casdoor 1.4.0 → 1.5.1

package/.eslintrc.js

@@ -1,6 +1,7 @@
 module.exports = {
   env: {
     browser: true,
+    webextensions: true,
     es2021: true,
   },
   extends: [

package/README.md

@@ -1,16 +1,28 @@
 # casdoor-chrome-extension
 
-The Casdoor extension can help browser users automatically log into applications protected by [Casdoor](https://casdoor.org). The extension's code is open-sourced at: https://github.com/casdoor/casdoor-chrome-extension
-
-This extension is very simple to use. We will show you the steps below.
+The Casdoor browser extension signs users into the systems that have no single sign-on, by filling their sign-in forms with the accounts kept in [Casdoor](https://casdoor.ai). The code is open-sourced at: https://github.com/casdoor/casdoor-chrome-extension
 
 ## Demo video
 
 ![AutoLogin](./img/demo.gif)
 
+## How it works
+
+1. The admin turns on **Form autofill** in the application of a legacy system (the "Form autofill" tab of the application's edit page) and enters its sign-in page URLs, e.g. `https://oa.example.com/login`. The host must be the same, `*.example.com` covers its subdomains, and a path without `*` matches as a prefix. The fields are found automatically, or set with CSS selectors.
+2. Each user's account of the system is a managed account on the user's page, or saved by the user: when **Let users save their accounts** is on, the extension offers to save the account that the user signs in with by hand.
+3. When the user opens a sign-in page, the extension asks Casdoor for the account of that page and fills it in, and clicks the sign-in button when **Submit automatically** is on. A sign-in page that comes back within 30 seconds is filled but not submitted again.
+
+Casdoor only hands an account out for a page of the system's own sign-in URLs, records every time it does, and can keep the passwords encrypted (the organization's "Encrypted fields", with `fieldEncryptionKey` set). Form autofill needs a Casdoor Enterprise edition license. On a Casdoor without it, the extension fills the managed accounts on the pages that match the application's "Signin URL", a regular expression, as its first versions did.
+
 ## Usage
 
 ### Install the extension
 
 1. Go to `chrome://extensions` and check the box for **Developer mode** in the top right.
 2. Click `Load unpacked` button, then choose this project folder.
+
+### Sign in to Casdoor
+
+1. Open the extension, enter the Casdoor URL and the name of the application to sign in with.
+2. Add the address shown at the bottom of the extension (`https://<extension id>.chromiumapp.org/`) to the redirect URLs of that application, and allow the `token` grant type in it.
+3. Click **Sign in to Casdoor**. The extension then lists the systems it fills for you.

package/manifest.json

@@ -1,12 +1,16 @@
 {
-  "name": "Casdoor Browser Plugin",
-  "description": "Casdoor Browser Plugin can help the users automatically log into applications protected by Casdoor identity provider.",
-  "version": "1.0.0",
+  "name": "Casdoor",
+  "description": "Signs you into the systems without single sign-on by filling their sign-in forms with your accounts kept in Casdoor.",
+  "version": "2.0.0",
   "manifest_version": 3,
   "permissions": [
     "storage",
     "identity"
   ],
+  "host_permissions": [
+    "https://*/*",
+    "http://*/*"
+  ],
   "action": {
     "default_popup": "/src/popup.html",
     "default_icon": {
@@ -22,6 +26,9 @@
     "48": "/images/icon48.png",
     "128": "/images/icon128.png"
   },
+  "background": {
+    "service_worker": "/src/background.js"
+  },
   "content_scripts": [
     {
       "matches": [
@@ -29,18 +36,10 @@
         "http://*/*"
       ],
       "js": [
-        "/src/content-script.js",
-        "/src/sdk.js",
-        "/src/oauth.js",
-        "/src/config.js"
-      ]
+        "/src/content-script.js"
+      ],
+      "all_frames": true,
+      "run_at": "document_idle"
     }
-  ],
-    "background": {
-        "service_worker": "/src/background.js"
-      },
-  "host_permissions": [
-    "https://*/*",
-    "http://*/*"
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "casdoor",
-  "version": "1.4.0",
+  "version": "1.5.1",
   "description": "The Casdoor extension can help browser users automatically log into applications protected by Casdoor single-sign-on (SSO) system.",
   "repository": {
     "type": "git",

