strapi-plugin-keycloak-realm-users 1.0.0

package/server/src/controllers/user.js

@@ -0,0 +1,413 @@
+import { PLUGIN_ID, SERVICES, ERROR_MESSAGES } from '../constants.js';
+
+const userController = ({ strapi }) => ({
+  /**
+   * List users in a realm
+   */
+  async find(ctx) {
+    const user = ctx.state.user;
+    const { realmId } = ctx.params;
+    const { search, page = 1, pageSize = 25 } = ctx.query;
+
+    if (!user) {
+      return ctx.unauthorized(ERROR_MESSAGES.INSUFFICIENT_PERMISSIONS);
+    }
+
+    try {
+      const userService = strapi.plugin(PLUGIN_ID).service(SERVICES.USER);
+      const result = await userService.listUsers(
+        realmId,
+        { search, page: parseInt(page, 10), pageSize: parseInt(pageSize, 10) },
+        user
+      );
+
+      ctx.body = { data: result };
+    } catch (err) {
+      strapi.log.error(`[${PLUGIN_ID}] user.find error:`, err);
+      ctx.throw(400, err.sanitizedMessage || ERROR_MESSAGES.UNKNOWN_ERROR);
+    }
+  },
+
+  /**
+   * Get a single user
+   */
+  async findOne(ctx) {
+    const user = ctx.state.user;
+    const { realmId, id } = ctx.params;
+
+    if (!user) {
+      return ctx.unauthorized(ERROR_MESSAGES.INSUFFICIENT_PERMISSIONS);
+    }
+
+    try {
+      const userService = strapi.plugin(PLUGIN_ID).service(SERVICES.USER);
+      const keycloakUser = await userService.getUser(realmId, id, user);
+
+      ctx.body = { data: keycloakUser };
+    } catch (err) {
+      strapi.log.error(`[${PLUGIN_ID}] user.findOne error:`, err);
+      ctx.throw(400, err.sanitizedMessage || ERROR_MESSAGES.UNKNOWN_ERROR);
+    }
+  },
+
+  /**
+   * Create a new user
+   */
+  async create(ctx) {
+    const user = ctx.state.user;
+    const { realmId } = ctx.params;
+    const { data } = ctx.request.body;
+
+    if (!user) {
+      return ctx.unauthorized(ERROR_MESSAGES.INSUFFICIENT_PERMISSIONS);
+    }
+
+    try {
+      const userService = strapi.plugin(PLUGIN_ID).service(SERVICES.USER);
+      const keycloakUser = await userService.createUser(realmId, data, user);
+
+      ctx.body = { data: keycloakUser };
+    } catch (err) {
+      strapi.log.error(`[${PLUGIN_ID}] user.create error:`, err);
+      ctx.throw(400, err.sanitizedMessage || ERROR_MESSAGES.UNKNOWN_ERROR);
+    }
+  },
+
+  /**
+   * Update a user
+   */
+  async update(ctx) {
+    const user = ctx.state.user;
+    const { realmId, id } = ctx.params;
+    const { data } = ctx.request.body;
+
+    if (!user) {
+      return ctx.unauthorized(ERROR_MESSAGES.INSUFFICIENT_PERMISSIONS);
+    }
+
+    try {
+      const userService = strapi.plugin(PLUGIN_ID).service(SERVICES.USER);
+      const keycloakUser = await userService.updateUser(realmId, id, data, user);
+
+      ctx.body = { data: keycloakUser };
+    } catch (err) {
+      strapi.log.error(`[${PLUGIN_ID}] user.update error:`, err);
+      ctx.throw(400, err.sanitizedMessage || ERROR_MESSAGES.UNKNOWN_ERROR);
+    }
+  },
+
+  /**
+   * Delete a user
+   */
+  async delete(ctx) {
+    const user = ctx.state.user;
+    const { realmId, id } = ctx.params;
+
+    if (!user) {
+      return ctx.unauthorized(ERROR_MESSAGES.INSUFFICIENT_PERMISSIONS);
+    }
+
+    try {
+      const userService = strapi.plugin(PLUGIN_ID).service(SERVICES.USER);
+      await userService.deleteUser(realmId, id, user);
+
+      ctx.body = { data: { success: true } };
+    } catch (err) {
+      strapi.log.error(`[${PLUGIN_ID}] user.delete error:`, err);
+      ctx.throw(400, err.sanitizedMessage || ERROR_MESSAGES.UNKNOWN_ERROR);
+    }
+  },
+
+  /**
+   * Reset user password
+   */
+  async resetPassword(ctx) {
+    const user = ctx.state.user;
+    const { realmId, id } = ctx.params;
+    const { data } = ctx.request.body;
+
+    if (!user) {
+      return ctx.unauthorized(ERROR_MESSAGES.INSUFFICIENT_PERMISSIONS);
+    }
+
+    try {
+      const { password, temporary = true } = data;
+
+      if (!password) {
+        return ctx.badRequest('Password is required.');
+      }
+
