strapi-identity 0.2.0 → 0.4.0

package/dist/server/index.js

@@ -71,11 +71,11 @@ const defaultConfig$1 = {
     </table>
 </div>`
 };
-const bootstrap = async () => {
-  const config2 = strapi.documents("plugin::strapi-identity.strapi-identity-config");
+const bootstrap = async ({ strapi: strapi2 }) => {
+  const config2 = strapi2.documents("plugin::strapi-identity.strapi-identity-config");
   const existingConfig = await config2.count({});
   if (!existingConfig) await config2.create({ data: defaultConfig$1 });
-  strapi.admin.services.permission.actionProvider.registerMany([
+  strapi2.admin.services.permission.actionProvider.registerMany([
     {
       uid: "settings.read",
       section: "plugins",
@@ -9620,25 +9620,13 @@ var jsonwebtokenExports = requireJsonwebtoken();
 const jwt = /* @__PURE__ */ getDefaultExportFromCjs(jsonwebtokenExports);
 const register = ({ strapi: strapi2 }) => {
   const { admin: admin2, config: config2, server } = strapi2;
+  registerMiddlewares(server);
   const secret2 = config2.get("admin.auth.secret");
   const domain = config2.get("admin.auth.domain");
   const loginRoute = admin2.routes.admin.routes.find(
     ({ method, path }) => method === "POST" && path === "/login"
   );
   if (loginRoute) replaceLogin(loginRoute, secret2, domain);
-  server.use(async (ctx, next) => {
-    const mfaCookie = ctx.cookies.get("strapi_admin_mfa");
-    if (mfaCookie && ctx.path.startsWith("/admin/auth")) {
-      ctx.cookies.set("jwtToken", null, { expires: /* @__PURE__ */ new Date(0) });
-      ctx.redirect("/admin/strapi-identity/verify");
-      return;
-    }
-    if (!mfaCookie && ctx.path === "/admin/strapi-identity/verify") {
-      ctx.redirect("/admin");
-      return;
-    }
-    await next();
-  });
 };
 const replaceLogin = (route2, secret2, domain) => {
   route2.config.middlewares = route2.config.middlewares || [];
@@ -9680,6 +9668,68 @@ const replaceLogin = (route2, secret2, domain) => {
     ctx.body.data = { data: {}, error: null };
   });
 };
+const registerMiddlewares = (server) => {
+  const configService = strapi.service("plugin::strapi-identity.config");
+  server.use(async (ctx, next) => {
+    const mfaCookie = ctx.cookies.get("strapi_admin_mfa");
+    if (mfaCookie && ctx.path.startsWith("/admin/auth")) {
+      ctx.cookies.set("jwtToken", null, { expires: /* @__PURE__ */ new Date(0) });
+      ctx.redirect("/admin/strapi-identity/verify");
+      return;
+    }
+    if (!mfaCookie && ctx.path === "/admin/strapi-identity/verify") {
+      ctx.redirect("/admin");
+      return;
+    }
+    await next();
+  });
+  server.use(async (ctx, next) => {
+    const cookie = ctx.cookies.get("jwtToken");
+    if (!cookie) {
+      await next();
+      return;
+    }
+    const config2 = await configService.getConfig();
+    if (!config2.enabled || !config2.enforce) {
+      await next();
+      return;
+    }
+    const userEnabled = await configService.checkUserByJWT(cookie);
+    if (userEnabled) {
+      if (ctx.path === "/admin/strapi-identity/enforced") {
+        ctx.redirect("/admin");
+        return;
+      }
+      await next();
+      return;
+    }
+    const allowedPaths = [
+      "/admin/strapi-identity/enforced",
+      "/admin/init",
+      "/admin/users/me",
+      "/strapi-identity/status",
+      "/strapi-identity/config",
+      "/strapi-identity/config/enabled",
+      "/strapi-identity/enable",
+      "/strapi-identity/setup",
+      "/strapi-identity/enable-email",
+      "/strapi-identity/setup-email"
+    ];
+    const isAllowed = allowedPaths.includes(ctx.path) || // Static assets (JS, CSS, images, fonts, sourcemaps)
+    /\.(mjs|js|css|png|jpg|jpeg|gif|svg|ico|woff2?|ttf|eot|map)(\?.*)?$/.test(ctx.path) || ctx.path.startsWith("/admin/@");
+    if (!isAllowed) console.log(ctx.path);
+    if (!isAllowed) {
+      if (ctx.accepts("html") && ctx.path.startsWith("/admin")) {
+        ctx.redirect("/admin/strapi-identity/enforced");
+        return;
+      }
+      ctx.status = 403;
+      ctx.body = { error: { status: 403, message: "MFA setup required." } };
+      return;
+    }
+    await next();
+  });
+};
 const config$4 = {
   default: {},
   validator() {
@@ -10455,8 +10505,30 @@ const disableMFAForAllUsers = async () => {
     console.log("Error disabling MFA for all users:", err);
   }
 };
+const checkUserByJWT = async (jwtToken) => {
+  const config2 = await getConfig();
+  const secret2 = strapi.config.get("admin.auth.secret");
+  if (!config2.enabled) return false;
+  let userId;
+  try {
+    const decoded = jwt.verify(jwtToken, secret2);
+    userId = decoded.userId || decoded.id;
+  } catch {
+    return false;
+  }
+  if (!userId) return false;
+  try {
+    const mfaExists = await strapi.documents("plugin::strapi-identity.mfa-token").count({
+      filters: { admin_user: { id: userId }, enabled: true }
+    });
+    return mfaExists > 0;
+  } catch {
+    return false;
+  }
+};
 const config = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
   __proto__: null,
+  checkUserByJWT,
   getConfig,
   isEnabled,
   updateConfig

