casdoor 1.5.1 → 1.6.1

package/.github/workflows/release.yaml

@@ -26,3 +26,33 @@ jobs:
         run: yarn semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Package
+        id: package
+        if: github.event_name == 'push' && github.repository == 'casdoor/casdoor-chrome-extension'
+        run: |
+          tag=$(git tag --points-at HEAD | grep '^v' | head -n 1)
+          if [ -z "$tag" ]; then
+            echo "No new release, nothing to package"
+            exit 0
+          fi
+          # the version only lives in the tag, it is written into the manifest here and not committed
+          node -e 'const fs = require("fs"); const m = JSON.parse(fs.readFileSync("manifest.json")); m.version = process.argv[1]; fs.writeFileSync("manifest.json", JSON.stringify(m, null, 2) + "\n")' "${tag#v}"
+          zip -r casdoor-extension.zip manifest.json src images
+          gh release upload "$tag" casdoor-extension.zip --clobber
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Publish to the Chrome Web Store
+        if: steps.package.outputs.tag != ''
+        run: |
+          if [ -z "$CLIENT_ID" ] || [ -z "$CLIENT_SECRET" ] || [ -z "$REFRESH_TOKEN" ] || [ -z "$PUBLISHER_ID" ]; then
+            echo "::warning::The Chrome Web Store secrets are not set, ${{ steps.package.outputs.tag }} is only attached to the GitHub release"
+            exit 0
+          fi
+          npx --yes chrome-webstore-upload-cli@4.0.2 --source casdoor-extension.zip
+        env:
+          EXTENSION_ID: bnjbegmkpjbcpneclidlbloadenondlm
+          PUBLISHER_ID: ${{ secrets.CHROME_PUBLISHER_ID }}
+          CLIENT_ID: ${{ secrets.CHROME_CLIENT_ID }}
+          CLIENT_SECRET: ${{ secrets.CHROME_CLIENT_SECRET }}
+          REFRESH_TOKEN: ${{ secrets.CHROME_REFRESH_TOKEN }}

package/README.md

@@ -18,11 +18,14 @@ Casdoor only hands an account out for a page of the system's own sign-in URLs, r
 
 ### Install the extension
 
-1. Go to `chrome://extensions` and check the box for **Developer mode** in the top right.
-2. Click `Load unpacked` button, then choose this project folder.
+Install it from the [Chrome Web Store](https://chromewebstore.google.com/detail/casdoor-browser-plugin/bnjbegmkpjbcpneclidlbloadenondlm). It also works in Edge and other Chromium browsers that allow extensions from the Chrome Web Store.
+
+Where the store can't be reached, download `casdoor-extension.zip` from the [latest release](https://github.com/casdoor/casdoor-chrome-extension/releases/latest), unzip it, go to `chrome://extensions`, turn on **Developer mode** in the top right, click **Load unpacked** and choose the unzipped folder.
+
+Each release is published to the Chrome Web Store and attached to the GitHub release by `.github/workflows/release.yaml`, with the version of the release written into `manifest.json`. The store can take a few days to review a new version.
 
 ### Sign in to Casdoor
 
 1. Open the extension, enter the Casdoor URL and the name of the application to sign in with.
-2. Add the address shown at the bottom of the extension (`https://<extension id>.chromiumapp.org/`) to the redirect URLs of that application, and allow the `token` grant type in it.
+2. Add the address shown at the bottom of the extension (`https://<extension id>.chromiumapp.org/`) to the redirect URLs of that application, and allow the `token` grant type in it. The extension installed from the Chrome Web Store always has the address `https://bnjbegmkpjbcpneclidlbloadenondlm.chromiumapp.org/`, so it can be added once for everyone; an unpacked one gets its own.
 3. Click **Sign in to Casdoor**. The extension then lists the systems it fills for you.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "casdoor",
-  "version": "1.5.1",
+  "version": "1.6.1",
   "description": "The Casdoor extension can help browser users automatically log into applications protected by Casdoor single-sign-on (SSO) system.",
   "repository": {
     "type": "git",

package/src/content-script.js

@@ -33,6 +33,10 @@
       skip: "不用了",
       saved: "已保存到 Casdoor",
       close: "关闭",
+      missingSelector: "管理员配置的{field}选择器“{selector}”在这个页面上没有找到，已改用自动识别",
+      usernameField: "用户名输入框",
+      passwordField: "密码输入框",
+      submitField: "登录按钮",
     }
     : {
       filled: "Casdoor filled in the account {user} of {app}",
@@ -44,6 +48,10 @@
       skip: "No thanks",
       saved: "Saved to Casdoor",
       close: "Close",
+      missingSelector: "The {field} selector \"{selector}\" set by the admin matches nothing on this page, so it was found automatically",
+      usernameField: "username input",
+      passwordField: "password input",
+      submitField: "sign-in button",
     };
 
   function format(text, values) {
@@ -78,19 +86,36 @@
     return element.getClientRects().length > 0;
   }
 
