@strapi/plugin-users-permissions 5.52.2 → 5.53.0

package/dist/server/utils/trim-grant-session-response.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"trim-grant-session-response.mjs","sources":["../../../server/src/utils/trim-grant-session-response.js"],"sourcesContent":["'use strict';\n\nconst compact = (value) => {\n  if (value === null || value === undefined) {\n    return undefined;\n  }\n\n  if (typeof value !== 'object' || Array.isArray(value)) {\n    return value;\n  }\n\n  return Object.fromEntries(\n    Object.entries(value)\n      .map(([key, entry]) => [key, compact(entry)])\n      .filter(([, entry]) => entry !== undefined)\n  );\n};\n\n/**\n * Compact grant's OAuth token response before it is written to the signed\n * koa-session cookie. The full token exchange payload (especially Cognito's\n * dual JWTs plus a duplicated raw blob) can exceed the browser's ~4 KB\n * per-cookie limit and silently break the auth callback.\n *\n * Keep only fields that auth.callback / providers-registry actually read.\n */\nconst trimGrantSessionResponse = (grantResponse, provider) => {\n  if (!grantResponse || typeof grantResponse !== 'object') {\n    return grantResponse;\n  }\n\n  switch (provider) {\n    case 'cognito':\n      return compact({\n        id_token: grantResponse.id_token,\n      });\n\n    case 'twitter':\n      return compact({\n        access_token: grantResponse.access_token,\n        access_secret: grantResponse.access_secret,\n        raw: grantResponse.raw?.screen_name\n          ? { screen_name: grantResponse.raw.screen_name }\n          : undefined,\n      });\n\n    case 'vk':\n      return compact({\n        access_token: grantResponse.access_token,\n        raw:\n          grantResponse.raw?.email != null && grantResponse.raw?.user_id != null\n            ? {\n                email: grantResponse.raw.email,\n                user_id: grantResponse.raw.user_id,\n              }\n            : undefined,\n      });\n\n    default:\n      return compact({\n        access_token: grantResponse.access_token,\n        oauth_token: grantResponse.oauth_token,\n        id_token: grantResponse.id_token,\n      });\n  }\n};\n\nmodule.exports = {\n  