@strapi/plugin-users-permissions 5.50.1 → 5.51.0

package/server/utils/oauth-connect/index.js

@@ -0,0 +1,256 @@
+'use strict';
+
+const { errors } = require('@strapi/utils');
+
+const builtinProviderEndpoints = require('./providers');
+const oauth1 = require('./oauth1');
+const oauth2 = require('./oauth2');
+
+const CONNECT_PREFIX = '/connect';
+
+const parseConnectPath = (requestPath, apiPrefix) => {
+  const prefix = `${apiPrefix}${CONNECT_PREFIX}/`;
+  if (!requestPath.startsWith(prefix)) {
+    return null;
+  }
+
+  const remainder = requestPath.slice(prefix.length);
+  const [provider, segment] = remainder.split('/').filter(Boolean);
+
+  if (!provider) {
+    return null;
+  }
+
+  return {
+    provider,
+    isCallback: segment === 'callback',
+  };
+};
+
+/**
+ * Resolve OAuth endpoint config from built-ins, falling back to store-defined
+ * endpoints so custom providers registered via providers-registry still work.
+ */
+const buildProviderConfig = (providerName, storedConfig, redirectUri) => {
+  const defaults = builtinProviderEndpoints[providerName];
+  const endpoints = defaults || {
+    oauth: storedConfig.oauth,
+    authorize_url: storedConfig.authorize_url,
+    access_url: storedConfig.access_url,
+    request_url: storedConfig.request_url,
+    scope_delimiter: storedConfig.scope_delimiter,
+    token_endpoint_auth_method: storedConfig.token_endpoint_auth_method,
+  };
+
+  if (endpoints.oauth === 1) {
+    if (!endpoints.request_url || !endpoints.authorize_url || !endpoints.access_url) {
+      return null;
+    }
+  } else if (!endpoints.authorize_url || !endpoints.access_url) {
+    return null;
+  }
+
+  return {
+    name: providerName,
+    ...endpoints,
+    key: storedConfig.key,
+    secret: storedConfig.secret,
+    scope: storedConfig.scope,
+    subdomain: storedConfig.subdomain,
+    callback: storedConfig.callback,
+    redirect_uri: redirectUri,
+  };
+};
+
+const redirectWithPayload = (ctx, callbackUrl, payload) => {
+  const url = new URL(callbackUrl);
+  const params = new URLSearchParams();
+
+  Object.entries(payload).forEach(([key, value]) => {
+    if (key === 'raw') {
+      Object.entries(value).forEach(([rawKey, rawValue]) => {
+        params.set(`raw[${rawKey}]`, String(rawValue));
+      });
+      return;
+    }
+    if (value !== undefined && value !== null) {
+      params.set(key, String(value));
+    }
+  });
+
+  url.search = params.toString();
+  ctx.redirect(url.toString());
+};
+
+const preserveGrantDynamic = (ctx) => {
+  const dynamic = ctx.session.grant?.dynamic;
+  return dynamic ? { dynamic } : {};
+};
+
+const startOAuth1Flow = async (ctx, provider, parsed, redirectUri) => {
+  const requestToken = await oauth1.requestToken({
+    requestUrl: provider.request_url,
+    redirectUri,
+    consumerKey: provider.key,
+    clientCredential: provider.secret,
+  });
+
+  ctx.session.grant = {
+    ...preserveGrantDynamic(ctx),
+    provider: parsed.provider,
+    request: requestToken,
+  };
+
+  const authorizeUrl = `${provider.authorize_url}?oauth_token=${encodeURIComponent(requestToken.oauth_token)}`;
+  return ctx.redirect(authorizeUrl);
+};
+
+const startOAuth2Flow = (ctx, provider, parsed, redirectUri) => {
+  const state = oauth2.generateState();
+  ctx.session.grant = {
+    ...preserveGrantDynamic(ctx),
+    provider: parsed.provider,
+    state,
+  };
+
+  let authorizeUrl = oauth2.buildAuthorizeUrl(provider, {
+    key: provider.key,
+    redirectUri,
+    scope: provider.scope,
+    subdomain: provider.subdomain,
+  });
+
+  authorizeUrl += `&state=${encodeURIComponent(state)}`;
+  return ctx.redirect(authorizeUrl);
+};
+
+const handleOAuth1Callback = async (ctx, provider, callbackUrl) => {
+  const session = ctx.session.grant || {};
+  const { oauth_token: oauthToken, oauth_verifier: oauthVerifier } = ctx.query;
+  const requestToken = session.request;
