@strapi/plugin-users-permissions 0.0.0-experimental.6340da17068c3bed7fb006e7bcc554c71129e282 → 0.0.0-experimental.63624e21eb5b0713345a0cf2f68f1c40eab427bc

package/server/src/utils/oauth-connect/oauth2.js

@@ -0,0 +1,123 @@
+'use strict';
+
+const crypto = require('node:crypto');
+
+const formatScope = (scope, delimiter = ',') => {
+  if (Array.isArray(scope)) {
+    return scope.filter(Boolean).join(delimiter) || undefined;
+  }
+  return scope || undefined;
+};
+
+const substituteSubdomain = (url, subdomain) =>
+  subdomain ? url.replace('[subdomain]', subdomain) : url;
+
+const buildAuthorizeUrl = (provider, { key, redirectUri, scope, subdomain }) => {
+  const authorizeUrl = substituteSubdomain(provider.authorize_url, subdomain);
+  const params = new URLSearchParams({
+    client_id: key,
+    response_type: 'code',
+    redirect_uri: redirectUri,
+  });
+
+  const formattedScope = formatScope(scope, provider.scope_delimiter);
+  if (formattedScope) {
+    params.set('scope', formattedScope);
+  }
+
+  if (provider.name === 'instagram' && /^\d+$/.test(key)) {
+    params.delete('client_id');
+    params.set('app_id', key);
+    if (formattedScope) {
+      params.set('scope', formattedScope.replaceAll(' ', ','));
+    }
+  }
+
+  return `${authorizeUrl}?${params.toString()}`;
+};
+
+const parseTokenResponse = async (response) => {
+  const contentType = response.headers.get('content-type') || '';
+  if (contentType.includes('application/json')) {
+    return response.json();
+  }
+  const text = await response.text();
+  return Object.fromEntries(new URLSearchParams(text));
+};
+
+const exchangeAuthorizationCode = async (
+  provider,
+  { key, secret, redirectUri, code, subdomain }
+) => {
+  const accessUrl = substituteSubdomain(provider.access_url, subdomain);
+  const body = new URLSearchParams({
+    grant_type: 'authorization_code',
+    code,
+    redirect_uri: redirectUri,
+    client_id: key,
+    client_secret: secret,
+  });
+
+  const headers = { 'Content-Type': 'application/x-www-form-urlencoded' };
+
+  if (provider.token_endpoint_auth_method === 'client_secret_basic') {
+    const credentials = Buffer.from(`${key}:${secret}`).toString('base64');
+    headers.Authorization = `Basic ${credentials}`;
+    body.delete('client_id');
+    body.delete('client_secret');
+  }
+
+  if (provider.name === 'instagram' && /^\d+$/.test(key)) {
+    body.delete('client_id');
+    body.delete('client_secret');
+    body.set('app_id', key);
+    body.set('app_secret', secret);
+  }
+
+  const response = await fetch(accessUrl, { method: 'POST', headers, body });
+  const output = await parseTokenResponse(response);
+
+  if (!response.ok) {
+    throw new Error(
+      output.error_description || output.error || `Token exchange failed (${response.status})`
+    );
+  }
+
+  return output;
+};
+
+const tokensToQueryPayload = (provider, tokenResponse) => {
+  const data = { raw: tokenResponse };
+
+  if (provider.oauth === 1) {
+    if (tokenResponse.oauth_token) {
+      data.access_token = tokenResponse.oauth_token;
+    }
+    if (tokenResponse.oauth_token_secret) {
+      data.access_secret = tokenResponse.oauth_token_secret;
+    }
+    return data;
+  }
+
+  if (tokenResponse.id_token) {
+    data.id_token = tokenResponse.id_token;
+  }
+  if (tokenResponse.access_token) {
+    data.access_token = tokenResponse.access_token;
+  }
+  if (tokenResponse.refresh_token) {
+    data.refresh_token = tokenResponse.refresh_token;
+  }
+
+  return data;
+};
+
+const generateState = () => crypto.randomBytes(20).toString('hex');
+
+module.exports = {
+  buildAuthorizeUrl,
+  exchangeAuthorizationCode,
+  tokensToQueryPayload,
+  generateState,
+  substituteSubdomain,
+};