trimGrantSessionResponse,\n};\n"],"names":["compact","value","undefined","Array","isArray","Object","fromEntries","entries","map","key","entry","filter","trimGrantSessionResponse","grantResponse","provider","id_token","access_token","access_secret","raw","screen_name","email","user_id","oauth_token","trimGrantSessionResponse_1"],"mappings":";;;;;AAEA,IAAA,MAAMA,UAAU,CAACC,KAAAA,GAAAA;QACf,IAAIA,KAAAA,KAAU,IAAA,IAAQA,KAAAA,KAAUC,SAAAA,EAAW;YACzC,OAAOA,SAAAA;AACX,QAAA;AAEE,QAAA,IAAI,OAAOD,KAAAA,KAAU,QAAA,IAAYE,KAAAA,CAAMC,OAAO,CAACH,KAAAA,CAAAA,EAAQ;YACrD,OAAOA,KAAAA;AACX,QAAA;AAEE,QAAA,OAAOI,MAAAA,CAAOC,WAAW,CACvBD,MAAAA,CAAOE,OAAO,CAACN,KAAAA,CAAAA,CACZO,GAAG,CAAC,CAAC,CAACC,GAAAA,EAAKC,MAAM,GAAK;AAACD,gBAAAA,GAAAA;gBAAKT,OAAAA,CAAQU,KAAAA;AAAO,aAAA,CAAA,CAC3CC,MAAM,CAAC,CAAC,GAAGD,KAAAA,CAAM,GAAKA,KAAAA,KAAUR,SAAAA,CAAAA,CAAAA;AAEvC,IAAA,CAAA;AAEA;;;;;;;KAQA,MAAMU,wBAAAA,GAA2B,CAACC,aAAAA,EAAeC,QAAAA,GAAAA;AAC/C,QAAA,IAAI,CAACD,aAAAA,IAAiB,OAAOA,aAAAA,KAAkB,QAAA,EAAU;YACvD,OAAOA,aAAAA;AACX,QAAA;QAEE,OAAQC,QAAAA;YACN,KAAK,SAAA;AACH,gBAAA,OAAOd,OAAAA,CAAQ;AACbe,oBAAAA,QAAAA,EAAUF,cAAcE;AAChC,iBAAA,CAAA;YAEI,KAAK,SAAA;AACH,gBAAA,OAAOf,OAAAA,CAAQ;AACbgB,oBAAAA,YAAAA,EAAcH,cAAcG,YAAY;AACxCC,oBAAAA,aAAAA,EAAeJ,cAAcI,aAAa;oBAC1CC,GAAAA,EAAKL,aAAAA,CAAcK,GAAG,EAAEC,WAAAA,GACpB;wBAAEA,WAAAA,EAAaN,aAAAA,CAAcK,GAAG,CAACC;qBAAW,GAC5CjB;AACZ,iBAAA,CAAA;YAEI,KAAK,IAAA;AACH,gBAAA,OAAOF,OAAAA,CAAQ;AACbgB,oBAAAA,YAAAA,EAAcH,cAAcG,YAAY;oBACxCE,GAAAA,EACEL,aAAAA,CAAcK,GAAG,EAAEE,KAAAA,IAAS,QAAQP,aAAAA,CAAcK,GAAG,EAAEG,OAAAA,IAAW,IAAA,GAC9D;wBACED,KAAAA,EAAOP,aAAAA,CAAcK,GAAG,CAACE,KAAK;wBAC9BC,OAAAA,EAASR,aAAAA,CAAcK,GAAG,CAACG;qBAC3C,GACcnB;AACd,iBAAA,CAAA;AAEI,YAAA;AACE,gBAAA,OAAOF,OAAAA,CAAQ;AACbgB,oBAAAA,YAAAA,EAAcH,cAAcG,YAAY;AACxCM,oBAAAA,WAAAA,EAAaT,cAAcS,WAAW;AACtCP,oBAAAA,QAAAA,EAAUF,cAAcE;AAChC,iBAAA,CAAA;AACA;AACA,IAAA,CAAA;IAEAQ,0BAAAA,GAAiB;AACfX,QAAAA;AACF,KAAA;;;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@strapi/plugin-users-permissions",
-  "version": "5.52.2",
+  "version": "5.53.0",
   "description": "Protect your API with a full-authentication process based on JWT",
   "homepage": "https://strapi.io",
   "bugs": {
@@ -55,7 +55,7 @@
   "dependencies": {
     "@strapi/design-system": "2.2.4",
     "@strapi/icons": "2.2.4",
-    "@strapi/utils": "5.52.2",
+    "@strapi/utils": "5.53.0",
     "bcryptjs": "2.4.3",
     "formik": "2.4.9",
     "immer": "9.0.21",
@@ -72,8 +72,8 @@
     "zod": "4.4.3"
   },
   "devDependencies": {
-    "@strapi/admin": "5.52.2",
-    "@strapi/strapi": "5.52.2",
+    "@strapi/admin": "5.53.0",
+    "@strapi/strapi": "5.53.0",
     "@testing-library/dom": "10.4.1",
     "@testing-library/jest-dom": "6.9.1",
     "@testing-library/react": "16.3.2",