+
+  if (!requestToken?.oauth_token || oauthToken !== requestToken.oauth_token) {
+    throw new Error('OAuth1 token mismatch');
+  }
+
+  const tokenResponse = await oauth1.accessToken({
+    accessUrl: provider.access_url,
+    consumerKey: provider.key,
+    clientCredential: provider.secret,
+    oauthToken,
+    oauthVerifier,
+    oauthTokenCredential: requestToken.oauth_token_secret,
+  });
+
+  const payload = oauth2.tokensToQueryPayload(provider, tokenResponse);
+  ctx.session.grant = {};
+  return redirectWithPayload(ctx, callbackUrl, payload);
+};
+
+const handleOAuth2Callback = async (ctx, provider, callbackUrl, redirectUri) => {
+  const session = ctx.session.grant || {};
+  const { code, state: queryState, error, error_description: errorDescription } = ctx.query;
+
+  if (error) {
+    ctx.session.grant = {};
+    return redirectWithPayload(ctx, callbackUrl, {
+      error,
+      error_description: errorDescription,
+    });
+  }
+
+  if (!code) {
+    throw new Error('OAuth2 missing code parameter');
+  }
+
+  // Reject when session state is missing (not only on mismatch) to close login-CSRF.
+  if (!session.state || queryState !== session.state) {
+    throw new Error('OAuth2 state mismatch');
+  }
+
+  const tokenResponse = await oauth2.exchangeAuthorizationCode(provider, {
+    key: provider.key,
+    secret: provider.secret,
+    redirectUri,
+    code,
+    subdomain: provider.subdomain,
+  });
+
+  const payload = oauth2.tokensToQueryPayload(provider, tokenResponse);
+  ctx.session.grant = {};
+  return redirectWithPayload(ctx, callbackUrl, payload);
+};
+
+const createOAuthConnectMiddleware = () => {
+  return async (ctx, next) => {
+    const apiPrefix = strapi.config.get('api.rest.prefix');
+    const [requestPath] = ctx.request.url.split('?');
+    const parsed = parseConnectPath(requestPath, apiPrefix);
+
+    if (!parsed) {
+      return next();
+    }
+
+    if (!ctx.session) {
+      ctx.throw(400, 'OAuth connect requires session middleware');
+    }
+
+    const storedProviders = await strapi
+      .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })
+      .get();
+
+    const storedConfig = storedProviders?.[parsed.provider];
+    if (!storedConfig?.enabled) {
+      throw new errors.ApplicationError('This provider is disabled');
+    }
+
+    const { getService } = require('..');
+    const redirectUri = getService('providers').buildRedirectUri(parsed.provider);
+
+    const callbackOverride =
+      ctx.state.oauthConnect?.callback ?? ctx.session.grant?.dynamic?.callback;
+    const effectiveConfig = callbackOverride
+      ? { ...storedConfig, callback: callbackOverride }
+      : storedConfig;
+
+    const provider = buildProviderConfig(parsed.provider, effectiveConfig, redirectUri);
+
+    if (!provider) {
+      throw new errors.ApplicationError('Unknown OAuth provider');
+    }
+
+    ctx.session.grant = ctx.session.grant || {};
+
+    if (!parsed.isCallback) {
+      if (provider.oauth === 1) {
+        return startOAuth1Flow(ctx, provider, parsed, redirectUri);
+      }
+      return startOAuth2Flow(ctx, provider, parsed, redirectUri);
+    }
+
+    const callbackUrl = effectiveConfig.callback;
+    if (!callbackUrl) {
+      throw new errors.ApplicationError('Provider callback URL is not configured');
+    }
+
+    try {
+      if (provider.oauth === 1) {
+        return await handleOAuth1Callback(ctx, provider, callbackUrl);
+      }
+      return await handleOAuth2Callback(ctx, provider, callbackUrl, redirectUri);
+    } catch (err) {
+      ctx.session.grant = {};
+      return redirectWithPayload(ctx, callbackUrl, {
+        error: 'oauth_error',
+        error_description: err.message,
+      });
+    }
+  };
+};
+
+module.exports = {
+  createOAuthConnectMiddleware,
+  parseConnectPath,
+  buildProviderConfig,
+  redirectWithPayload,
+};