+      const userService = strapi.plugin(PLUGIN_ID).service(SERVICES.USER);
+      await userService.resetPassword(realmId, id, password, temporary, user);
+
+      ctx.body = { data: { success: true } };
+    } catch (err) {
+      strapi.log.error(`[${PLUGIN_ID}] user.resetPassword error:`, err);
+      ctx.throw(400, err.sanitizedMessage || ERROR_MESSAGES.UNKNOWN_ERROR);
+    }
+  },
+
+  /**
+   * Enable a user
+   */
+  async enable(ctx) {
+    const user = ctx.state.user;
+    const { realmId, id } = ctx.params;
+
+    if (!user) {
+      return ctx.unauthorized(ERROR_MESSAGES.INSUFFICIENT_PERMISSIONS);
+    }
+
+    try {
+      const userService = strapi.plugin(PLUGIN_ID).service(SERVICES.USER);
+      await userService.enableUser(realmId, id, user);
+
+      ctx.body = { data: { success: true } };
+    } catch (err) {
+      strapi.log.error(`[${PLUGIN_ID}] user.enable error:`, err);
+      ctx.throw(400, err.sanitizedMessage || ERROR_MESSAGES.UNKNOWN_ERROR);
+    }
+  },
+
+  /**
+   * Disable a user
+   */
+  async disable(ctx) {
+    const user = ctx.state.user;
+    const { realmId, id } = ctx.params;
+
+    if (!user) {
+      return ctx.unauthorized(ERROR_MESSAGES.INSUFFICIENT_PERMISSIONS);
+    }
+
+    try {
+      const userService = strapi.plugin(PLUGIN_ID).service(SERVICES.USER);
+      await userService.disableUser(realmId, id, user);
+
+      ctx.body = { data: { success: true } };
+    } catch (err) {
+      strapi.log.error(`[${PLUGIN_ID}] user.disable error:`, err);
+      ctx.throw(400, err.sanitizedMessage || ERROR_MESSAGES.UNKNOWN_ERROR);
+    }
+  },
+
+  /**
+   * Send verification email
+   */
+  async sendVerifyEmail(ctx) {
+    const user = ctx.state.user;
+    const { realmId, id } = ctx.params;
+
+    if (!user) {
+      return ctx.unauthorized(ERROR_MESSAGES.INSUFFICIENT_PERMISSIONS);
+    }
+
+    try {
+      const userService = strapi.plugin(PLUGIN_ID).service(SERVICES.USER);
+      await userService.sendVerificationEmail(realmId, id, user);
+
+      ctx.body = { data: { success: true } };
+    } catch (err) {
+      strapi.log.error(`[${PLUGIN_ID}] user.sendVerifyEmail error:`, err);
+      ctx.throw(400, err.sanitizedMessage || ERROR_MESSAGES.UNKNOWN_ERROR);
+    }
+  },
+
+  /**
+   * Send password reset email
+   */
+  async sendResetPasswordEmail(ctx) {
+    const user = ctx.state.user;
+    const { realmId, id } = ctx.params;
+
+    if (!user) {
+      return ctx.unauthorized(ERROR_MESSAGES.INSUFFICIENT_PERMISSIONS);
+    }
+
+    try {
+      const userService = strapi.plugin(PLUGIN_ID).service(SERVICES.USER);
+      await userService.sendResetPasswordEmail(realmId, id, user);
+
+      ctx.body = { data: { success: true } };
+    } catch (err) {
+      strapi.log.error(`[${PLUGIN_ID}] user.sendResetPasswordEmail error:`, err);
+      ctx.throw(400, err.sanitizedMessage || ERROR_MESSAGES.UNKNOWN_ERROR);
+    }
+  },
+
+  /**
+   * Get realm roles
+   */
+  async getRoles(ctx) {
+    const user = ctx.state.user;
+    const { realmId } = ctx.params;
+
+    if (!user) {
+      return ctx.unauthorized(ERROR_MESSAGES.INSUFFICIENT_PERMISSIONS);
+    }
+
+    try {
+      const userService = strapi.plugin(PLUGIN_ID).service(SERVICES.USER);
+      const roles = await userService.getRoles(realmId, user);
+
+      ctx.body = { data: roles };
+    } catch (err) {
+      strapi.log.error(`[${PLUGIN_ID}] user.getRoles error:`, err);
+      ctx.throw(400, err.sanitizedMessage || ERROR_MESSAGES.UNKNOWN_ERROR);
+    }
+  },
+
+  /**
+   * Get user's roles
+   */
+  async getUserRoles(ctx) {
+    const user = ctx.state.user;
+    const { realmId, id } = ctx.params;
+
+    if (!user) {
+      return ctx.unauthorized(ERROR_MESSAGES.INSUFFICIENT_PERMISSIONS);
+    }
+
+    try {
+      const userService = strapi.plugin(PLUGIN_ID).service(SERVICES.USER);
+      const roles = await userService.getUserRoles(realmId, id, user);
+
+      ctx.body = { data: roles };
+    } catch (err) {
+      strapi.log.error(`[${PLUGIN_ID}] user.getUserRoles error:`, err);