package/server/src/controllers/auth.js

@@ -205,7 +205,15 @@ module.exports = ({ strapi }) => ({
 
     // Connect the user with the third-party provider.
     try {
-      const user = await getService('providers').connect(provider, ctx.query);
+      const grantResponse = _.get(ctx, 'session.grant.response');
+
+      if (!grantResponse) {
+        throw new ApplicationError('OAuth authentication requires a completed provider session');
+      }
+
+      const user = await getService('providers').connect(provider, grantResponse, {
+        grantResponse,
+      });
 
       if (user.blocked) {
         throw new ForbiddenError('Your account has been blocked by an administrator');
@@ -373,7 +381,10 @@ module.exports = ({ strapi }) => ({
       const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
       const isProduction = process.env.NODE_ENV === 'production';
 
-      const { maxAge, ...cookieOptions } = buildRefreshCookieOptions(upSessions, isProduction);
+      const { maxAge: _maxAge, ...cookieOptions } = buildRefreshCookieOptions(
+        upSessions,
+        isProduction
+      );
 
       ctx.cookies.set(cookieName, '', { ...cookieOptions, expires: new Date(0) });
     }

package/server/src/graphql/mutations/auth/change-password.js

@@ -3,9 +3,11 @@
 const { toPlainObject } = require('lodash/fp');
 
 const { checkBadRequest } = require('../../utils');
+const { createRateLimitRunner } = require('./rate-limit');
 
 module.exports = ({ nexus, strapi }) => {
   const { nonNull } = nexus;
+  const runRateLimit = createRateLimitRunner(strapi, '/auth/change-password');
 
   return {
     type: 'UsersPermissionsLoginPayload',
@@ -21,11 +23,9 @@ module.exports = ({ nexus, strapi }) => {
     async resolve(parent, args, context) {
       const { koaContext } = context;
 
-      koaContext.request.body = toPlainObject(args);
-
-      await strapi.plugin('users-permissions').controller('auth').changePassword(koaContext);
-
-      const output = koaContext.body;
+      const output = await runRateLimit(koaContext, { body: toPlainObject(args) }, (ctx) =>
+        strapi.plugin('users-permissions').controller('auth').changePassword(ctx)
+      );
 
       checkBadRequest(output);
 

package/server/src/graphql/mutations/auth/forgot-password.js

@@ -3,9 +3,11 @@
 const { toPlainObject } = require('lodash/fp');
 
 const { checkBadRequest } = require('../../utils');
+const { createRateLimitRunner } = require('./rate-limit');
 
 module.exports = ({ nexus, strapi }) => {
   const { nonNull } = nexus;
+  const runRateLimit = createRateLimitRunner(strapi, '/auth/forgot-password');
 
   return {
     type: 'UsersPermissionsPasswordPayload',
@@ -19,11 +21,9 @@ module.exports = ({ nexus, strapi }) => {
     async resolve(parent, args, context) {
       const { koaContext } = context;
 
-      koaContext.request.body = toPlainObject(args);
-
-      await strapi.plugin('users-permissions').controller('auth').forgotPassword(koaContext);
-
-      const output = koaContext.body;
+      const output = await runRateLimit(koaContext, { body: toPlainObject(args) }, (ctx) =>
+        strapi.plugin('users-permissions').controller('auth').forgotPassword(ctx)
+      );
 
       checkBadRequest(output);
 

package/server/src/graphql/mutations/auth/login.js

@@ -3,9 +3,11 @@
 const { toPlainObject } = require('lodash/fp');
 
 const { checkBadRequest } = require('../../utils');
+const { createRateLimitRunner } = require('./rate-limit');
 
 module.exports = ({ nexus, strapi }) => {
   const { nonNull } = nexus;
+  const runRateLimit = createRateLimitRunner(strapi, '/auth/local');
 
   return {
     type: nonNull('UsersPermissionsLoginPayload'),
@@ -17,12 +19,14 @@ module.exports = ({ nexus, strapi }) => {
     async resolve(parent, args, context) {
       const { koaContext } = context;
 
-      koaContext.params = { provider: args.input.provider };
-      koaContext.request.body = toPlainObject(args.input);
-
-      await strapi.plugin('users-permissions').controller('auth').callback(koaContext);
-
-      const output = koaContext.body;
+      const output = await runRateLimit(
+        koaContext,
+        {
+          body: toPlainObject(args.input),
+          params: { provider: args.input.provider },
+        },
+        (ctx) => strapi.plugin('users-permissions').controller('auth').callback(ctx)
+      );
 
       checkBadRequest(output);
 