package/server/src/utils/oauth-connect/providers.js

@@ -0,0 +1,100 @@
+'use strict';
+
+/**
+ * OAuth endpoint definitions for built-in users-permissions providers.
+ * Derived from grant's oauth.json (MIT) — inlined to drop the grant dependency.
+ */
+module.exports = {
+  discord: {
+    oauth: 2,
+    authorize_url: 'https://discord.com/api/oauth2/authorize',
+    access_url: 'https://discord.com/api/oauth2/token',
+    scope_delimiter: ' ',
+  },
+  facebook: {
+    oauth: 2,
+    authorize_url: 'https://www.facebook.com/dialog/oauth',
+    access_url: 'https://graph.facebook.com/oauth/access_token',
+  },
+  google: {
+    oauth: 2,
+    authorize_url: 'https://accounts.google.com/o/oauth2/v2/auth',
+    access_url: 'https://oauth2.googleapis.com/token',
+    scope_delimiter: ' ',
+  },
+  github: {
+    oauth: 2,
+    authorize_url: 'https://github.com/login/oauth/authorize',
+    access_url: 'https://github.com/login/oauth/access_token',
+  },
+  microsoft: {
+    oauth: 2,
+    authorize_url: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',
+    access_url: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
+    scope_delimiter: ' ',
+  },
+  twitter: {
+    oauth: 1,
+    request_url: 'https://api.twitter.com/oauth/request_token',
+    authorize_url: 'https://api.twitter.com/oauth/authenticate',
+    access_url: 'https://api.twitter.com/oauth/access_token',
+  },
+  instagram: {
+    oauth: 2,
+    authorize_url: 'https://api.instagram.com/oauth/authorize',
+    access_url: 'https://api.instagram.com/oauth/access_token',
+    scope_delimiter: ' ',
+  },
+  vk: {
+    oauth: 2,
+    authorize_url: 'https://oauth.vk.com/authorize',
+    access_url: 'https://oauth.vk.com/access_token',
+  },
+  twitch: {
+    oauth: 2,
+    authorize_url: 'https://id.twitch.tv/oauth2/authorize',
+    access_url: 'https://id.twitch.tv/oauth2/token',
+    scope_delimiter: ' ',
+  },
+  linkedin: {
+    oauth: 2,
+    authorize_url: 'https://www.linkedin.com/oauth/v2/authorization',
+    access_url: 'https://www.linkedin.com/oauth/v2/accessToken',
+    scope_delimiter: ' ',
+  },
+  cognito: {
+    oauth: 2,
+    authorize_url: 'https://[subdomain]/oauth2/authorize',
+    access_url: 'https://[subdomain]/oauth2/token',
+    scope_delimiter: ' ',
+  },
+  reddit: {
+    oauth: 2,
+    authorize_url: 'https://ssl.reddit.com/api/v1/authorize',
+    access_url: 'https://ssl.reddit.com/api/v1/access_token',
+    token_endpoint_auth_method: 'client_secret_basic',
+  },
+  auth0: {
+    oauth: 2,
+    authorize_url: 'https://[subdomain].auth0.com/authorize',
+    access_url: 'https://[subdomain].auth0.com/oauth/token',
+    scope_delimiter: ' ',
+  },
+  cas: {
+    oauth: 2,
+    authorize_url: 'https://[subdomain]/oidc/authorize',
+    access_url: 'https://[subdomain]/oidc/token',
+  },
+  patreon: {
+    oauth: 2,
+    authorize_url: 'https://www.patreon.com/oauth2/authorize',
+    access_url: 'https://www.patreon.com/api/oauth2/token',
+    scope_delimiter: ' ',
+  },
+  keycloak: {
+    oauth: 2,
+    authorize_url: 'https://[subdomain]/protocol/openid-connect/auth',
+    access_url: 'https://[subdomain]/protocol/openid-connect/token',
+    scope_delimiter: ' ',
+  },
+};