+      ctx.throw(400, err.sanitizedMessage || ERROR_MESSAGES.UNKNOWN_ERROR);
+    }
+  },
+
+  /**
+   * Assign roles to user
+   */
+  async assignRoles(ctx) {
+    const user = ctx.state.user;
+    const { realmId, id } = ctx.params;
+    const { data } = ctx.request.body;
+
+    if (!user) {
+      return ctx.unauthorized(ERROR_MESSAGES.INSUFFICIENT_PERMISSIONS);
+    }
+
+    try {
+      const { roles } = data;
+
+      if (!roles || !Array.isArray(roles)) {
+        return ctx.badRequest('Roles array is required.');
+      }
+
+      const userService = strapi.plugin(PLUGIN_ID).service(SERVICES.USER);
+      await userService.assignRoles(realmId, id, roles, user);
+
+      ctx.body = { data: { success: true } };
+    } catch (err) {
+      strapi.log.error(`[${PLUGIN_ID}] user.assignRoles error:`, err);
+      ctx.throw(400, err.sanitizedMessage || ERROR_MESSAGES.UNKNOWN_ERROR);
+    }
+  },
+
+  /**
+   * Remove roles from user
+   */
+  async removeRoles(ctx) {
+    const user = ctx.state.user;
+    const { realmId, id } = ctx.params;
+    const { data } = ctx.request.body;
+
+    if (!user) {
+      return ctx.unauthorized(ERROR_MESSAGES.INSUFFICIENT_PERMISSIONS);
+    }
+
+    try {
+      const { roles } = data;
+
+      if (!roles || !Array.isArray(roles)) {
+        return ctx.badRequest('Roles array is required.');
+      }
+
+      const userService = strapi.plugin(PLUGIN_ID).service(SERVICES.USER);
+      await userService.removeRoles(realmId, id, roles, user);
+
+      ctx.body = { data: { success: true } };
+    } catch (err) {
+      strapi.log.error(`[${PLUGIN_ID}] user.removeRoles error:`, err);
+      ctx.throw(400, err.sanitizedMessage || ERROR_MESSAGES.UNKNOWN_ERROR);
+    }
+  },
+
+  /**
+   * Bulk import users
+   */
+  async bulkImport(ctx) {
+    const user = ctx.state.user;
+    const { realmId } = ctx.params;
+    const { data } = ctx.request.body;
+
+    if (!user) {
+      return ctx.unauthorized(ERROR_MESSAGES.INSUFFICIENT_PERMISSIONS);
+    }
+
+    try {
+      const { users } = data;
+
+      if (!users || !Array.isArray(users)) {
+        return ctx.badRequest('Users array is required.');
+      }
+
+      const userService = strapi.plugin(PLUGIN_ID).service(SERVICES.USER);
+      const result = await userService.bulkImport(realmId, users, user);
+
+      ctx.body = { data: result };
+    } catch (err) {
+      strapi.log.error(`[${PLUGIN_ID}] user.bulkImport error:`, err);
+      ctx.throw(400, err.sanitizedMessage || ERROR_MESSAGES.UNKNOWN_ERROR);
+    }
+  },
+
+  /**
+   * Export users
+   */
+  async exportUsers(ctx) {
+    const user = ctx.state.user;
+    const { realmId } = ctx.params;
+    const { format = 'json' } = ctx.query;
+
+    if (!user) {
+      return ctx.unauthorized(ERROR_MESSAGES.INSUFFICIENT_PERMISSIONS);
+    }
+
+    try {
+      const userService = strapi.plugin(PLUGIN_ID).service(SERVICES.USER);
+      const users = await userService.exportUsers(realmId, user);
+
+      if (format === 'csv') {
+        // Convert to CSV
+        const headers = ['id', 'username', 'email', 'firstName', 'lastName', 'enabled', 'emailVerified'];
+        const csvRows = [headers.join(',')];
+
+        for (const u of users) {
+          const row = headers.map((h) => {
+            const val = u[h];
+            if (val === undefined || val === null) return '';
+            if (typeof val === 'string' && val.includes(',')) return `"${val}"`;
+            return String(val);
+          });
+          csvRows.push(row.join(','));
+        }
+
+        ctx.set('Content-Type', 'text/csv');
+        ctx.set('Content-Disposition', `attachment; filename="keycloak-users-${realmId}.csv"`);
+        ctx.body = csvRows.join('\n');
+      } else {
+        ctx.body = { data: users };
+      }
+    } catch (err) {
+      strapi.log.error(`[${PLUGIN_ID}] user.exportUsers error:`, err);
+      ctx.throw(400, err.sanitizedMessage || ERROR_MESSAGES.UNKNOWN_ERROR);
+    }
+  },
+});
+
+export default userController;