package/server/src/graphql/mutations/auth/rate-limit.js

@@ -0,0 +1,62 @@
+'use strict';
+
+const RATE_LIMIT_MIDDLEWARE = 'plugin::users-permissions.rateLimit';
+const contextQueues = new WeakMap();
+
+const getRateLimitPath = (strapi, routeSuffix) => {
+  const configuredPrefix = strapi.config.get('api.rest.prefix', '/api');
+  const prefix = typeof configuredPrefix === 'string' ? configuredPrefix : '/api';
+  const normalizedPrefix = prefix.replace(/^\/+|\/+$/g, '');
+  const normalizedSuffix = routeSuffix.replace(/^\/+/, '');
+
+  return `/${[normalizedPrefix, normalizedSuffix].filter(Boolean).join('/')}`;
+};
+
+const enqueueContextOperation = (koaContext, operation) => {
+  const previous = contextQueues.get(koaContext) || Promise.resolve();
+  const result = previous.catch(() => undefined).then(operation);
+
+  contextQueues.set(
+    koaContext,
+    result.catch(() => undefined)
+  );
+
+  return result;
+};
+
+const createRateLimitRunner = (strapi, routeSuffix) => {
+  const rateLimit = strapi.middleware(RATE_LIMIT_MIDDLEWARE)({}, { strapi });
+  const routePath = getRateLimitPath(strapi, routeSuffix);
+
+  return (koaContext, { body, params }, controller) =>
+    enqueueContextOperation(koaContext, async () => {
+      const originalBody = koaContext.request.body;
+      const originalPath = koaContext.request.path;
+      const originalParams = koaContext.params;
+      const originalResponseBody = koaContext.body;
+      let responseStatus = 200;
+
+      koaContext.request.path = routePath;
+      koaContext.request.body = body;
+      if (params) {
+        koaContext.params = params;
+      }
+
+      try {
+        await rateLimit(koaContext, () => controller(koaContext));
+        responseStatus = koaContext.status;
+        return koaContext.body;
+      } finally {
+        koaContext.request.path = originalPath;
+        koaContext.request.body = originalBody;
+        koaContext.params = originalParams;
+        koaContext.body = originalResponseBody;
+        koaContext.status = responseStatus;
+      }
+    });
+};
+
+module.exports = {
+  createRateLimitRunner,
+  getRateLimitPath,
+};

package/server/src/graphql/mutations/auth/register.js

@@ -3,9 +3,11 @@
 const { toPlainObject } = require('lodash/fp');
 
 const { checkBadRequest } = require('../../utils');
+const { createRateLimitRunner } = require('./rate-limit');
 
 module.exports = ({ nexus, strapi }) => {
   const { nonNull } = nexus;
+  const runRateLimit = createRateLimitRunner(strapi, '/auth/local/register');
 
   return {
     type: nonNull('UsersPermissionsLoginPayload'),
@@ -19,11 +21,9 @@ module.exports = ({ nexus, strapi }) => {
     async resolve(parent, args, context) {
       const { koaContext } = context;
 
-      koaContext.request.body = toPlainObject(args.input);
-
-      await strapi.plugin('users-permissions').controller('auth').register(koaContext);
-
-      const output = koaContext.body;
+      const output = await runRateLimit(koaContext, { body: toPlainObject(args.input) }, (ctx) =>
+        strapi.plugin('users-permissions').controller('auth').register(ctx)
+      );
 
       checkBadRequest(output);
 

package/server/src/graphql/mutations/auth/reset-password.js

@@ -3,9 +3,11 @@
 const { toPlainObject } = require('lodash/fp');
 
 const { checkBadRequest } = require('../../utils');
+const { createRateLimitRunner } = require('./rate-limit');
 
 module.exports = ({ nexus, strapi }) => {
   const { nonNull } = nexus;
+  const runRateLimit = createRateLimitRunner(strapi, '/auth/reset-password');
 
   return {
     type: 'UsersPermissionsLoginPayload',
@@ -21,11 +23,9 @@ module.exports = ({ nexus, strapi }) => {
     async resolve(parent, args, context) {
       const { koaContext } = context;
 
-      koaContext.request.body = toPlainObject(args);
-
-      await strapi.plugin('users-permissions').controller('auth').resetPassword(koaContext);
-
-      const output = koaContext.body;
+      const output = await runRateLimit(koaContext, { body: toPlainObject(args) }, (ctx) =>
+        strapi.plugin('users-permissions').controller('auth').resetPassword(ctx)
+      );
 
       checkBadRequest(output);
 

package/server/src/middlewares/rateLimit.js

@@ -46,7 +46,7 @@ const routeUsesEmailIdentifier = (requestPath) => {
  * `/api/auth/local/` share one bucket.
  */
 const normalizeRequestPathForRateLimit = (requestPath) => {
-  const normalized = path.normalize(requestPath);
+  const normalized = path.posix.normalize(requestPath);
   const lower = toLower(normalized);
   return lower.replace(/\/+$/, '') || '/';
 };

