qs: {
+                            include_email: 'true',
+                            screen_name: screenName
                         }
                     });
-                    return twitter.get('account/verify_credentials').auth(accessToken, query.access_secret).qs({
-                        screen_name: query['raw[screen_name]'],
-                        include_email: 'true'
-                    }).request().then(({ body })=>({
-                            username: body.screen_name,
-                            email: body.email
-                        }));
+                    if (!body.email) {
+                        throw new Error('Email not verified by Twitter');
+                    }
+                    return {
+                        username: body.screen_name,
+                        email: body.email
+                    };
                 }
             },
             instagram: {
@@ -231,15 +201,15 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken }) {
-                    const instagram = purest({
-                        provider: 'instagram'
+                    const { body } = await bearerGet('https://graph.instagram.com/me', accessToken, {
+                        qs: {
+                            fields: 'id,username'
+                        }
                     });
-                    return instagram.get('me').auth(accessToken).qs({
-                        fields: 'id,username'
-                    }).request().then(({ body })=>({
-                            username: body.username,
-                            email: `${body.username}@strapi.io`
-                        }));
+                    return {
+                        username: body.username,
+                        email: `${body.username}@strapi.io`
+                    };
                 }
             },
             vk: {
@@ -253,17 +223,25 @@ function requireProvidersRegistry() {
                         'email'
                     ]
                 },
-                async authCallback ({ accessToken, query }) {
-                    const vk = purest({
-                        provider: 'vk'
+                async authCallback ({ accessToken, grantResponse }) {
+                    const email = grantResponse?.raw?.email;
+                    const userId = grantResponse?.raw?.user_id;
+                    if (!email || !userId) {
+                        throw new Error('VK authentication requires a completed OAuth session');
+                    }
+                    const { body } = await bearerGet('https://api.vk.com/method/users.get', accessToken, {
+                        qs: {
+                            user_ids: userId,
+                            v: '5.122'
+                        }
                     });
-                    return vk.get('users').auth(accessToken).qs({
-                        id: query.raw.user_id,
-                        v: '5.122'
-                    }).request().then(({ body })=>({
-                            username: `${body.response[0].last_name} ${body.response[0].first_name}`,
-                            email: query.raw.email
-                        }));
+                    if (!body.response?.[0]) {
+                        throw new Error('Invalid VK access token');
+                    }
+                    return {
+                        username: `${body.response[0].last_name} ${body.response[0].first_name}`,
+                        email
+                    };
                 }
             },
             twitch: {
@@ -278,25 +256,19 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken, providers }) {
-                    const twitch = purest({
-                        provider: 'twitch',
-                        config: {
-                            twitch: {
-                                default: {
-                                    origin: 'https://api.twitch.tv',
-                                    path: 'helix/{path}',
-                                    headers: {
-                                        Authorization: 'Bearer {auth}',
-                                        'Client-Id': '{auth}'
-                                    }
-                                }
-                            }
+                    const { body } = await bearerGet('https://api.twitch.tv/helix/users', accessToken, {
+                        headers: {
+                            'Client-Id': providers.twitch.key
                         }
                     });
-                    return twitch.get('users').auth(accessToken, providers.twitch.key).request().then(({ body })=>({
-                            username: body.data[0].login,
-                            email: body.data[0].email
-                        }));
+                    const email = body.data?.[0]?.email;
+                    if (!email) {
+                        throw new Error('Email not verified by Twitch');
+                    }
+                    return {
+                        username: body.data[0].login,
+                        email
+                    };
                 }
             },
             linkedin: {
@@ -312,14 +284,14 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken }) {
-                    const linkedIn = purest({
-                        provider: 'linkedin'
-                    });
-                    const { body: { localizedFirstName } } = await linkedIn.get('me').auth(accessToken).request();
-                    const { body: { elements } } = await linkedIn.get('emailAddress?q=members&projection=(elements*(handle~))').auth(accessToken).request();