package/server/src/destroy.js

@@ -0,0 +1,5 @@
+const destroy = ({ strapi }) => {
+  // Cleanup if needed
+};
+
+export default destroy;

package/server/src/index.js

@@ -0,0 +1,21 @@
+import bootstrap from './bootstrap.js';
+import register from './register.js';
+import destroy from './destroy.js';
+import config from './config/index.js';
+import contentTypes from './content-types/index.js';
+import controllers from './controllers/index.js';
+import services from './services/index.js';
+import policies from './policies/index.js';
+import routes from './routes/index.js';
+
+export default {
+  bootstrap,
+  register,
+  destroy,
+  config,
+  contentTypes,
+  controllers,
+  services,
+  policies,
+  routes,
+};

package/server/src/policies/can-access-realm.js

@@ -0,0 +1,26 @@
+import { PLUGIN_ID, SERVICES } from '../constants.js';
+
+const canAccessRealm = async (policyContext, config, { strapi }) => {
+  const { realmId, id } = policyContext.params;
+  const user = policyContext.state.user;
+
+  // Determine which parameter holds the realm ID
+  const targetRealmId = realmId || id;
+
+  if (!user || !targetRealmId) {
+    return false;
+  }
+
+  const permissionService = strapi.plugin(PLUGIN_ID).service(SERVICES.PERMISSION);
+
+  // Super admins can access all realms
+  if (permissionService.isSuperAdmin(user)) {
+    return true;
+  }
+
+  // Check specific permission
+  const permission = config?.permission || 'canRead';
+  return permissionService.canAccessRealm(user, targetRealmId, permission);
+};
+
+export default canAccessRealm;

package/server/src/policies/index.js

@@ -0,0 +1,7 @@
+import isAuthenticated from './is-authenticated.js';
+import canAccessRealm from './can-access-realm.js';
+
+export default {
+  'is-authenticated': isAuthenticated,
+  'can-access-realm': canAccessRealm,
+};

package/server/src/policies/is-authenticated.js

@@ -0,0 +1,5 @@
+const isAuthenticated = (policyContext) => {
+  return Boolean(policyContext.state.user);
+};
+
+export default isAuthenticated;

package/server/src/register.js

@@ -0,0 +1,7 @@
+import { PLUGIN_ID } from './constants.js';
+
+const register = ({ strapi }) => {
+  strapi.log.info(`[${PLUGIN_ID}] Plugin registered successfully`);
+};
+
+export default register;