package/dist/server/index.mjs

@@ -64,11 +64,11 @@ const defaultConfig$1 = {
     </table>
 </div>`
 };
-const bootstrap = async () => {
-  const config2 = strapi.documents("plugin::strapi-identity.strapi-identity-config");
+const bootstrap = async ({ strapi: strapi2 }) => {
+  const config2 = strapi2.documents("plugin::strapi-identity.strapi-identity-config");
   const existingConfig = await config2.count({});
   if (!existingConfig) await config2.create({ data: defaultConfig$1 });
-  strapi.admin.services.permission.actionProvider.registerMany([
+  strapi2.admin.services.permission.actionProvider.registerMany([
     {
       uid: "settings.read",
       section: "plugins",
@@ -9613,25 +9613,13 @@ var jsonwebtokenExports = requireJsonwebtoken();
 const jwt = /* @__PURE__ */ getDefaultExportFromCjs(jsonwebtokenExports);
 const register = ({ strapi: strapi2 }) => {
   const { admin: admin2, config: config2, server } = strapi2;
+  registerMiddlewares(server);
   const secret2 = config2.get("admin.auth.secret");
   const domain = config2.get("admin.auth.domain");
   const loginRoute = admin2.routes.admin.routes.find(
     ({ method, path }) => method === "POST" && path === "/login"
   );
   if (loginRoute) replaceLogin(loginRoute, secret2, domain);
-  server.use(async (ctx, next) => {
-    const mfaCookie = ctx.cookies.get("strapi_admin_mfa");
-    if (mfaCookie && ctx.path.startsWith("/admin/auth")) {
-      ctx.cookies.set("jwtToken", null, { expires: /* @__PURE__ */ new Date(0) });
-      ctx.redirect("/admin/strapi-identity/verify");
-      return;
-    }
-    if (!mfaCookie && ctx.path === "/admin/strapi-identity/verify") {
-      ctx.redirect("/admin");
-      return;
-    }
-    await next();
-  });
 };
 const replaceLogin = (route2, secret2, domain) => {
   route2.config.middlewares = route2.config.middlewares || [];
@@ -9673,6 +9661,68 @@ const replaceLogin = (route2, secret2, domain) => {
     ctx.body.data = { data: {}, error: null };
   });
 };
+const registerMiddlewares = (server) => {
+  const configService = strapi.service("plugin::strapi-identity.config");
+  server.use(async (ctx, next) => {
+    const mfaCookie = ctx.cookies.get("strapi_admin_mfa");
+    if (mfaCookie && ctx.path.startsWith("/admin/auth")) {
+      ctx.cookies.set("jwtToken", null, { expires: /* @__PURE__ */ new Date(0) });
+      ctx.redirect("/admin/strapi-identity/verify");
+      return;
+    }
+    if (!mfaCookie && ctx.path === "/admin/strapi-identity/verify") {
+      ctx.redirect("/admin");
+      return;
+    }
+    await next();
+  });
+  server.use(async (ctx, next) => {
+    const cookie = ctx.cookies.get("jwtToken");
+    if (!cookie) {
+      await next();
+      return;
+    }
+    const config2 = await configService.getConfig();
+    if (!config2.enabled || !config2.enforce) {
+      await next();
+      return;
+    }
+    const userEnabled = await configService.checkUserByJWT(cookie);
+    if (userEnabled) {
+      if (ctx.path === "/admin/strapi-identity/enforced") {
+        ctx.redirect("/admin");
+        return;
+      }
+      await next();
+      return;
+    }
+    const allowedPaths = [
+      "/admin/strapi-identity/enforced",
+      "/admin/init",
+      "/admin/users/me",
+      "/strapi-identity/status",
+      "/strapi-identity/config",
+      "/strapi-identity/config/enabled",
+      "/strapi-identity/enable",
+      "/strapi-identity/setup",
+      "/strapi-identity/enable-email",
+      "/strapi-identity/setup-email"
+    ];
+    const isAllowed = allowedPaths.includes(ctx.path) || // Static assets (JS, CSS, images, fonts, sourcemaps)
+    /\.(mjs|js|css|png|jpg|jpeg|gif|svg|ico|woff2?|ttf|eot|map)(\?.*)?$/.test(ctx.path) || ctx.path.startsWith("/admin/@");
+    if (!isAllowed) console.log(ctx.path);
+    if (!isAllowed) {
+      if (ctx.accepts("html") && ctx.path.startsWith("/admin")) {
+        ctx.redirect("/admin/strapi-identity/enforced");
+        return;
+      }
+      ctx.status = 403;
+      ctx.body = { error: { status: 403, message: "MFA setup required." } };
+      return;
+    }
+    await next();
+  });
+};
 const config$4 = {
   default: {},
   validator() {
@@ -10448,8 +10498,30 @@ const disableMFAForAllUsers = async () => {
     console.log("Error disabling MFA for all users:", err);
   }
 };
+const checkUserByJWT = async (jwtToken) => {
+  const config2 = await getConfig();
+  const secret2 = strapi.config.get("admin.auth.secret");
+  if (!config2.enabled) return false;
+  let userId;
+  try {
+    const decoded = jwt.verify(jwtToken, secret2);
+    userId = decoded.userId || decoded.id;
+  } catch {
+    return false;
+  }
+  if (!userId) return false;
+  try {
+    const mfaExists = await strapi.documents("plugin::strapi-identity.mfa-token").count({
+      filters: { admin_user: { id: userId }, enabled: true }
+    });
+    return mfaExists > 0;
+  } catch {
+    return false;
+  }
+};
 const config = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
   __proto__: null,
+  checkUserByJWT,
   getConfig,
   isEnabled,
   updateConfig