package/src/background.js

@@ -12,101 +12,357 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-let autoLoginTabs = new Set();
-
-chrome.tabs.onUpdated.addListener(async (tabId, changeInfo, tab) => {
-  if (tab.url && tab.status === "complete") {
-    const [UserLoggedIn, DisableAutoLogin] = await Promise.all([
-      isUserLoggedIn(tabId),
-      isDisableAutoLogin(tabId),
-    ]);
-    if (UserLoggedIn && !DisableAutoLogin && !autoLoginTabs.has(tabId)) {
-      autoLogin(tabId, tab.url);
-    }
+/* global importScripts, matchFormFillSite, matchLegacySigninUrl */
+
+importScripts("match.js");
+
+// The service worker is the only part that talks to Casdoor and holds the access token. The content scripts ask it
+// for the account of the page they are on, and it only answers for a frame whose own URL is a sign-in page.
+
+const SITES_TTL = 60 * 1000;
+const PENDING_TTL = 2 * 60 * 1000;
+const AUTO_SUBMIT_GAP = 30 * 1000;
+
+let sitesCache = null;
+const lastAutoSubmits = new Map();
+
+function getSettings() {
+  return chrome.storage.local.get(["endpoint", "applicationName", "accessToken", "userProfile", "disableAutoFill"]);
+}
+
+// the settings of the first versions were kept in the synced storage
+async function migrateSettings() {
+  const local = await chrome.storage.local.get(["migrated"]);
+  if (local.migrated) {
+    return;
+  }
+  const synced = await chrome.storage.sync.get(["endpoint", "applicationName", "disableAutoLogin"]);
+  const current = await chrome.storage.local.get(["endpoint", "applicationName", "disableAutoFill"]);
+  await chrome.storage.local.set({
+    endpoint: current.endpoint ?? synced.endpoint ?? "",
+    applicationName: current.applicationName ?? synced.applicationName ?? "",
+    disableAutoFill: current.disableAutoFill ?? !!synced.disableAutoLogin,
+    migrated: true,
+  });
+  await chrome.storage.sync.remove(["accessToken", "userProfile"]);
+}
+
+chrome.runtime.onInstalled.addListener(() => {
+  migrateSettings();
+});
+
+chrome.storage.onChanged.addListener((changes, area) => {
+  if (area === "local" && (changes.accessToken || changes.endpoint)) {
+    sitesCache = null;
   }
 });
 
-async function isUserLoggedIn(tabId) {
-  return new Promise((resolve, reject) => {
-    chrome.tabs.sendMessage(
-      tabId,
-      { action: "isUserLoggedIn" },
-      function (UserLoggedIn) {
-        if (chrome.runtime.lastError) {
-          reject(chrome.runtime.lastError.message);
-        } else {
-          resolve(UserLoggedIn);
-        }
-      }
-    );
-  });
+function normalizeEndpoint(endpoint) {
+  return (endpoint || "").trim().replace(/\/+$/, "");
 }
 
-function getManagedAccounts(tabId) {
-  return new Promise((resolve, reject) => {
-    chrome.tabs.sendMessage(
-      tabId,
-      { action: "getManagedAccounts" },
-      function (managedAccounts) {
-        if (chrome.runtime.lastError) {
-          reject(chrome.runtime.lastError.message);
-        } else {
-          resolve(managedAccounts);
-        }
-      }
-    );
-  });
+async function signOut() {
+  sitesCache = null;
+  await chrome.storage.local.set({accessToken: "", userProfile: null});
 }
 
