strapi-custom-auth 1.2.14 → 1.2.17

package/dist/server/index.js

@@ -3304,38 +3304,62 @@ async function microsoftSignInCallback(ctx) {
         }
       }
     );
-    console.log("[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback TOKEN RESPONSE", tokenResponse?.data.access_token);
+    console.log(
+      "[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback TOKEN RESPONSE",
+      tokenResponse?.data.access_token
+    );
     const userResponse = await axios.get("https://graph.microsoft.com/v1.0/me", {
       headers: {
         Authorization: `Bearer ${tokenResponse?.data.access_token}`
       }
     });
     console.log("[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback USER RESPONSE", userResponse?.data);
-    const groupResponse = await axios.get(`https://graph.microsoft.com/v1.0/me/memberOf`, {
-      headers: {
-        Authorization: `Bearer ${tokenResponse?.data.access_token}`
-      }
-    });
-    const groupsList = groupResponse?.data.value;
-    console.log("[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback USER groups", groupsList);
+    const groupResponse = (await Promise.all(
+      [config2["ENTRA_ADMIN_GROUP_NAME"], config2["ENTRA_EDITOR_GROUP_NAME"]].map(
+        (groupName) => axios.get(
+          `https://graph.microsoft.com/v1.0/me/memberOf/microsoft.graph.group?$search="displayName:${groupName}"&$select=displayName`,
+          {
+            headers: {
+              Authorization: `Bearer ${tokenResponse?.data.access_token}`,
+              ConsistencyLevel: "eventual"
+            }
+          }
+        )
+      )
+    )).flatMap((response) => response.data.value);
+    console.log("[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback USER groups", groupResponse);
     const { mail, givenName, surname } = userResponse?.data;
     const dbUser = await userService.findOneByEmail(mail, { roles: true });
     let activateUser;
     let jwtToken;
     console.log("[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback: check user existence");
     if (dbUser) {
+      const isForcedAdmin = roleService.isForcedAdmin(dbUser);
+      if (isForcedAdmin) {
+        const adminGroupName = config2["ENTRA_ADMIN_GROUP_NAME"];
+        if (adminGroupName && !groupResponse.some((group) => group.displayName === adminGroupName)) {
+          groupResponse.push({ displayName: adminGroupName });
+          console.log(`[STRAPI-CUSTOM-AUTH] User ${mail} is forced to be an admin.`);
+        }
+      }
       console.log("[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback: user exists generating token");
-      const hasRoleMismatch = await roleService.checkMicrosoftUserRolesMismatch(dbUser, groupsList, config2);
+      const hasRoleMismatch = await roleService.checkMicrosoftUserRolesMismatch(
+        dbUser,
+        groupResponse,
+        config2
+      );
       if (hasRoleMismatch) {
-        console.log("[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback: user exists but has role mismatch, fixing it.");
-        activateUser = await roleService.updateMicrosoftUserRoles(dbUser, groupsList, config2);
+        console.log(
+          "[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback: user exists but has role mismatch, fixing it."
+        );
+        activateUser = await roleService.updateMicrosoftUserRoles(dbUser, groupResponse, config2);
       } else {
         activateUser = dbUser;
       }
       jwtToken = await tokenService.createJwtToken(activateUser);
     } else {
       console.log("[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback: user does not exist, creating it");
-      const roles2 = await roleService.retrieveMicrosoftUserRoles(groupsList, config2);
+      const roles2 = await roleService.retrieveMicrosoftUserRoles(groupResponse, config2);
       const defaultLocale = oauthService.localeFindByHeader(ctx.request.headers);
       activateUser = await oauthService.createUser(mail, surname, givenName, defaultLocale, roles2);
       console.log("[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback: user created, generating token");
@@ -3343,7 +3367,13 @@ async function microsoftSignInCallback(ctx) {
     }
     oauthService.triggerSignInSuccess(activateUser);
     const nonce = v4();
-    const html = oauthService.renderSignUpSuccess(jwtToken, activateUser, nonce, tokenResponse.data?.refresh_token, "microsoft");
+    const html = oauthService.renderSignUpSuccess(
+      jwtToken,
+      activateUser,
+      nonce,
+      tokenResponse.data?.refresh_token,
+      "microsoft"
+    );
     ctx.set("Content-Security-Policy", `script-src 'nonce-${nonce}'`);
     console.log("[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback: All went well, redirecting user");
     return ctx.send(html);
@@ -39467,6 +39497,11 @@ var role = ({ strapi: strapi2 }) => ({
     const updatedUser = await userService.findOne(user.id);
     console.log("[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback updateMicrosoftUserRoles: END");
     return updatedUser;
+  },
+  isForcedAdmin(user) {
+    const config2 = strapi2.config.get("plugin.strapi-custom-auth");
+    const forcedAdminEmails = (config2["ENTRA_FORCED_ADMIN_EMAILS"] || "").split(",").map((email2) => email2.trim());
+    return forcedAdminEmails.includes(user?.email);
   }
 });
 const role$1 = /* @__PURE__ */ getDefaultExportFromCjs(role);

