@strapi/plugin-users-permissions 0.0.0-next.fb3a0b82484ce466b1efb1b28f16fc8ef73aba4a → 0.0.0-next.fd9757603c653ca239c45d6e28ab536d2dae0b39

package/server/controllers/auth.js

@@ -201,10 +201,28 @@ module.exports = {
     }
 
     // Ability to pass OAuth callback dynamically
-    grantConfig[provider].callback =
-      _.get(ctx, 'query.callback') ||
-      _.get(ctx, 'session.grant.dynamic.callback') ||
-      grantConfig[provider].callback;
+    const queryCustomCallback = _.get(ctx, 'query.callback');
+    const dynamicSessionCallback = _.get(ctx, 'session.grant.dynamic.callback');
+
+    const customCallback = queryCustomCallback ?? dynamicSessionCallback;
+
+    // The custom callback is validated to make sure it's not redirecting to an unwanted actor.
+    if (customCallback !== undefined) {
+      try {
+        // We're extracting the callback validator from the plugin config since it can be user-customized
+        const { validate: validateCallback } = strapi
+          .plugin('users-permissions')
+          .config('callback');
+
+        await validateCallback(customCallback, grantConfig[provider]);
+
+        grantConfig[provider].callback = customCallback;
+      } catch (e) {
+        throw new ValidationError('Invalid callback URL provided', { callback: customCallback });
+      }
+    }
+
+    // Build a valid redirect URI for the current provider
     grantConfig[provider].redirect_uri = getService('providers').buildRedirectUri(provider);
 
     return grant(grantConfig)(ctx, next);

package/server/services/providers-registry.js

@@ -54,8 +54,11 @@ const getInitialProviders = ({ purest }) => ({
       .auth(accessToken)
       .request()
       .then(({ body }) => {
-        // Combine username and discriminator because discord username is not unique
-        const username = `${body.username}#${body.discriminator}`;
+        // Combine username and discriminator (if discriminator exists and not equal to 0)
+        const username =
+          body.discriminator && body.discriminator !== '0'
+            ? `${body.username}#${body.discriminator}`
+            : body.username;
         return {
           username,
           email: body.email,
@@ -311,6 +314,7 @@ const getInitialProviders = ({ purest }) => ({
             origin: 'https://www.patreon.com',
             path: 'api/oauth2/{path}',
             headers: {
+              'user-agent': 'strapi',
               authorization: 'Bearer {auth}',
             },
           },
@@ -331,6 +335,21 @@ const getInitialProviders = ({ purest }) => ({
         };
       });
   },
+  async keycloak({ accessToken, providers }) {
+    const keycloak = purest({ provider: 'keycloak' });
+
+    return keycloak
+      .subdomain(providers.keycloak.subdomain)
+      .get('protocol/openid-connect/userinfo')
+      .auth(accessToken)
+      .request()
+      .then(({ body }) => {
+        return {
+          username: body.preferred_username,
+          email: body.email,
+        };
+      });
+  },
 });
 
 module.exports = () => {

package/.eslintrc.js

@@ -1,14 +0,0 @@
-module.exports = {
-  root: true,
-  overrides: [
-    {
-      files: ['admin/**/*'],
-      extends: ['custom/front'],
-    },
-    {
-      files: ['**/*'],
-      excludedFiles: ['admin/**/*'],
-      extends: ['custom/back'],
-    },
-  ],
-};

package/strapi-admin.js

@@ -1,3 +0,0 @@
-'use strict';
-
-module.exports = require('./admin/src').default;