-function testUrlWithRegex(url, regexPattern) {
+async function callApi(path, options = {}) {
+  const {endpoint, accessToken} = await getSettings();
+  if (!endpoint || !accessToken) {
+    return {status: "error", msg: "", data: "Please login first"};
+  }
+  let response;
   try {
-    const regex = new RegExp(regexPattern);
-    const isMatched = regex.test(url);
-    console.log(`testUrlWithRegex(), url = ${url}, regexPattern = ${regexPattern}, isMatched = ${isMatched}`);
-    return isMatched;
+    response = await fetch(`${endpoint}${path}`, {
+      ...options,
+      headers: {...(options.headers || {}), Authorization: `Bearer ${accessToken}`},
+    });
   } catch (error) {
-    alert(`testUrlWithRegex() error, the regex pattern: "${regexPattern}" is invalid`);
-    return false;
+    return {status: "error", msg: error.message, unreachable: true};
+  }
+  let res;
+  try {
+    res = await response.json();
+  } catch (error) {
+    // a Casdoor without the API answers with a page
+    return {status: "error", msg: `HTTP ${response.status}`, missing: true};
+  }
+  if (res.status !== "ok" && res.data === "Please login first") {
+    await signOut();
   }
+  return res;
 }
 
-async function autoLogin(tabId, url) {
-  const managedAccounts = await getManagedAccounts(tabId);
-  if (managedAccounts) {
-    for (const managedAccount of managedAccounts) {
-      if (managedAccount && managedAccount.signinUrl && url) {
-        const isMatched = testUrlWithRegex(url, managedAccount.signinUrl);
-        if (isMatched) {
-          autoLoginTabs.add(tabId);
-          chrome.tabs.sendMessage(tabId, {
-            action: "autoLogin",
-            managedAccount: managedAccount,
-          });
-          break;
-        }
-      }
+// getSites returns the sign-in pages that the user's accounts are filled into. A Casdoor without an enterprise license
+// or without form autofill falls back to the managed accounts with their sign-in URLs as regular expressions.
+async function getSites() {
+  const settings = await getSettings();
+  if (!settings.endpoint || !settings.accessToken) {
+    return null;
+  }
+  if (sitesCache && sitesCache.endpoint === settings.endpoint && Date.now() - sitesCache.time < SITES_TTL) {
+    return sitesCache;
+  }
+
+  const res = await callApi("/api/get-form-fill-sites");
+  let cache;
+  if (res.status === "ok") {
+    cache = {mode: "sites", sites: res.data || []};
+  } else if (res.code === "edition-required" || res.missing) {
+    const accountRes = await callApi("/api/get-account?managedAccounts=1");
+    if (accountRes.status !== "ok") {
+      return null;
     }
+    const accounts = (accountRes.data && accountRes.data.managedAccounts) || [];
+    cache = {mode: "legacy", accounts, message: res.code === "edition-required" ? res.msg : ""};
+  } else {
+    return null;
+  }
+  sitesCache = {...cache, endpoint: settings.endpoint, time: Date.now()};
+  return sitesCache;
+}
+
+function findSite(cache, pageUrl) {
+  if (cache.mode === "sites") {
+    return cache.sites.find((site) => matchFormFillSite(site, pageUrl)) || null;
+  }
+  const accounts = cache.accounts.filter((account) => account.signinUrl && matchLegacySigninUrl(account.signinUrl, pageUrl));
+  if (accounts.length === 0) {
+    return null;
+  }
+  // the first versions always signed in
+  return {application: accounts[0].application, displayName: accounts[0].application, accounts: accounts.map((account) => account.username), autoSubmit: true};
+}
+
+async function getFill(sender) {
+  const settings = await getSettings();
+  if (settings.disableAutoFill) {
+    return {};
+  }
+  const cache = await getSites();
+  if (!cache) {
+    return {};
   }
+  const site = findSite(cache, sender.url);
+  if (!site) {
+    return {};
+  }
+  const key = `${sender.tab ? sender.tab.id : 0}/${site.application}`;
+  const recentlySubmitted = Date.now() - (lastAutoSubmits.get(key) || 0) < AUTO_SUBMIT_GAP;
+  return {
+    site: {
+      application: site.application,
+      displayName: site.displayName || site.application,
+      usernameSelector: site.usernameSelector || "",
+      passwordSelector: site.passwordSelector || "",
+      submitSelector: site.submitSelector || "",
+      autoSubmit: !!site.autoSubmit && !recentlySubmitted,
+      urls: site.urls || [],
+    },
+    accounts: site.accounts || [],
+    canSave: !!site.allowSave && (site.accounts || []).length === 0,
+    recentlySubmitted,
+  };
 }
 