package/server/src/services/providers-registry.js

@@ -23,6 +23,9 @@ const initProviders = ({ baseURL }) => ({
     },
     async authCallback({ accessToken }) {
       const { body } = await bearerGet('https://discord.com/api/users/@me', accessToken);
+      if (body.verified !== true) {
+        throw new Error('Email not verified by Discord');
+      }
       const username =
         body.discriminator && body.discriminator !== '0'
           ? `${body.username}#${body.discriminator}`
@@ -46,6 +49,9 @@ const initProviders = ({ baseURL }) => ({
       const { body } = await bearerGet('https://graph.facebook.com/me', accessToken, {
         qs: { fields: 'name,email' },
       });
+      if (!body.email) {
+        throw new Error('Email not verified by Facebook');
+      }
       return {
         username: body.name,
         email: body.email,
@@ -65,6 +71,10 @@ const initProviders = ({ baseURL }) => ({
       const { body } = await fetchJson(
         `https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(accessToken)}`
       );
+      const verified = body.verified_email ?? body.email_verified;
+      if (verified !== true && verified !== 'true') {
+        throw new Error('Email not verified by Google');
+      }
       return {
         username: body.email.split('@')[0],
         email: body.email,
@@ -85,13 +95,6 @@ const initProviders = ({ baseURL }) => ({
         headers: { 'user-agent': 'strapi' },
       });
 
-      if (userBody.email) {
-        return {
-          username: userBody.login,
-          email: userBody.email,
-        };
-      }
-
       const { body: emailBody } = await bearerGet(
         'https://api.github.com/user/emails',
         accessToken,
@@ -100,11 +103,32 @@ const initProviders = ({ baseURL }) => ({
         }
       );
 
+      if (userBody.email) {
+        const verifiedPublicEmail = Array.isArray(emailBody)
+          ? emailBody.find((entry) => entry.email === userBody.email && entry.verified === true)
+          : null;
+
+        if (!verifiedPublicEmail) {
+          throw new Error('Email not verified by GitHub');
+        }
+
+        return {
+          username: userBody.login,
+          email: userBody.email,
+        };
+      }
+
+      const primaryEmail = Array.isArray(emailBody)
+        ? emailBody.find((email) => email.primary === true)
+        : null;
+
+      if (!primaryEmail || primaryEmail.verified !== true) {
+        throw new Error('Email not verified by GitHub');
+      }
+
       return {
         username: userBody.login,
-        email: Array.isArray(emailBody)
-          ? emailBody.find((email) => email.primary === true).email
-          : null,
+        email: primaryEmail.email,
       };
     },
   },
@@ -134,17 +158,28 @@ const initProviders = ({ baseURL }) => ({
       secret: '',
       callbackUrl: `${baseURL}/twitter/callback`,
     },
-    async authCallback({ accessToken, query, providers }) {
+    async authCallback({ accessToken, providers, grantResponse }) {
+      const accessSecret = grantResponse?.access_secret;
+      const screenName = grantResponse?.raw?.screen_name;
+
+      if (!accessSecret) {
+        throw new Error('Twitter authentication requires a completed OAuth session');
+      }
+
       const { twitterGet } = require('../utils/oauth-connect/oauth1');
       const { body } = await twitterGet({
         url: 'https://api.twitter.com/1.1/account/verify_credentials.json',
         accessToken,
-        accessCredential: query.access_secret,
+        accessCredential: accessSecret,
         consumerKey: providers.twitter.key,
         clientCredential: providers.twitter.secret,
-        qs: { include_email: 'true', screen_name: query['raw[screen_name]'] },
+        qs: { include_email: 'true', screen_name: screenName },
       });
 