-                    const email = elements[0]['handle~'];
+                    const { body: profileBody } = await bearerGet('https://api.linkedin.com/v2/me', accessToken);
+                    const { body: emailBody } = await bearerGet('https://api.linkedin.com/v2/emailAddress?q=members&projection=(elements*(handle~))', accessToken);
+                    const email = emailBody.elements[0]?.['handle~'];
+                    if (!email?.emailAddress) {
+                        throw new Error('Email not verified by LinkedIn');
+                    }
                     return {
-                        username: localizedFirstName,
+                        username: profileBody.localizedFirstName,
                         email: email.emailAddress
                     };
                 }
@@ -338,14 +310,19 @@ function requireProvidersRegistry() {
                         'profile'
                     ]
                 },
-                async authCallback ({ query, providers }) {
+                async authCallback ({ providers, grantResponse }) {
                     const jwksUrl = new URL(providers.cognito.jwksurl);
-                    const idToken = query.id_token;
-                    const tokenPayload = await getCognitoPayload({
+                    const idToken = grantResponse?.id_token;
+                    if (!idToken) {
+                        throw new Error('Cognito authentication requires a completed OAuth session');
+                    }
+                    const tokenPayload = await verifyJwtWithJwks({
                         idToken,
-                        jwksUrl,
-                        purest
+                        jwksUrl
                     });
+                    if (tokenPayload.email_verified !== true) {
+                        throw new Error('Email not verified by Cognito');
+                    }
                     return {
                         username: tokenPayload['cognito:username'],
                         email: tokenPayload.email
@@ -364,26 +341,15 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken }) {
-                    const reddit = purest({
-                        provider: 'reddit',
-                        config: {
-                            reddit: {
-                                default: {
-                                    origin: 'https://oauth.reddit.com',
-                                    path: 'api/{version}/{path}',
-                                    version: 'v1',
-                                    headers: {
-                                        Authorization: 'Bearer {auth}',
-                                        'user-agent': 'strapi'
-                                    }
-                                }
-                            }
+                    const { body } = await bearerGet('https://oauth.reddit.com/api/v1/me', accessToken, {
+                        headers: {
+                            'user-agent': 'strapi'
                         }
                     });
-                    return reddit.get('me').auth(accessToken).request().then(({ body })=>({
-                            username: body.name,
-                            email: `${body.name}@strapi.io`
-                        }));
+                    return {
+                        username: body.name,
+                        email: `${body.name}@strapi.io`
+                    };
                 }
             },
             auth0: {
@@ -401,17 +367,16 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken, providers }) {
-                    const auth0 = purest({
-                        provider: 'auth0'
-                    });
-                    return auth0.get('userinfo').subdomain(providers.auth0.subdomain).auth(accessToken).request().then(({ body })=>{
-                        const username = body.username || body.nickname || body.name || body.email.split('@')[0];
-                        const email = body.email || `${username.replace(/\s+/g, '.')}@strapi.io`;
-                        return {
-                            username,
-                            email
-                        };
-                    });
+                    const { body } = await bearerGet(`https://${providers.auth0.subdomain}.auth0.com/userinfo`, accessToken);
+                    if (body.email && body.email_verified !== true) {
+                        throw new Error('Email not verified by Auth0');
+                    }
+                    const username = body.username || body.nickname || body.name || body.email.split('@')[0];
+                    const email = body.email || `${username.replace(/\s+/g, '.')}@strapi.io`;
+                    return {
+                        username,
+                        email
+                    };
                 }
             },
             cas: {
@@ -427,21 +392,20 @@ function requireProvidersRegistry() {
                     subdomain: 'my.subdomain.com/cas'
                 },
                 async authCallback ({ accessToken, providers }) {
-                    const cas = purest({
-                        provider: 'cas'
-                    });
-                    return cas.get('oidc/profile').subdomain(providers.cas.subdomain).auth(accessToken).request().then(({ body })=>{
-                        // CAS attribute may be in body.attributes or "FLAT", depending on CAS config
-                        const username = body.attributes ? body.attributes.strapiusername || body.id || body.sub : body.strapiusername || body.id || body.sub;