package/server/utils/oauth-connect/oauth1.js

@@ -0,0 +1,169 @@
+'use strict';
+
+const crypto = require('node:crypto');
+const { URLSearchParams } = require('node:url');
+
+const encode = (str) =>
+  encodeURIComponent(str).replace(
+    /[!'()*]/g,
+    (c) => `%${c.codePointAt(0).toString(16).toUpperCase()}`
+  );
+
+const sortKeys = (keys) =>
+  keys.sort((a, b) => {
+    if (a < b) return -1;
+    if (a > b) return 1;
+    return 0;
+  });
+
+/**
+ * OAuth 1.0 (RFC 5849) request signature — HMAC-SHA1 is required by the protocol.
+ * This is not password storage or user-credential hashing (those use bcrypt).
+ */
+const signRfc5849BaseString = (signatureBaseString, signingMaterial) => {
+  // codeql[js/insufficient-password-hash] OAuth 1.0 signing material, not user password storage
+  return crypto.createHmac('sha1', signingMaterial).update(signatureBaseString).digest('base64');
+};
+
+const buildOAuth1Header = ({
+  method,
+  url,
+  params,
+  consumerKey,
+  clientCredential,
+  token,
+  tokenCredential,
+}) => {
+  const requestParameters = {
+    oauth_consumer_key: consumerKey,
+    oauth_nonce: crypto.randomBytes(16).toString('hex'),
+    oauth_signature_method: 'HMAC-SHA1',
+    oauth_timestamp: Math.floor(Date.now() / 1000).toString(),
+    oauth_version: '1.0',
+    ...(token ? { oauth_token: token } : {}),
+    ...params,
+  };
+
+  const paramString = sortKeys(Object.keys(requestParameters))
+    .map((key) => `${encode(key)}=${encode(requestParameters[key])}`)
+    .join('&');
+
+  const signatureBaseString = [method.toUpperCase(), encode(url), encode(paramString)].join('&');
+  const signingMaterial = `${encode(clientCredential)}&${encode(tokenCredential || '')}`;
+  const signature = signRfc5849BaseString(signatureBaseString, signingMaterial);
+
+  const headerParameters = { ...requestParameters, oauth_signature: signature };
+  const header = `OAuth ${sortKeys(Object.keys(headerParameters))
+    .map((key) => `${encode(key)}="${encode(headerParameters[key])}"`)
+    .join(', ')}`;
+
+  return header;
+};
+
+const oauth1Request = async ({
+  method,
+  url,
+  consumerKey,
+  clientCredential,
+  token,
+  tokenCredential,
+  params = {},
+}) => {
+  const authorization = buildOAuth1Header({
+    method,
+    url,
+    params,
+    consumerKey,
+    clientCredential,
+    token,
+    tokenCredential,
+  });
+
+  const response = await fetch(url, {
+    method,
+    headers: { Authorization: authorization },
+  });
+
+  const text = await response.text();
+  if (!response.ok) {
+    throw new Error(text || `OAuth1 request failed (${response.status})`);
+  }
+
+  return Object.fromEntries(new URLSearchParams(text));
+};
+
+const requestToken = async ({ requestUrl, redirectUri, consumerKey, clientCredential }) =>
+  oauth1Request({
+    method: 'POST',
+    url: requestUrl,
+    consumerKey,
+    clientCredential,
+    params: { oauth_callback: redirectUri },
+  });
+
+const accessToken = async ({
+  accessUrl,
+  consumerKey,
+  clientCredential,
+  oauthToken,
+  oauthVerifier,
+  oauthTokenCredential,
+}) =>
+  oauth1Request({
+    method: 'POST',
+    url: accessUrl,
+    consumerKey,
+    clientCredential,
+    token: oauthToken,
+    tokenCredential: oauthTokenCredential,
+    params: { oauth_verifier: oauthVerifier },
+  });
+
+const twitterGet = async ({
+  url,
+  accessToken,
+  accessCredential,
+  consumerKey,
+  clientCredential,
+  qs = {},
+}) => {
+  const target = new URL(url);
+  const signedParams = {};
+
+  Object.entries(qs).forEach(([key, value]) => {
+    if (value !== undefined && value !== null) {
+      const stringValue = String(value);
+      target.searchParams.set(key, stringValue);
+      // RFC 5849 §3.4.1: base-string URI excludes the query; params are signed separately.
+      signedParams[key] = stringValue;
+    }
+  });
+
+  const authorization = buildOAuth1Header({
+    method: 'GET',
+    url: target.origin + target.pathname,
+    params: signedParams,
+    consumerKey,
+    clientCredential,
+    token: accessToken,
+    tokenCredential: accessCredential,
+  });
+
+  const response = await fetch(target, {
+    headers: { Authorization: authorization },
+  });
+
+  const body = await response.json();
+  if (!response.ok) {
+    throw new Error(body.errors?.[0]?.message || `Twitter API error (${response.status})`);
+  }
+
+  return { body };
+};
+
+module.exports = {
+  buildOAuth1Header,
+  requestToken,
+  accessToken,
+  twitterGet,
+};