+      if (!body.email) {
+        throw new Error('Email not verified by Twitter');
+      }
+
       return {
         username: body.screen_name,
         email: body.email,
@@ -179,13 +214,25 @@ const initProviders = ({ baseURL }) => ({
       callbackUrl: `${baseURL}/vk/callback`,
       scope: ['email'],
     },
-    async authCallback({ accessToken, query }) {
+    async authCallback({ accessToken, grantResponse }) {
+      const email = grantResponse?.raw?.email;
+      const userId = grantResponse?.raw?.user_id;
+
+      if (!email || !userId) {
+        throw new Error('VK authentication requires a completed OAuth session');
+      }
+
       const { body } = await bearerGet('https://api.vk.com/method/users.get', accessToken, {
-        qs: { user_ids: query.raw.user_id, v: '5.122' },
+        qs: { user_ids: userId, v: '5.122' },
       });
+
+      if (!body.response?.[0]) {
+        throw new Error('Invalid VK access token');
+      }
+
       return {
         username: `${body.response[0].last_name} ${body.response[0].first_name}`,
-        email: query.raw.email,
+        email,
       };
     },
   },
@@ -205,9 +252,13 @@ const initProviders = ({ baseURL }) => ({
           'Client-Id': providers.twitch.key,
         },
       });
+      const email = body.data?.[0]?.email;
+      if (!email) {
+        throw new Error('Email not verified by Twitch');
+      }
       return {
         username: body.data[0].login,
-        email: body.data[0].email,
+        email,
       };
     },
   },
@@ -228,7 +279,11 @@ const initProviders = ({ baseURL }) => ({
         accessToken
       );
 
-      const email = emailBody.elements[0]['handle~'];
+      const email = emailBody.elements[0]?.['handle~'];
+
+      if (!email?.emailAddress) {
+        throw new Error('Email not verified by LinkedIn');
+      }
 
       return {
         username: profileBody.localizedFirstName,
@@ -247,10 +302,18 @@ const initProviders = ({ baseURL }) => ({
       callback: `${baseURL}/cognito/callback`,
       scope: ['email', 'openid', 'profile'],
     },
-    async authCallback({ query, providers }) {
+    async authCallback({ providers, grantResponse }) {
       const jwksUrl = new URL(providers.cognito.jwksurl);
-      const idToken = query.id_token;
+      const idToken = grantResponse?.id_token;
+
+      if (!idToken) {
+        throw new Error('Cognito authentication requires a completed OAuth session');
+      }
+
       const tokenPayload = await verifyJwtWithJwks({ idToken, jwksUrl });
+      if (tokenPayload.email_verified !== true) {
+        throw new Error('Email not verified by Cognito');
+      }
       return {
         username: tokenPayload['cognito:username'],
         email: tokenPayload.email,
@@ -293,6 +356,9 @@ const initProviders = ({ baseURL }) => ({
         `https://${providers.auth0.subdomain}.auth0.com/userinfo`,
         accessToken
       );
+      if (body.email && body.email_verified !== true) {
+        throw new Error('Email not verified by Auth0');
+      }
       const username = body.username || body.nickname || body.name || body.email.split('@')[0];
       const email = body.email || `${username.replace(/\s+/g, '.')}@strapi.io`;
 
@@ -324,11 +390,15 @@ const initProviders = ({ baseURL }) => ({
       const email = body.attributes
         ? body.attributes.strapiemail || body.attributes.email
         : body.strapiemail || body.email;
+      const emailVerified = body.email_verified ?? body.attributes?.email_verified;
       if (!username || !email) {
         strapi.log.warn(
           `CAS Response Body did not contain required attributes: ${JSON.stringify(body)}`
         );
       }
+      if (email && emailVerified !== true) {
+        throw new Error('Email not verified by CAS');
+      }
       return {
         username,
         email,
@@ -347,10 +417,13 @@ const initProviders = ({ baseURL }) => ({
     },
     async authCallback({ accessToken }) {
       const { body } = await bearerGet(
-        'https://www.patreon.com/api/oauth2/v2/identity?fields[user]=full_name,email',
+        'https://www.patreon.com/api/oauth2/v2/identity?fields[user]=full_name,email,is_email_verified',
         accessToken
       );
       const patreonData = body.data.attributes;
+      if (patreonData.is_email_verified !== true) {
+        throw new Error('Email not verified by Patreon');
+      }
       return {
         username: patreonData.full_name,
         email: patreonData.email,
@@ -372,6 +445,9 @@ const initProviders = ({ baseURL }) => ({
         `https://${providers.keycloak.subdomain}/protocol/openid-connect/userinfo`,
         accessToken
       );
+      if (body.email_verified !== true) {
+        throw new Error('Email not verified by Keycloak');
+      }
       return {
         username: body.preferred_username,
         email: body.email,
@@ -400,12 +476,12 @@ module.exports = () => {
       delete authProviders[name];
     },
 