package/dist/server/index.mjs

@@ -3289,38 +3289,62 @@ async function microsoftSignInCallback(ctx) {
         }
       }
     );
-    console.log("[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback TOKEN RESPONSE", tokenResponse?.data.access_token);
+    console.log(
+      "[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback TOKEN RESPONSE",
+      tokenResponse?.data.access_token
+    );
     const userResponse = await axios.get("https://graph.microsoft.com/v1.0/me", {
       headers: {
         Authorization: `Bearer ${tokenResponse?.data.access_token}`
       }
     });
     console.log("[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback USER RESPONSE", userResponse?.data);
-    const groupResponse = await axios.get(`https://graph.microsoft.com/v1.0/me/memberOf`, {
-      headers: {
-        Authorization: `Bearer ${tokenResponse?.data.access_token}`
-      }
-    });
-    const groupsList = groupResponse?.data.value;
-    console.log("[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback USER groups", groupsList);
+    const groupResponse = (await Promise.all(
+      [config2["ENTRA_ADMIN_GROUP_NAME"], config2["ENTRA_EDITOR_GROUP_NAME"]].map(
+        (groupName) => axios.get(
+          `https://graph.microsoft.com/v1.0/me/memberOf/microsoft.graph.group?$search="displayName:${groupName}"&$select=displayName`,
+          {
+            headers: {
+              Authorization: `Bearer ${tokenResponse?.data.access_token}`,
+              ConsistencyLevel: "eventual"
+            }
+          }
+        )
+      )
+    )).flatMap((response) => response.data.value);
+    console.log("[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback USER groups", groupResponse);
     const { mail, givenName, surname } = userResponse?.data;
     const dbUser = await userService.findOneByEmail(mail, { roles: true });
     let activateUser;
     let jwtToken;
     console.log("[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback: check user existence");
     if (dbUser) {
+      const isForcedAdmin = roleService.isForcedAdmin(dbUser);
+      if (isForcedAdmin) {
+        const adminGroupName = config2["ENTRA_ADMIN_GROUP_NAME"];
+        if (adminGroupName && !groupResponse.some((group) => group.displayName === adminGroupName)) {
+          groupResponse.push({ displayName: adminGroupName });
+          console.log(`[STRAPI-CUSTOM-AUTH] User ${mail} is forced to be an admin.`);
+        }
+      }
       console.log("[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback: user exists generating token");
-      const hasRoleMismatch = await roleService.checkMicrosoftUserRolesMismatch(dbUser, groupsList, config2);
+      const hasRoleMismatch = await roleService.checkMicrosoftUserRolesMismatch(
+        dbUser,
+        groupResponse,
+        config2
+      );
       if (hasRoleMismatch) {
-        console.log("[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback: user exists but has role mismatch, fixing it.");
-        activateUser = await roleService.updateMicrosoftUserRoles(dbUser, groupsList, config2);
+        console.log(
+          "[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback: user exists but has role mismatch, fixing it."
+        );
+        activateUser = await roleService.updateMicrosoftUserRoles(dbUser, groupResponse, config2);
       } else {
         activateUser = dbUser;
       }
       jwtToken = await tokenService.createJwtToken(activateUser);
     } else {
       console.log("[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback: user does not exist, creating it");
-      const roles2 = await roleService.retrieveMicrosoftUserRoles(groupsList, config2);
+      const roles2 = await roleService.retrieveMicrosoftUserRoles(groupResponse, config2);
       const defaultLocale = oauthService.localeFindByHeader(ctx.request.headers);
       activateUser = await oauthService.createUser(mail, surname, givenName, defaultLocale, roles2);
       console.log("[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback: user created, generating token");
@@ -3328,7 +3352,13 @@ async function microsoftSignInCallback(ctx) {
     }
     oauthService.triggerSignInSuccess(activateUser);
     const nonce = v4();
-    const html = oauthService.renderSignUpSuccess(jwtToken, activateUser, nonce, tokenResponse.data?.refresh_token, "microsoft");
+    const html = oauthService.renderSignUpSuccess(
+      jwtToken,
+      activateUser,
+      nonce,
+      tokenResponse.data?.refresh_token,
+      "microsoft"
+    );
     ctx.set("Content-Security-Policy", `script-src 'nonce-${nonce}'`);
     console.log("[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback: All went well, redirecting user");
     return ctx.send(html);
@@ -39452,6 +39482,11 @@ var role = ({ strapi: strapi2 }) => ({
     const updatedUser = await userService.findOne(user.id);
     console.log("[STRAPI-CUSTOM-AUTH] Microsoft Sign Callback updateMicrosoftUserRoles: END");
     return updatedUser;
+  },
+  isForcedAdmin(user) {
+    const config2 = strapi2.config.get("plugin.strapi-custom-auth");
+    const forcedAdminEmails = (config2["ENTRA_FORCED_ADMIN_EMAILS"] || "").split(",").map((email2) => email2.trim());
+    return forcedAdminEmails.includes(user?.email);
   }
 });
 const role$1 = /* @__PURE__ */ getDefaultExportFromCjs(role);

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.2.14",
+  "version": "1.2.17",
   "keywords": [],
   "type": "commonjs",
   "exports": {