package/server/utils/oauth-connect/oauth2.js

@@ -0,0 +1,123 @@
+'use strict';
+
+const crypto = require('node:crypto');
+
+const formatScope = (scope, delimiter = ',') => {
+  if (Array.isArray(scope)) {
+    return scope.filter(Boolean).join(delimiter) || undefined;
+  }
+  return scope || undefined;
+};
+
+const substituteSubdomain = (url, subdomain) =>
+  subdomain ? url.replace('[subdomain]', subdomain) : url;
+
+const buildAuthorizeUrl = (provider, { key, redirectUri, scope, subdomain }) => {
+  const authorizeUrl = substituteSubdomain(provider.authorize_url, subdomain);
+  const params = new URLSearchParams({
+    client_id: key,
+    response_type: 'code',
+    redirect_uri: redirectUri,
+  });
+
+  const formattedScope = formatScope(scope, provider.scope_delimiter);
+  if (formattedScope) {
+    params.set('scope', formattedScope);
+  }
+
+  if (provider.name === 'instagram' && /^\d+$/.test(key)) {
+    params.delete('client_id');
+    params.set('app_id', key);
+    if (formattedScope) {
+      params.set('scope', formattedScope.replaceAll(' ', ','));
+    }
+  }
+
+  return `${authorizeUrl}?${params.toString()}`;
+};
+
+const parseTokenResponse = async (response) => {
+  const contentType = response.headers.get('content-type') || '';
+  if (contentType.includes('application/json')) {
+    return response.json();
+  }
+  const text = await response.text();
+  return Object.fromEntries(new URLSearchParams(text));
+};
+
+const exchangeAuthorizationCode = async (
+  provider,
+  { key, secret, redirectUri, code, subdomain }
+) => {
+  const accessUrl = substituteSubdomain(provider.access_url, subdomain);
+  const body = new URLSearchParams({
+    grant_type: 'authorization_code',
+    code,
+    redirect_uri: redirectUri,
+    client_id: key,
+    client_secret: secret,
+  });
+
+  const headers = { 'Content-Type': 'application/x-www-form-urlencoded' };
+
+  if (provider.token_endpoint_auth_method === 'client_secret_basic') {
+    const credentials = Buffer.from(`${key}:${secret}`).toString('base64');
+    headers.Authorization = `Basic ${credentials}`;
+    body.delete('client_id');
+    body.delete('client_secret');
+  }
+
+  if (provider.name === 'instagram' && /^\d+$/.test(key)) {
+    body.delete('client_id');
+    body.delete('client_secret');
+    body.set('app_id', key);
+    body.set('app_secret', secret);
+  }
+
+  const response = await fetch(accessUrl, { method: 'POST', headers, body });
+  const output = await parseTokenResponse(response);
+
+  if (!response.ok) {
+    throw new Error(
+      output.error_description || output.error || `Token exchange failed (${response.status})`
+    );
+  }
+
+  return output;
+};
+
+const tokensToQueryPayload = (provider, tokenResponse) => {
+  const data = { raw: tokenResponse };
+
+  if (provider.oauth === 1) {
+    if (tokenResponse.oauth_token) {
+      data.access_token = tokenResponse.oauth_token;
+    }
+    if (tokenResponse.oauth_token_secret) {
+      data.access_secret = tokenResponse.oauth_token_secret;
+    }
+    return data;
+  }
+
+  if (tokenResponse.id_token) {
+    data.id_token = tokenResponse.id_token;
+  }
+  if (tokenResponse.access_token) {
+    data.access_token = tokenResponse.access_token;
+  }
+  if (tokenResponse.refresh_token) {
+    data.refresh_token = tokenResponse.refresh_token;
+  }
+
+  return data;
+};
+
+const generateState = () => crypto.randomBytes(20).toString('hex');
+
+module.exports = {
+  buildAuthorizeUrl,
+  exchangeAuthorizationCode,
+  tokensToQueryPayload,
+  generateState,
+  substituteSubdomain,
+};