-function isDisableAutoLogin(tabId) {
-  return new Promise((resolve, reject) => {
-    chrome.tabs.sendMessage(
-      tabId,
-      { action: "isDisableAutoLogin" },
-      function (DisableAutoLogin) {
-        if (chrome.runtime.lastError) {
-          reject(chrome.runtime.lastError);
-        } else {
-          resolve(DisableAutoLogin);
-        }
-      }
-    );
+async function getAccount(message, sender) {
+  const cache = await getSites();
+  if (!cache) {
+    return {error: "not signed in"};
+  }
+  const site = findSite(cache, sender.url);
+  if (!site || site.application !== message.application) {
+    return {error: "not a sign-in page"};
+  }
+
+  if (cache.mode === "legacy") {
+    const account = cache.accounts.find((item) => item.application === site.application && (!message.username || item.username === message.username));
+    return account ? {username: account.username, password: account.password} : {error: "no account"};
+  }
+
+  const query = new URLSearchParams({application: site.application, username: message.username || "", url: sender.url});
+  const res = await callApi(`/api/get-form-fill-account?${query.toString()}`);
+  if (res.status !== "ok") {
+    return {error: res.msg};
+  }
+  if (message.autoSubmit && sender.tab) {
+    lastAutoSubmits.set(`${sender.tab.id}/${site.application}`, Date.now());
+  }
+  return {username: res.data.username, password: res.data.password};
+}
+
+function pendingKey(tabId) {
+  return `pending-${tabId}`;
+}
+
+async function capture(message, sender) {
+  if (!sender.tab || !message.username || !message.password) {
+    return {};
+  }
+  const cache = await getSites();
+  const site = cache && findSite(cache, sender.url);
+  if (!site || !site.allowSave || site.application !== message.application) {
+    return {};
+  }
+  await chrome.storage.session.set({
+    [pendingKey(sender.tab.id)]: {
+      application: site.application,
+      displayName: site.displayName || site.application,
+      username: message.username,
+      password: message.password,
+      url: sender.url,
+      time: Date.now(),
+    },
+  });
+  return {};
+}
+
+async function getPending(sender) {
+  if (!sender.tab) {
+    return null;
+  }
+  const key = pendingKey(sender.tab.id);
+  const pending = (await chrome.storage.session.get([key]))[key];
+  if (!pending) {
+    return null;
+  }
+  if (Date.now() - pending.time > PENDING_TTL) {
+    await chrome.storage.session.remove([key]);
+    return null;
+  }
+  return {application: pending.application, displayName: pending.displayName, username: pending.username};
+}
+
+async function resolvePending(message, sender) {
+  if (!sender.tab) {
+    return {};
+  }
+  const key = pendingKey(sender.tab.id);
+  const pending = (await chrome.storage.session.get([key]))[key];
+  await chrome.storage.session.remove([key]);
+  if (!pending || !message.save) {
+    return {};
+  }
+  const res = await callApi("/api/save-form-fill-account", {
+    method: "POST",
+    headers: {"Content-Type": "application/json"},
+    body: JSON.stringify({application: pending.application, username: pending.username, password: pending.password, url: pending.url}),
   });
+  sitesCache = null;
+  return res.status === "ok" ? {saved: true} : {error: res.msg};
 }
 
-function clearAutoLoginTabs() {
-  autoLoginTabs.clear();
+function getRedirectUri() {
+  return chrome.identity.getRedirectURL();
 }
 