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.2.0",
+  "version": "0.4.0",
   "keywords": [
     "strapi",
     "plugin",
@@ -40,11 +40,11 @@
     "input-otp": "^1.4.2",
     "otpauth": "^9.5.0",
     "qrcode.react": "^4.2.0",
-    "strapi-admin-portal": "^0.2.2"
+    "strapi-admin-portal": "^0.3.0"
   },
   "devDependencies": {
     "@strapi/sdk-plugin": "^6.0.1",
-    "@strapi/typescript-utils": "^5.39.0",
+    "@strapi/typescript-utils": "^5.40.0",
     "@types/bcryptjs": "^2.4.6",
     "@types/react": "^18.3.27",
     "@types/react-dom": "^18.3.7",

package/dist/admin/tokenHelpers-DagDzpso.mjs

@@ -1,22 +0,0 @@
-const getCookieValue = (name) => {
-  let result = null;
-  const cookieArray = document.cookie.split(";");
-  cookieArray.forEach((cookie) => {
-    const [key, value] = cookie.split("=").map((item) => item.trim());
-    if (key === name) {
-      result = decodeURIComponent(value);
-    }
-  });
-  return result;
-};
-const getToken = () => {
-  const fromLocalStorage = localStorage.getItem("jwtToken");
-  if (fromLocalStorage) {
-    return JSON.parse(fromLocalStorage);
-  }
-  const fromCookie = getCookieValue("jwtToken");
-  return fromCookie ?? null;
-};
-export {
-  getToken as g
-};

package/dist/admin/tokenHelpers-jtoRu0q5.js

@@ -1,21 +0,0 @@
-"use strict";
-const getCookieValue = (name) => {
-  let result = null;
-  const cookieArray = document.cookie.split(";");
-  cookieArray.forEach((cookie) => {
-    const [key, value] = cookie.split("=").map((item) => item.trim());
-    if (key === name) {
-      result = decodeURIComponent(value);
-    }
-  });
-  return result;
-};
-const getToken = () => {
-  const fromLocalStorage = localStorage.getItem("jwtToken");
-  if (fromLocalStorage) {
-    return JSON.parse(fromLocalStorage);
-  }
-  const fromCookie = getCookieValue("jwtToken");
-  return fromCookie ?? null;
-};
-exports.getToken = getToken;