package/server/utils/oauth-connect/providers.js

@@ -0,0 +1,100 @@
+'use strict';
+
+/**
+ * OAuth endpoint definitions for built-in users-permissions providers.
+ * Derived from grant's oauth.json (MIT) — inlined to drop the grant dependency.
+ */
+module.exports = {
+  discord: {
+    oauth: 2,
+    authorize_url: 'https://discord.com/api/oauth2/authorize',
+    access_url: 'https://discord.com/api/oauth2/token',
+    scope_delimiter: ' ',
+  },
+  facebook: {
+    oauth: 2,
+    authorize_url: 'https://www.facebook.com/dialog/oauth',
+    access_url: 'https://graph.facebook.com/oauth/access_token',
+  },
+  google: {
+    oauth: 2,
+    authorize_url: 'https://accounts.google.com/o/oauth2/v2/auth',
+    access_url: 'https://oauth2.googleapis.com/token',
+    scope_delimiter: ' ',
+  },
+  github: {
+    oauth: 2,
+    authorize_url: 'https://github.com/login/oauth/authorize',
+    access_url: 'https://github.com/login/oauth/access_token',
+  },
+  microsoft: {
+    oauth: 2,
+    authorize_url: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',
+    access_url: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
+    scope_delimiter: ' ',
+  },
+  twitter: {
+    oauth: 1,
+    request_url: 'https://api.twitter.com/oauth/request_token',
+    authorize_url: 'https://api.twitter.com/oauth/authenticate',
+    access_url: 'https://api.twitter.com/oauth/access_token',
+  },
+  instagram: {
+    oauth: 2,
+    authorize_url: 'https://api.instagram.com/oauth/authorize',
+    access_url: 'https://api.instagram.com/oauth/access_token',
+    scope_delimiter: ' ',
+  },
+  vk: {
+    oauth: 2,
+    authorize_url: 'https://oauth.vk.com/authorize',
+    access_url: 'https://oauth.vk.com/access_token',
+  },
+  twitch: {
+    oauth: 2,
+    authorize_url: 'https://id.twitch.tv/oauth2/authorize',
+    access_url: 'https://id.twitch.tv/oauth2/token',
+    scope_delimiter: ' ',
+  },
+  linkedin: {
+    oauth: 2,
+    authorize_url: 'https://www.linkedin.com/oauth/v2/authorization',
+    access_url: 'https://www.linkedin.com/oauth/v2/accessToken',
+    scope_delimiter: ' ',
+  },
+  cognito: {
+    oauth: 2,
+    authorize_url: 'https://[subdomain]/oauth2/authorize',
+    access_url: 'https://[subdomain]/oauth2/token',
+    scope_delimiter: ' ',
+  },
+  reddit: {
+    oauth: 2,
+    authorize_url: 'https://ssl.reddit.com/api/v1/authorize',
+    access_url: 'https://ssl.reddit.com/api/v1/access_token',
+    token_endpoint_auth_method: 'client_secret_basic',
+  },
+  auth0: {
+    oauth: 2,
+    authorize_url: 'https://[subdomain].auth0.com/authorize',
+    access_url: 'https://[subdomain].auth0.com/oauth/token',
+    scope_delimiter: ' ',
+  },
+  cas: {
+    oauth: 2,
+    authorize_url: 'https://[subdomain]/oidc/authorize',
+    access_url: 'https://[subdomain]/oidc/token',
+  },
+  patreon: {
+    oauth: 2,
+    authorize_url: 'https://www.patreon.com/oauth2/authorize',
+    access_url: 'https://www.patreon.com/api/oauth2/token',
+    scope_delimiter: ' ',
+  },
+  keycloak: {
+    oauth: 2,
+    authorize_url: 'https://[subdomain]/protocol/openid-connect/auth',
+    access_url: 'https://[subdomain]/protocol/openid-connect/token',
+    scope_delimiter: ' ',
+  },
+};

package/server/utils/provider-http.js

@@ -0,0 +1,49 @@
+'use strict';
+
+const fetchJson = async (url, options = {}) => {
+  const response = await fetch(url, options);
+  const contentType = response.headers.get('content-type') || '';
+
+  let body;
+  if (contentType.includes('application/json')) {
+    body = await response.json();
+  } else {
+    const text = await response.text();
+    try {
+      body = JSON.parse(text);
+    } catch {
+      body = text;
+    }
+  }
+
+  if (!response.ok) {
+    const message =
+      typeof body === 'object' && body !== null
+        ? body.error_description || body.error || body.message
+        : body;
+    throw new Error(message || `HTTP ${response.status}`);
+  }
+
+  return { body };
+};
+
+const bearerGet = (url, accessToken, { headers = {}, qs = {} } = {}) => {
+  const target = new URL(url);
+  Object.entries(qs).forEach(([key, value]) => {
+    if (value !== undefined && value !== null) {
+      target.searchParams.set(key, String(value));
+    }
+  });
+
+  return fetchJson(target, {
+    headers: {
+      Authorization: `Bearer ${accessToken}`,
+      ...headers,
+    },
+  });
+};
+
+module.exports = {
+  fetchJson,
+  bearerGet,
+};