-    async run({ provider, accessToken, query, providers }) {
+    async run({ provider, accessToken, query, providers, grantResponse }) {
       const authProvider = authProviders[provider];
 
       assert(authProvider, 'Unknown auth provider');
 
-      return authProvider.authCallback({ accessToken, query, providers });
+      return authProvider.authCallback({ accessToken, query, providers, grantResponse });
     },
   };
 };

package/server/src/services/providers.js

@@ -17,8 +17,8 @@ module.exports = ({ strapi }) => {
    * @param {String}   provider
    */
 
-  const getProfile = async (provider, query) => {
-    const accessToken = query.access_token || query.code || query.oauth_token;
+  const getProfile = async (provider, oauthData, { grantResponse } = {}) => {
+    const accessToken = oauthData.access_token || oauthData.code || oauthData.oauth_token;
 
     const providers = await strapi
       .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })
@@ -26,9 +26,10 @@ module.exports = ({ strapi }) => {
 
     return getService('providers-registry').run({
       provider,
-      query,
+      query: oauthData,
       accessToken,
       providers,
+      grantResponse,
     });
   };
 
@@ -42,15 +43,16 @@ module.exports = ({ strapi }) => {
    * @return  {*}
    */
 
-  const connect = async (provider, query) => {
-    const accessToken = query.access_token || query.code || query.oauth_token;
+  const connect = async (provider, oauthData, { grantResponse } = {}) => {
+    const accessToken = oauthData.access_token || oauthData.code || oauthData.oauth_token;
+    const idToken = oauthData.id_token;
 
-    if (!accessToken) {
+    if (!accessToken && !idToken) {
       throw new Error('No access_token.');
     }
 
     // Get the profile.
-    const profile = await getProfile(provider, query);
+    const profile = await getProfile(provider, oauthData, { grantResponse });
 
     const email = _.toLower(profile.email);
 

package/server/src/services/user.js

@@ -10,12 +10,14 @@ const crypto = require('crypto');
 const bcrypt = require('bcryptjs');
 const urlJoin = require('url-join');
 
-const { sanitize } = require('@strapi/utils');
-const { toNumber, getOr } = require('lodash/fp');
+const { sanitize, ALLOWED_QUERY_PARAM_KEYS } = require('@strapi/utils');
+const { toNumber, getOr, pick } = require('lodash/fp');
 const { getService } = require('../utils');
 
 const USER_MODEL_UID = 'plugin::users-permissions.user';
 
+const pickAllowedQueryParams = pick(ALLOWED_QUERY_PARAM_KEYS);
+
 const getSessionManager = () => {
   const manager = strapi.sessionManager;
   return manager ?? null;
@@ -29,7 +31,11 @@ module.exports = ({ strapi }) => ({
    */
 
   count(params) {
-    return strapi.db.query(USER_MODEL_UID).count({ where: params });
+    const query = strapi
+      .get('query-params')
+      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));
+
+    return strapi.db.query(USER_MODEL_UID).count(query);
   },
 
   /**
@@ -101,7 +107,9 @@ module.exports = ({ strapi }) => ({
    * @return {Promise}
    */
   fetch(id, params) {
-    const query = strapi.get('query-params').transform(USER_MODEL_UID, params ?? {});
+    const query = strapi
+      .get('query-params')
+      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));
 
     return strapi.db.query(USER_MODEL_UID).findOne({
       ...query,
@@ -124,7 +132,9 @@ module.exports = ({ strapi }) => ({
    * @return {Promise}
    */
   fetchAll(params) {
-    const query = strapi.get('query-params').transform(USER_MODEL_UID, params ?? {});
+    const query = strapi
+      .get('query-params')
+      .transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));
 
     return strapi.db.query(USER_MODEL_UID).findMany(query);
   },