-setInterval(clearAutoLoginTabs, 10000);
+async function login(message) {
+  const endpoint = normalizeEndpoint(message.endpoint);
+  const applicationName = (message.applicationName || "").trim();
+  if (!/^https?:\/\//.test(endpoint) || !applicationName) {
+    return {error: "endpoint"};
+  }
+  await chrome.storage.local.set({endpoint, applicationName});
+
+  let application;
+  try {
+    const response = await fetch(`${endpoint}/api/get-application?id=admin/${encodeURIComponent(applicationName)}`);
+    application = (await response.json()).data;
+  } catch (error) {
+    return {error: error.message};
+  }
+  if (!application || !application.clientId) {
+    return {error: "application"};
+  }
+
+  const state = crypto.randomUUID();
+  const authorizeUrl = `${endpoint}/login/oauth/authorize?` + new URLSearchParams({
+    client_id: application.clientId,
+    response_type: "token",
+    redirect_uri: getRedirectUri(),
+    scope: "openid profile",
+    state,
+  }).toString();
+
+  let redirectUrl;
+  try {
+    redirectUrl = await chrome.identity.launchWebAuthFlow({url: authorizeUrl, interactive: true});
+  } catch (error) {
+    return {error: error.message};
+  }
+  const params = new URLSearchParams(new URL(redirectUrl).hash.slice(1));
+  if (params.get("state") !== state || !params.get("access_token")) {
+    return {error: "token"};
+  }
+
+  sitesCache = null;
+  await chrome.storage.local.set({accessToken: params.get("access_token")});
+  const accountRes = await callApi("/api/get-account");
+  if (accountRes.status !== "ok") {
+    await signOut();
+    return {error: accountRes.msg};
+  }
+  const user = accountRes.data;
+  await chrome.storage.local.set({userProfile: {name: user.name, displayName: user.displayName, avatar: user.avatar, owner: user.owner}});
+  return {ok: true};
+}
+
+async function getStatus() {
+  await migrateSettings();
+  const settings = await getSettings();
+  const status = {
+    endpoint: settings.endpoint || "",
+    applicationName: settings.applicationName || "",
+    user: settings.accessToken ? settings.userProfile : null,
+    autoFill: !settings.disableAutoFill,
+    redirectUri: getRedirectUri(),
+  };
+  if (status.user) {
+    const cache = await getSites();
+    if (cache) {
+      status.mode = cache.mode;
+      status.message = cache.message || "";
+      status.sites = cache.mode === "sites"
+        ? cache.sites.map((site) => ({name: site.displayName || site.application, accounts: site.accounts.length}))
+        : cache.accounts.map((account) => ({name: account.application, accounts: 1}));
+    }
+  }
+  return status;
+}
+
+const handlers = {
+  getFill: (message, sender) => getFill(sender),
+  getAccount: (message, sender) => getAccount(message, sender),
+  capture: (message, sender) => capture(message, sender),
+  getPending: (message, sender) => getPending(sender),
+  resolvePending: (message, sender) => resolvePending(message, sender),
+  login: (message) => login(message),
+  logout: () => signOut().then(() => ({ok: true})),
+  getStatus: () => getStatus(),
+  setAutoFill: (message) => chrome.storage.local.set({disableAutoFill: !message.enabled}).then(() => ({ok: true})),
+};
+
+chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
+  const handler = handlers[message && message.type];
+  if (!handler) {
+    return false;
+  }
+  // the content scripts only reach the handlers that act on their own frame, the rest are for the popup
+  const fromExtension = (sender.url || "").startsWith(chrome.runtime.getURL(""));
+  if (!fromExtension && ["login", "logout", "getStatus", "setAutoFill"].includes(message.type)) {
+    return false;
+  }
+  handler(message, sender)
+    .then(sendResponse)
+    .catch((error) => sendResponse({error: error.message}));
+  return true;
+});
+
+chrome.tabs.onRemoved.addListener((tabId) => {
+  chrome.storage.session.remove([pendingKey(tabId)]);
+  for (const key of lastAutoSubmits.keys()) {
+    if (key.startsWith(`${tabId}/`)) {
+      lastAutoSubmits.delete(key);
+    }
+  }
+});