+  // a class attribute pasted as it is, like "el-button login-btn el-button--primary", is taken as those classes
+  function selectorCandidates(selector) {
+    const value = selector.trim();
+    const candidates = [value];
+    if (/^[\w-]+(\s+[\w-]+)*$/.test(value)) {
+      candidates.push("." + value.split(/\s+/).join("."));
+    }
+    return candidates;
+  }
+
   function query(selector) {
-    if (!selector) {
+    if (!selector || !selector.trim()) {
       return null;
     }
-    try {
-      return document.querySelector(selector);
-    } catch (error) {
-      return null;
+    for (const candidate of selectorCandidates(selector)) {
+      try {
+        const element = document.querySelector(candidate);
+        if (element) {
+          return element;
+        }
+      } catch (error) {
+        // not a valid selector, try the next way of reading it
+      }
     }
+    return null;
   }
 
   const usernameHints = /user|login|account|email|mail|phone|mobile|tel|name|uid|uname|loginid|工号|账号|帳號|用户|用戶|手机|邮箱/i;
-  const submitHints = /^\s*(登\s*录|登\s*入|登\s*陆|log\s*in|sign\s*in|login|signin|submit|确\s*定|提\s*交|进入系统)\s*$/i;
+  // "登录", "登录系统", "立即登录", "Sign in", ...
+  const submitHints = /^\s*(?:(?:立即|马上|安全|用户|账号)?\s*(?:登\s*录|登\s*入|登\s*陆)\s*(?:系统|平台)?|进入系统|log\s*in|log\s*on|sign\s*in|login|logon|signin|submit|确\s*定|提\s*交)\s*$/i;
 
   function findPassword(site) {
     const configured = query(site.passwordSelector);
@@ -136,8 +161,14 @@
         return button;
       }
     }
-    const clickable = [...document.querySelectorAll("button, input[type=button], input[type=submit], a, [role=button], div[onclick], span[onclick]")];
-    return clickable.find((element) => isVisible(element) && submitHints.test(element.value || element.textContent || "")) || null;
+    // buttons first, so that a link or a tab with the same words loses to the real button
+    for (const selector of ["button, input[type=button], input[type=submit]", "[role=button]", "a, div[onclick], span[onclick]"]) {
+      const found = [...document.querySelectorAll(selector)].find((element) => isVisible(element) && submitHints.test(element.value || element.textContent || ""));
+      if (found) {
+        return found;
+      }
+    }
+    return null;
   }
 
   function setValue(input, value) {
@@ -154,8 +185,11 @@
     for (const type of ["keydown", "keypress", "keyup"]) {
       input.dispatchEvent(new KeyboardEvent(type, {key: "Enter", code: "Enter", keyCode: 13, which: 13, bubbles: true}));
     }
-    if (input.form) {
-      input.form.requestSubmit();
+    // a single-page app (Vue, React, ...) signs in from its own Enter handler, submitting its <form> would only reload
+    // the page; a server-side form says where it goes
+    const form = input.form;
+    if (form && (form.hasAttribute("action") || form.hasAttribute("method"))) {
+      form.requestSubmit();
     }
   }
 
@@ -187,6 +221,7 @@
     title.style.cssText = "font-weight:600;font-size:12px;color:#5c6ac4;margin-bottom:4px;";
     title.textContent = "Casdoor";
     const body = document.createElement("div");
+    body.style.whiteSpace = "pre-line";
     body.textContent = text;
     box.append(title, body);
     if (buttons.length > 0) {
@@ -239,7 +274,14 @@
       showNotice(strings.retry, buttons, 0);
       return;
     }
-    showNotice(format(strings.filled, {app: site.displayName, user: account.username}), buttons);
+    // the admin's selectors that match nothing, so that a wrong one doesn't go unnoticed
+    const missing = [
+      [site.usernameSelector, strings.usernameField],
+      [site.passwordSelector, strings.passwordField],
+      [site.autoSubmit ? site.submitSelector : "", strings.submitField],
+    ].filter(([selector]) => selector && selector.trim() && !query(selector));
+    const warnings = missing.map(([selector, field]) => format(strings.missingSelector, {field, selector}));
+    showNotice([format(strings.filled, {app: site.displayName, user: account.username}), ...warnings].join("\n"), buttons, warnings.length > 0 ? 15000 : 8000);
 
     if (site.autoSubmit && !username) {
       await sleep(400);