package/server/src/utils/provider-http.js

@@ -0,0 +1,49 @@
+'use strict';
+
+const fetchJson = async (url, options = {}) => {
+  const response = await fetch(url, options);
+  const contentType = response.headers.get('content-type') || '';
+
+  let body;
+  if (contentType.includes('application/json')) {
+    body = await response.json();
+  } else {
+    const text = await response.text();
+    try {
+      body = JSON.parse(text);
+    } catch {
+      body = text;
+    }
+  }
+
+  if (!response.ok) {
+    const message =
+      typeof body === 'object' && body !== null
+        ? body.error_description || body.error || body.message
+        : body;
+    throw new Error(message || `HTTP ${response.status}`);
+  }
+
+  return { body };
+};
+
+const bearerGet = (url, accessToken, { headers = {}, qs = {} } = {}) => {
+  const target = new URL(url);
+  Object.entries(qs).forEach(([key, value]) => {
+    if (value !== undefined && value !== null) {
+      target.searchParams.set(key, String(value));
+    }
+  });
+
+  return fetchJson(target, {
+    headers: {
+      Authorization: `Bearer ${accessToken}`,
+      ...headers,
+    },
+  });
+};
+
+module.exports = {
+  fetchJson,
+  bearerGet,
+};

package/server/{utils → src/utils}/sanitize/sanitizers.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { curry } = require('lodash/fp');
+const { curry } = require('lodash');
 const { traverseEntity, async } = require('@strapi/utils');
 
 const { removeUserRelationFromRoleEntities } = require('./visitors');

package/server/src/utils/trim-grant-session-response.js

@@ -0,0 +1,70 @@
+'use strict';
+
+const compact = (value) => {
+  if (value === null || value === undefined) {
+    return undefined;
+  }
+
+  if (typeof value !== 'object' || Array.isArray(value)) {
+    return value;
+  }
+
+  return Object.fromEntries(
+    Object.entries(value)
+      .map(([key, entry]) => [key, compact(entry)])
+      .filter(([, entry]) => entry !== undefined)
+  );
+};
+
+/**
+ * Compact grant's OAuth token response before it is written to the signed
+ * koa-session cookie. The full token exchange payload (especially Cognito's
+ * dual JWTs plus a duplicated raw blob) can exceed the browser's ~4 KB
+ * per-cookie limit and silently break the auth callback.
+ *
+ * Keep only fields that auth.callback / providers-registry actually read.
+ */
+const trimGrantSessionResponse = (grantResponse, provider) => {
+  if (!grantResponse || typeof grantResponse !== 'object') {
+    return grantResponse;
+  }
+
+  switch (provider) {
+    case 'cognito':
+      return compact({
+        id_token: grantResponse.id_token,
+      });
+
+    case 'twitter':
+      return compact({
+        access_token: grantResponse.access_token,
+        access_secret: grantResponse.access_secret,
+        raw: grantResponse.raw?.screen_name
+          ? { screen_name: grantResponse.raw.screen_name }
+          : undefined,
+      });
+
+    case 'vk':
+      return compact({
+        access_token: grantResponse.access_token,
+        raw:
+          grantResponse.raw?.email != null && grantResponse.raw?.user_id != null
+            ? {
+                email: grantResponse.raw.email,
+                user_id: grantResponse.raw.user_id,
+              }
+            : undefined,
+      });
+
+    default:
+      return compact({
+        access_token: grantResponse.access_token,
+        oauth_token: grantResponse.oauth_token,
+        id_token: grantResponse.id_token,
+      });
+  }
+};
+
+module.exports = {
+  trimGrantSessionResponse,
+};