-                        const email = body.attributes ? body.attributes.strapiemail || body.attributes.email : body.strapiemail || body.email;
-                        if (!username || !email) {
-                            strapi.log.warn(`CAS Response Body did not contain required attributes: ${JSON.stringify(body)}`);
-                        }
-                        return {
-                            username,
-                            email
-                        };
-                    });
+                    const { body } = await bearerGet(`https://${providers.cas.subdomain}/oidc/profile`, accessToken);
+                    const username = body.attributes ? body.attributes.strapiusername || body.id || body.sub : body.strapiusername || body.id || body.sub;
+                    const email = body.attributes ? body.attributes.strapiemail || body.attributes.email : body.strapiemail || body.email;
+                    const emailVerified = body.email_verified ?? body.attributes?.email_verified;
+                    if (!username || !email) {
+                        strapi.log.warn(`CAS Response Body did not contain required attributes: ${JSON.stringify(body)}`);
+                    }
+                    if (email && emailVerified !== true) {
+                        throw new Error('Email not verified by CAS');
+                    }
+                    return {
+                        username,
+                        email
+                    };
                 }
             },
             patreon: {
@@ -457,29 +421,15 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken }) {
-                    const patreon = purest({
-                        provider: 'patreon',
-                        config: {
-                            patreon: {
-                                default: {
-                                    origin: 'https://www.patreon.com',
-                                    path: 'api/oauth2/{path}',
-                                    headers: {
-                                        authorization: 'Bearer {auth}'
-                                    }
-                                }
-                            }
-                        }
-                    });
-                    return patreon.get('v2/identity').auth(accessToken).qs(new URLSearchParams({
-                        'fields[user]': 'full_name,email'
-                    }).toString()).request().then(({ body })=>{
-                        const patreonData = body.data.attributes;
-                        return {
-                            username: patreonData.full_name,
-                            email: patreonData.email
-                        };
-                    });
+                    const { body } = await bearerGet('https://www.patreon.com/api/oauth2/v2/identity?fields[user]=full_name,email,is_email_verified', accessToken);
+                    const patreonData = body.data.attributes;
+                    if (patreonData.is_email_verified !== true) {
+                        throw new Error('Email not verified by Patreon');
+                    }
+                    return {
+                        username: patreonData.full_name,
+                        email: patreonData.email
+                    };
                 }
             },
             keycloak: {
@@ -497,29 +447,24 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken, providers }) {
-                    const keycloak = purest({
-                        provider: 'keycloak'
-                    });
-                    return keycloak.subdomain(providers.keycloak.subdomain).get('protocol/openid-connect/userinfo').auth(accessToken).request().then(({ body })=>{
-                        return {
-                            username: body.preferred_username,
-                            email: body.email
-                        };
-                    });
+                    const { body } = await bearerGet(`https://${providers.keycloak.subdomain}/protocol/openid-connect/userinfo`, accessToken);
+                    if (body.email_verified !== true) {
+                        throw new Error('Email not verified by Keycloak');
+                    }
+                    return {
+                        username: body.preferred_username,
+                        email: body.email
+                    };
                 }
             }
         });
     providersRegistry = ()=>{
-        const purest = require$$4;
         const apiPrefix = strapi.config.get('api.rest.prefix');
         const baseURL = urljoin(strapi.config.server.url, apiPrefix, 'auth');
         const authProviders = initProviders({
-            baseURL,
-            purest
+            baseURL
         });
-        /**
-	   * @public
-	   */ return {
+        return {
             getAll () {
                 return authProviders;
             },
@@ -532,16 +477,14 @@ function requireProvidersRegistry() {
             remove (name) {
                 delete authProviders[name];
             },
-            /**
-	     * @internal
-	     */ async run ({ provider, accessToken, query, providers }) {
+            async run ({ provider, accessToken, query, providers, grantResponse }) {
                 const authProvider = authProviders[provider];
                 assert(authProvider, 'Unknown auth provider');
                 return authProvider.authCallback({
                     accessToken,
                     query,
                     providers,
-                    purest
+                    grantResponse
                 });
             }
         };