casdoor 1.5.0 → 1.6.0

package/.github/workflows/release.yaml

@@ -26,3 +26,33 @@ jobs:
         run: yarn semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Package
+        id: package
+        if: github.event_name == 'push' && github.repository == 'casdoor/casdoor-chrome-extension'
+        run: |
+          tag=$(git tag --points-at HEAD | grep '^v' | head -n 1)
+          if [ -z "$tag" ]; then
+            echo "No new release, nothing to package"
+            exit 0
+          fi
+          # the version only lives in the tag, it is written into the manifest here and not committed
+          node -e 'const fs = require("fs"); const m = JSON.parse(fs.readFileSync("manifest.json")); m.version = process.argv[1]; fs.writeFileSync("manifest.json", JSON.stringify(m, null, 2) + "\n")' "${tag#v}"
+          zip -r casdoor-extension.zip manifest.json src images
+          gh release upload "$tag" casdoor-extension.zip --clobber
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Publish to the Chrome Web Store
+        if: steps.package.outputs.tag != ''
+        run: |
+          if [ -z "$CLIENT_ID" ] || [ -z "$CLIENT_SECRET" ] || [ -z "$REFRESH_TOKEN" ] || [ -z "$PUBLISHER_ID" ]; then
+            echo "::warning::The Chrome Web Store secrets are not set, ${{ steps.package.outputs.tag }} is only attached to the GitHub release"
+            exit 0
+          fi
+          npx --yes chrome-webstore-upload-cli@4.0.2 --source casdoor-extension.zip
+        env:
+          EXTENSION_ID: bnjbegmkpjbcpneclidlbloadenondlm
+          PUBLISHER_ID: ${{ secrets.CHROME_PUBLISHER_ID }}
+          CLIENT_ID: ${{ secrets.CHROME_CLIENT_ID }}
+          CLIENT_SECRET: ${{ secrets.CHROME_CLIENT_SECRET }}
+          REFRESH_TOKEN: ${{ secrets.CHROME_REFRESH_TOKEN }}

package/README.md

@@ -18,11 +18,14 @@ Casdoor only hands an account out for a page of the system's own sign-in URLs, r
 
 ### Install the extension
 
-1. Go to `chrome://extensions` and check the box for **Developer mode** in the top right.
-2. Click `Load unpacked` button, then choose this project folder.
+Install it from the [Chrome Web Store](https://chromewebstore.google.com/detail/casdoor-browser-plugin/bnjbegmkpjbcpneclidlbloadenondlm). It also works in Edge and other Chromium browsers that allow extensions from the Chrome Web Store.
+
+Where the store can't be reached, download `casdoor-extension.zip` from the [latest release](https://github.com/casdoor/casdoor-chrome-extension/releases/latest), unzip it, go to `chrome://extensions`, turn on **Developer mode** in the top right, click **Load unpacked** and choose the unzipped folder.
+
+Each release is published to the Chrome Web Store and attached to the GitHub release by `.github/workflows/release.yaml`, with the version of the release written into `manifest.json`. The store can take a few days to review a new version.
 
 ### Sign in to Casdoor
 
 1. Open the extension, enter the Casdoor URL and the name of the application to sign in with.
-2. Add the address shown at the bottom of the extension (`https://<extension id>.chromiumapp.org/`) to the redirect URLs of that application, and allow the `token` grant type in it.
+2. Add the address shown at the bottom of the extension (`https://<extension id>.chromiumapp.org/`) to the redirect URLs of that application, and allow the `token` grant type in it. The extension installed from the Chrome Web Store always has the address `https://bnjbegmkpjbcpneclidlbloadenondlm.chromiumapp.org/`, so it can be added once for everyone; an unpacked one gets its own.
 3. Click **Sign in to Casdoor**. The extension then lists the systems it fills for you.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "casdoor",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "The Casdoor extension can help browser users automatically log into applications protected by Casdoor single-sign-on (SSO) system.",
   "repository": {
     "type": "git",

package/src/match.js

@@ -13,7 +13,8 @@
 // limitations under the License.
 
 // The sign-in page patterns of form autofill, matched the same way as Casdoor matches them (object/form_fill.go):
-// the host has to be the same, "*.example.com" covers the subdomains, and a path without "*" is a prefix.
+// the host has to be the same, "*.example.com" covers the subdomains, a path without "*" is a prefix, and the part
+// after "#" is compared only when the pattern has it.
 
 function splitFormFillUrl(value) {
   value = (value || "").trim();
@@ -66,7 +67,8 @@ function matchFormFillUrl(pattern, pageUrl) {
   if (!matchFormFillHost(patternHost, pageHost)) {
     return false;
   }
-  const pagePath = fullPagePath.split("#")[0];
+  // the fragment only counts when the pattern has one, like the "#/login" route of a single-page application
+  const pagePath = patternPath.includes("#") ? fullPagePath : fullPagePath.split("#")[0];
   if (!patternPath.includes("*")) {
     return pagePath.startsWith(patternPath);
   }