package/server/src/utils/verify-jwt-with-jwks.js

@@ -0,0 +1,43 @@
+'use strict';
+
+const crypto = require('node:crypto');
+const jwt = require('jsonwebtoken');
+
+const jwkToKeyObject = (jwk) => crypto.createPublicKey({ key: jwk, format: 'jwk' });
+
+const verifyJwtWithJwks = async ({ idToken, jwksUrl }) => {
+  const decoded = jwt.decode(idToken, { complete: true });
+
+  if (!decoded?.header?.kid || !decoded.payload) {
+    throw new Error('The provided token is not valid');
+  }
+
+  const response = await fetch(jwksUrl.toString());
+  if (!response.ok) {
+    throw new Error('There was an error verifying the token');
+  }
+
+  const jwk = await response.json();
+  const key = jwk.keys?.find(({ kid }) => kid === decoded.header.kid);
+
+  if (!key) {
+    throw new Error('There was an error verifying the token');
+  }
+
+  const publicKey = jwkToKeyObject(key);
+
+  return new Promise((resolve, reject) => {
+    jwt.verify(idToken, publicKey, { algorithms: ['RS256'] }, (err, tokenPayload) => {
+      if (err) {
+        reject(new Error('There was an error verifying the token'));
+        return;
+      }
+      resolve(tokenPayload);
+    });
+  });
+};
+
+module.exports = {
+  jwkToKeyObject,
+  verifyJwtWithJwks,
+};

package/types/strapi-server.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Declarations of the `strapi-server` entry of `@strapi/plugin-users-permissions`, a JavaScript
+ * package. They register its config contract for applications with `typescript.strictTypes`, until
+ * the plugin moves to TypeScript and emits its own declarations.
+ */
+
+/** The `jwtManagement` modes of the Content API authentication. */
+export type JwtManagement = 'legacy-support' | 'refresh';
+
+/**
+ * `strapi.config.get('plugin::users-permissions')`: the plugin config merged with its defaults
+ * (`server/src/config.js`).
+ */
+export type UsersPermissionsConfig = {
+  /** `JWT_SECRET`, unset when the environment does not define it. */
+  jwtSecret?: string;
+  /** Options of the plugin JWTs (`legacy-support` mode), e.g. `expiresIn`. */
+  jwt: { expiresIn?: string | number; [option: string]: unknown };
+  jwtManagement: JwtManagement;
+  /** Session manager lifespans, in seconds, and the refresh cookie (`refresh` mode). */
+  sessions: {
+    accessTokenLifespan: number;
+    maxRefreshTokenLifespan: number;
+    idleRefreshTokenLifespan: number;
+    maxSessionLifespan: number;
+    idleSessionLifespan: number;
+    httpOnly: boolean;
+    cookie?: {
+      name?: string;
+      secure?: boolean;
+      sameSite?: 'lax' | 'strict' | 'none' | boolean;
+      path?: string;
+      domain?: string;
+      maxAge?: number;
+    };
+  };
+  /** Options of the authentication routes' rate limit. */
+  ratelimit: { interval: number; max: number; [option: string]: unknown };
+  layout: { user: { actions: { create: string; update: string } } };
+  callback: {
+    /** Throws when a provider callback URL is not allowed. */
+    validate(callback: string, provider: { callback: string }): void;
+  };
+  /** Extra user fields the register route accepts. */
+  register?: { allowedFields?: string[] };
+  /** Password validation rules of the register and password routes. */
+  validationRules?: Record<string, unknown>;
+};
+
+declare global {
+  // eslint-disable-next-line @typescript-eslint/no-namespace
+  namespace Strapi {
+    // eslint-disable-next-line @typescript-eslint/no-namespace
+    namespace Registries {
+      interface PackageConfigs {
+        'plugin::users-permissions': UsersPermissionsConfig;
+      }
+    }
+  }
+}
+
+/** The plugin's server entry. Untyped, as the JavaScript entry was without these declarations. */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+declare const usersPermissions: any;
+export default usersPermissions;